← back to field/hole
through the hole
all notes
The ring is not a fourth main. It is a hole. Everything that has been written is here, including scraps that did not earn a public fold.
- Aug 5, 2025/articleGroth16From arithmetic circuits through R1CS and QAP to Groth16's three-element proof, trusted setup toxic waste, and the single pairing verification equation.
- Aug 1, 2025/articleAnalysis of ZKP implementation vulnerabilities: under-constrained inputs and Frozen HeartHow missing binary constraints on MultiMux1 selectors break BinaryMerkleRoot/Semaphore membership proofs, and how omitting public inputs from Fiat–Shamir transcripts enables Frozen Heart forgery in PlonK implementations.
- Jul 31, 2025/articleDeposit Forwarder SystemArchitecture for per-user deterministic deposit contracts: factory, master forwarder roles, and ETH/ERC-20 forward flows for an exchange backend.
- Jul 23, 2025/articleExploring KZG polynomial commitmentsWhy constant-size polynomial commitments beat per-coefficient Pedersen commits, how pairings and t-SDH/t-BSDH underwrite KZG, and the Setup / Commit / CreateWitness / VerifyEval flow.
- Jul 6, 2025/articleExploring PlonKProver-side walkthrough of PlonK: gate and wiring constraints, polynomial compilation, the five proof rounds, and how the verifier checks the batched opening.
- Dec 20, 2023/articleBlockchain data availability and blobspaceHow light clients face the data availability problem, what Celestia, EigenDA, and DACs change, and how EIP-4844 blobs, KZG, and danksharding reshape rollup throughput.
- Mar 3, 2023/articleBlockchain infrastructure and consensus protocol securityStudy notes on PoW vs PoS, finality, and BFT- versus chain-based stake protocols, framed by a survey of long-range attacks on Proof-of-Stake.
- Mar 3, 2023/articleLong-range attacks on Proof of Stake — survey notesStudy notes on long-range attacks in PoS: costless simulation, weak subjectivity, simple / posterior-corruption / stake-bleeding variants, and why no single mitigation closes the class.
- Feb 2, 2023/articleUniswap V2 math and contract reviewCPMM price rules, marginal price, TWAP oracle, flash swaps, EIP-712 permits, UQ112.112 fixed-point, protocol fees, sync/skim, and a walk through v2-core and v2-periphery.
- Jan 30, 2023/articleAMM and PMM mechanisms: math beyond the limit order bookFrom LOB limits to AMM conservation functions: actors, assets, slippage, divergence loss, and a state-space formalization of swaps and liquidity changes.
- Jan 25, 2023/articleEthereum P2P eclipse attacks (geth-era study notes)Paper notes on low-resource eclipse attacks against Ethereum's Kademlia-style discovery: why ECDSA node IDs and connection bias mattered before geth v1.8, and what changed.
- Jan 19, 2023/articleEVM storage layout collisions and upgradeable proxiesHow Solidity packs storage slots, how proxy + delegatecall share that layout, where upgradeable proxies collide, and the usual mitigations (EIP-1967-style slots, initializers, pattern choices).
- Aug 4, 2022/articleUniswapV2 subgraph event queriesHow The Graph indexes contract events: subgraph manifests, GraphQL schemas, AssemblyScript handlers, and a local graph-node deploy for a Swapper-style Uniswap flow.
- Aug 3, 2022/articleUniswap V2 smart contractsUniswap V2 core and periphery: Factory, Pair, Router, LP tokens, mint/burn/swap paths, reserve updates, and a swapper/subgraph lab section.
- Aug 1, 2022/articleSolana programs and Web3 APIWalkthrough of Solana web3.js patterns: connect, keypair, airdrop, transfer, deploy a hello-world program, create greeting accounts, and read/write on-chain state.
- Jul 31, 2022/articleSolana transactionsHow Solana transactions bundle instructions, list accounts up front for parallel execution, and charge deterministic fees with a recent blockhash.
- Jul 31, 2022/articleSolana on-chain programsHow Solana separates executable programs from account data, what native and SPL programs provide, and how Rust programs are structured and deployed.
- Jul 31, 2022/articleSolana accounts modelHow Solana accounts store state: data vs program accounts, PDA limits, ownership rules, rent, and the fields every account carries.
- Jul 31, 2022/articleSolana Program Derived AddressesHow Solana PDAs are discovered off the ed25519 curve via seeds and bumps, signed with invoke_signed, and used as program-controlled account indexes.
- Dec 31, 2021/articleCloud Vulnerability Lab 6 (CloudGoat: EC2 SSRF)CloudGoat EC2 SSRF path: Solus reads Lambda env keys for Wrex, SSRF hits IMDS, S3 yields Shepard admin creds, then invoke the target Lambda.
- Dec 31, 2021/articleCloud service vulnerability analysis 5 (CloudGoat: IAM privilege escalation by attachment)CloudGoat iam_privesc_by_attachment: from Kerrigan's limited IAM user, swap a meek instance profile for a mighty role, launch an EC2 foothold, and terminate the super-critical server.
- Dec 31, 2021/articleCloud Service Vulnerability Lab 4 (CloudGoat: Cloud Breach S3)Walkthrough of CloudGoat's cloud_breach_s3 scenario: abuse a misconfigured reverse proxy to reach IMDS, steal the instance-profile keys, and sync confidential objects out of a private S3 bucket.
- Dec 31, 2021/articleCloud Vulnerability Lab 2 (CloudGoat: IAM Privilege Escalation by Rollback)CloudGoat walkthrough: start as limited IAM user Raynor, find SetDefaultPolicyVersion, roll back to a policy version with full admin, and confirm the privilege jump.
- Dec 31, 2021/archiveCloud service vulnerability analysis 1: CloudGoat lab setupInstall Rhino Security Labs CloudGoat, create an admin IAM user for lab control, and wire AWS CLI plus CloudGoat profile/whitelist config.
- Dec 31, 2021/articleCloud service vulnerability analysis 0: overviewSeries opener on cloud security: public vs private clouds, OpenStack/Nova basics, and AWS IAM, EC2, S3, and Lambda as the usual attack surface.
- Dec 26, 2021/articleWeb Application SSRF / XXE / SSTI Research NotesPractical notes on SSRF (including gopher into MySQL), XXE (file read and blind OOB), and Jinja2 SSTI sandbox escape via MRO and subprocess.
- Dec 25, 2021/archiveWeb application RCE patternsShort notes on common remote code execution paths in PHP file inclusion, Node.js eval/injection, and Flask/Jinja2 server-side template injection.
- Dec 24, 2021/articleVulnerability analysis of commercial metaverse-based virtual office platformsBoB MetaVersPloit team report: methodology, common features, and attack impact across Gather, oVice, Kumospace, Spatial, and Horizon Workrooms — 31 findings in four months.
- Apr 1, 2021/archiveHyper-V Ubuntu 20.04 Full-Screen FixSet Ubuntu 20.04 on Hyper-V to 1920x1080 by editing GRUB's hyperv_fb mode, updating grub, and rebooting.
- Mar 30, 2021/archiveWindows heap management layersHow Windows memory allocation stacks from the kernel manager through VirtualAlloc, the heap APIs, malloc/free, and new/delete — and when each layer is the wrong tool.
- Mar 1, 2021/articleLinked-List Attack Surface on Intel (Structure Notes)Singly linked list layout, insert/remove helpers, and Intel disassembly of nodeAlloc/nodeSet/Init/frontInsert/rearInsert/rearRemove with IDA struct recovery and heap traces.
- Feb 10, 2021/archiveARM Load/Store Multiple Register InstructionsHow ARM and Thumb LDM/STM move register sets, the four addressing modes, and how those instructions implement push/pop and nested subroutine frames.
- Feb 10, 2021/archiveARM LDR Rd, =constHow the LDR Rd, =const pseudo-instruction builds 32-bit immediates via MOV/MVN or a literal pool, and when LTORG keeps the pool in range.
- Feb 10, 2021/archiveARM Data Transfer: Pre/Post-Index and STR/LDRHow ARM moves data between registers and memory with LDR/STR, and how pre-index versus post-index addressing updates the base register.
- Feb 10, 2021/archiveARM: loading constants into registersWhy you cannot load an arbitrary 32-bit immediate in one ARM instruction, and how MOV and MVN cover the common cases without a separate memory load.
- Feb 10, 2021/archiveARM: Loading Addresses into RegistersADR/ADRL vs LDR Rd,=label for address materialization, jump-table patterns, and string-copy examples in ARM and Thumb.
- Feb 9, 2021/archiveARM and Thumb instructionsLoad/store and 3-address data processing on ARM, conditional execution, barrel-shifter operands, and how Thumb differs on registers, flags, and branches.
- Feb 9, 2021/archiveARM RegistersQuick reference for ARM's banked registers, general-purpose roles (r0–r15), CPSR flags, and SPSR exception state.
- Feb 9, 2021/archiveARM conditional executionHow ARM and Thumb update CPSR flags, which condition codes exist, and how predicated instructions shrink Euclid's GCD compared with branch-heavy code.
- Feb 9, 2021/archiveARM Assembly 1ARM instruction layout, labels, AREA/ENTRY/END, BL-based subroutines, and switching between ARM and Thumb with CODE32/CODE16 and BX.
- Feb 9, 2021/archiveARM architecture overviewCISC vs RISC tradeoffs, the seven classic ARM processor modes, CPSR mode bits, and how Thumb state differs from ARM state.
- Jan 3, 2021/archiveTEB (Thread Environment Block)Windows TEB layout, how NtCurrentTeb and FS:[0x18]/0x30]/0] resolve TEB, PEB, and SEH, and how the FS segment selector indexes the descriptor table.
- Jan 3, 2021/archiveWindows SEH (Structured Exception Handling)How Windows SEH chains work, how debuggers interact with exceptions, common NTSTATUS codes, and the TEB ExceptionList entry point.
- Jan 3, 2021/archiveWindows SEH chain and TEB ExceptionListHow Windows builds the per-thread SEH singly-linked list on the stack, how FS:[0] and the TEB point at it, and how to walk the chain in WinDbg.
- Jan 3, 2021/archiveWindows PEB (Process Environment Block)How user-mode code reaches the PEB via FS:[30], what BeingDebugged / ImageBaseAddress / Ldr / ProcessHeap expose, and how module lists hang off PEB_LDR_DATA.
- Jan 3, 2021/archiveTLS (Thread Local Storage) CallbacksHow Windows PE TLS directories and IMAGE_TLS_CALLBACK hooks run before the entry point, and why reverse engineers care for anti-debugging.
- Dec 20, 2020/archiveWindows GUI binary fuzzer (dumb fuzzing)Notes on a PyQt dumb fuzzer for Windows PE binaries: install path for PaiMei/pydbg on Python 2.7, CLI flags, and GUI blueprint screenshots.
- Dec 20, 2020/articleSQLite3 fts3_tokenizer() Remote Code Execution ResearchHow a PHP sandbox with disabled system functions can still fall to RCE via SQLite3 fts3_tokenizer: leak the module base, hijack tokenizer callbacks, pivot the stack, and call system on both x86 and x86_64.
- Sep 18, 2020/articleSSTF 2020 t_express WriteupHeap note on t_express: off-by-one ticket_type overwrite, negative index stderr leak, tcache key forge for double free, then __free_hook to system.
- Sep 18, 2020/articleDEF CON 2016 xkcd writeupStatically linked xkcd challenge: a heartbeat-style reply buffer sits 0x200 bytes before the flag in .bss, so an overstated length turns strlen into an out-of-bounds read.
- Sep 18, 2020/articleDEF CON 2016 feedme Vulnerability AnalysisWriteup for DEF CON 2016 feedme: fork-stable canary brute-force across child processes, then a static-binary ROP chain to read /bin/sh into .bss and execve.
- Aug 16, 2020/articleHITCON 2017 Sakura writeupHITCON 2017 Sakura: 400 bytes of input feed a huge sub_850 checker; angr finds satisfying paths by locating the shared false-store pattern and exploring every third true branch.
- Aug 16, 2020/archiveELF Analysis ToolsPractical notes on objdump, strace, ltrace, and readelf for inspecting ELF sections, symbols, syscalls, and dynamic linking.
- Aug 16, 2020/archiveELF program headersHow ELF program headers describe loadable segments — PT_LOAD, PT_DYNAMIC, PT_NOTE, PT_INTERP, PT_PHDR — and what readelf -l shows for text versus data.
- Aug 16, 2020/archiveELF file formatELF object types (NONE, REL, EXEC, DYN, CORE) and the ELF header fields that describe entry point, program headers, and section headers.
- Aug 16, 2020/archiveDevice Files Useful for ELF AnalysisProcfs and boot artifacts that help map process and kernel memory when reversing ELF binaries: maps, kcore, System.map, kallsyms, and iomem.
- Aug 16, 2020/archiveLinux Linker Environment VariablesNotes on LD_PRELOAD, LD_SHOW_AUXV, and how linker scripts shape ELF section and segment layout.
- Aug 15, 2020/archiveFixing Python locale errors in Docker UbuntuHow to clear locale.Error: unsupported locale setting in an Ubuntu Docker container so pip install works again.
- Aug 15, 2020/articleCodeGate 2017 angrybird writeupCodeGate 2017 angrybird: patch early exits and canary-related checks, then use angr from 0x4007c2 to recover the 20-byte input that reaches the final printf.
- Aug 14, 2020/articleUsing angr for Binary Analysis, Part 3Walkthrough of the fauxware sample with angr: find the accept path, avoid the reject branch, and recover inputs from forked simulation states.
- Aug 14, 2020/archiveangr binary analysis notes 2: the loaderCLE loader internals in angr: loaded objects, symbols and relocations, load options, backends, SimProcedure summaries, and hooking.
- Aug 14, 2020/archiveUsing angr for Binary Analysis, Part 1A working tour of angr's Project, CLE loader, factory helpers, SimState, simulation managers, analyses, and explore/find paths.
- Jun 9, 2020/archiveGDB cheat sheetA compact GDB reference: startup, help, breakpoints, stack frames, source navigation, print/x examine formats, and register stepping.
- Jun 6, 2020/archiveHow to Install the Burp Suite CA CertificateSet Chrome to use Burp Suite as a proxy and install Burp's CA certificate as a trusted root so HTTPS interception works without certificate warnings.
- Jun 5, 2020/archiveMetasploit architecture and filesystem layoutWhere Metasploit lives on Kali, what each top-level directory holds, and how modules, plugins, scripts, and tools fit together.
- Jun 5, 2020/archiveMetasploit Lab SetupHardware baselines and lab layout for running Metasploit against Metasploitable and Windows VMs without exposing them to the public internet.
- Jun 2, 2020/archiveWindows PE File FormatWalkthrough of the Portable Executable layout using calc.exe: DOS header, NT headers, optional header fields, data directories, and section characteristics.
- Jun 1, 2020/archiveVulnerabilities and exploits — a field taxonomyWorking definitions of vulnerability and exploit, memory-corruption bug classes with small unsafe-pattern examples, and the local vs remote exploit distinction.
- May 29, 2020/archiveLua language notesA compact field guide to Lua syntax: comments, variables, control flow, functions, tables, metatables, class-like patterns, and modules.
graph/feed