Recent Posts

  • Oct 17, 2026reverse-engineering14 min read
    Sentinel Values, Pool Modes, and Other Clues to Runtime Architecture

    A four-slot pool meets a twelve-rule request. Tracing allocation, boot phases, and error handling shows how firmware can report boot complete after partition binding fails.

  • Oct 17, 2026reverse-engineering15 min read
    Register Maps, MMIO Blocks, and Other Hardware Buried in Code

    Seven peripheral blocks emerge from the MIPS code. Following loads and stores reveals 39 register addresses, and shows why a base address, an interrupt mask, or a boot marker cannot tell the whole story.

  • Oct 17, 2026reverse-engineering15 min read
    Radare2, Ghidra, and Other Ways to Tear Apart a Binary

    Table searches are easy. Checking cross-references, function boundaries, and decompiler guesses takes more care. One raw MIPS image shows where radare2, Ghidra, and Capstone agree, and where they need help.

  • Oct 16, 2026security14 min read
    When Randomness Fails

    Real entropy failures have different causes. A 150-billion-probe synthetic run gives us a measurable search result, provided we keep its model attached to the numbers.

  • Oct 16, 2026security8 min read
    Where Bitcoin Keys Actually Die: A Scanner Experiment

    Four candidate generators, a dated funded-address snapshot, and zero snapshot matches. The useful evidence is in exactly what the scanner tested.

  • Oct 16, 2026security6 min read
    Seed Phrases, Entropy, and the Myth of the Narrowed Search

    Twelve words encode less entropy than twenty-four. Following BIP39 and BIP32 shows what that changes for guessing a seed, recovering a key, and backing up a wallet.

  • Oct 16, 2026security6 min read
    The Database of All Bitcoin Private Keys Is a Magic Trick

    A private-key directory calculates its pages on demand. Building the trick shows why displaying a keyspace and searching it are different jobs.

  • Oct 15, 2026reverse-engineering16 min read
    Offsets, Embedded Nodes, and Other Phantoms of Lost Structs

    In Part 1, we identified AES, SHA-256, and CRC-32 from constant tables in .rodata. CRC-16 had no table, so we inspected its code to identify the algorithm and its parameters.

  • Oct 15, 2026security8 min read
    Nobody Broke the Math

    A hardware wallet can generate an unpredictable secret and still give it away. That distinction starts a series on Bitcoin keys, entropy, and failed randomness.

  • Oct 8, 2026reverse-engineering14 min read
    S-Boxes, Hash Constants, and Other Cryptographic Fingerprints

    The first series ended with an 8 KB MIPS32 firmware and a set of ways to read it. This time we have a 38,616-byte flat binary. Before following its code, we need to answer a...

Browse all 39 posts by category →