Archive
All Posts (39)
- Sentinel Values, Pool Modes, and Other Clues to Runtime Architecture
A four-slot pool meets a twelve-rule request. Tracing allocation, boot phases, and error handling shows how firmware can report boot complete after partition binding fails.
- Register Maps, MMIO Blocks, and Other Hardware Buried in Code
Seven peripheral blocks emerge from the MIPS code. Following loads and stores reveals 39 register addresses, and shows why a base address, an interrupt mask, or a boot marker cannot tell the whole story.
- Radare2, Ghidra, and Other Ways to Tear Apart a Binary
Table searches are easy. Checking cross-references, function boundaries, and decompiler guesses takes more care. One raw MIPS image shows where radare2, Ghidra, and Capstone agree, and where they need help.
- When Randomness Fails
Real entropy failures have different causes. A 150-billion-probe synthetic run gives us a measurable search result, provided we keep its model attached to the numbers.
- Where Bitcoin Keys Actually Die: A Scanner Experiment
Four candidate generators, a dated funded-address snapshot, and zero snapshot matches. The useful evidence is in exactly what the scanner tested.
- Seed Phrases, Entropy, and the Myth of the Narrowed Search
Twelve words encode less entropy than twenty-four. Following BIP39 and BIP32 shows what that changes for guessing a seed, recovering a key, and backing up a wallet.
- The Database of All Bitcoin Private Keys Is a Magic Trick
A private-key directory calculates its pages on demand. Building the trick shows why displaying a keyspace and searching it are different jobs.
- Offsets, Embedded Nodes, and Other Phantoms of Lost Structs
In Part 1, we identified AES, SHA-256, and CRC-32 from constant tables in .rodata. CRC-16 had no table, so we inspected its code to identify the algorithm and its parameters.
- Nobody Broke the Math
A hardware wallet can generate an unpredictable secret and still give it away. That distinction starts a series on Bitcoin keys, entropy, and failed randomness.
- S-Boxes, Hash Constants, and Other Cryptographic Fingerprints
The first series ended with an 8 KB MIPS32 firmware and a set of ways to read it. This time we have a 38,616-byte flat binary. Before following its code, we need to answer a...
- From an AER Log to a PCIe Failure Story
AER tells us who reported an error. A TLP header tells us what was on the wire. Two storage incidents show why we need both, and why neither is the whole story.
- Versions, Callgraphs, and other ways to compare what changed
In Part 4, we tried to recompile 191 decompiled C files and hit 2,896 unresolved symbols. We learned why firmware linking is fundamentally different from userspace linking, and concluded that binary patching – the four-byte...
- tlp-tool and the Next Phase of PCIe Debugging
A kernel 7.0 documentation patch pointed PCIe AER debugging at tlp-tool. The linux-pci discussion that followed surfaced a real Flit Mode debugging hazard -- and the tool changed in response.
- Symbols, Scripts, and other linking nightmares
In Part 3, we patched a four-byte bug in the firmware’s route engine and recalculated the CRC. Four bytes – problem solved. But as we noted at the end: what if the fix was not...
- Decompilers, Annotations, and other ways to read the unreadable
In Part 2, we mapped the major functions, string references, and 16 CLI commands using nothing but strings, pattern matching, and a Python script. That left us with a suspicious route-engine string:
- Opcodes, Prologues, and other hidden patterns
In Part 1, we built a flat MIPS32 firmware binary and stared at 8,496 bytes with no headers, no symbols, and no sections. file said “data.” readelf said nothing. We left off with a question:...
- Headers, Symbols, and other things you won't find
Eight years ago I wrote ELF’s Linker’s and other magical creatures – a walkthrough of the ELF binary format, relocations, segments, and even live code injection through /proc/pid/mem. That post ended in a comfortable place:...
- Before the BSD Kernel Starts: Part Two ARMv8
Note: This article was written in 2020 as a companion to Part One (AMD64) but was never published. The technical content reflects the state of NetBSD and the RK3399 platform at that time. Published here...
- rust_tlplib and tlp-tool 0.5.0: PCIe 6.0 Flit Mode
The rust_tlplib and rtlp-tool libraries had not seen a release in a long time. After getting Gen 4 TLP parsing to a point where it covered everything I needed day-to-day, I left it there. Good...
- A Transformer Block in CUDA
December, somewhere over the Pacific on the way to Tokyo. The letGPU challenge open in one browser tab, Ro Salaverry’s The Scaling Era: An Oral History of AI, 2019–2025 on my Kindle. No plan beyond...
- The GPT-2 Decoder Block: Before Writing Any Code
At university, long before the current AI period, neural networks were still niche. Academic appeal, limited hardware, results that rarely justified the compute. We wrote simple recurrent networks in C, used them in robotics and...
- Implement ls
I ask this in interviews sometimes. Not as a gotcha — as a conversation starter. “Implement ls.” Four words. The answer tells you a lot about where someone’s mental model of the OS ends.
- How to Parse PCIe TLPs
PCIe devices are everywhere, but when one misbehaves the kernel logs you with raw TLP headers and no explanation. This post is about making sense of those bytes.
- Before the BSD Kernel Starts: Part One AMD64
Note: This article was originally written for and published at Moritz Systems in November 2020. Their website is no longer available; the content is republished here in its original form. The web archive version can...
- Debugging FFS Mount Failures
Note: This post was originally written in 2019 and has been lightly refreshed for clarity. The content and examples are unchanged — just the presentation got a coat of paint.
- Fuzzing NetBSD Filesystems via AFL — Part 2
Note: This post was originally written in 2019 and has been lightly refreshed for clarity. The content and examples are unchanged — just the presentation got a coat of paint.
- Write Your Own Fuzzer for the NetBSD Kernel
Note: This post was originally written in 2019 and has been lightly refreshed for clarity. The content and examples are unchanged — just the presentation got a coat of paint.
- Short Story of Pages and Virtual Memory: Writing FS for Fun
Followup Writing Linux Filesystem For Fun After my presentation “Writing Filesystem for Fun” that I did during May C/Cpp meetup I recieved many questions and positive comments. Thus I wanted to do second part of...
- EuroBSDCon 2018
This year I attended the EuroBSD conference in Bucharest as a presenter. During my talk, I summarized last year of research and development of Live-patching feature for the FreeBSD kernel.
- Livepatching the kernel
One of the interesting features of the modern operating systems is live-patching: availability to do updates of the kernel without the need of rebooting the system. Updates without any downtime can be beneficial for businesses...
- ELF's Linker's and other magical creatures
One of the popular topics on many engineering blogs is program startup and ELF file structure. Given that fact, a reader may have some objections about whether another post about ELF makes sense or not....
- Writing Linux Filesystem for Fun
In May 2018 I gave a talk for the C/C++ Dublin meetup at the MongoDB office — starting from the historical background of Unix filesystems and finishing with a working implementation of a simple filesystem...
- Digging into Linux FileSystems
UNIX Filesystem story goes back to the first implementation of the operating system. Since then, many different implementations and improvements were made. Due to that FileSystems became quite composed but also rock solid piece of...
- How to Abstract Hardware Accelerator
At the 2017 Xen Developer Summit I presented on abstracting hardware acceleration devices in cloud environments — covering accelerators in general, then drilling into what virtualization and multi-tenancy actually demand from the hardware and driver...
- The Xen way
What is Xen? In terms of open source hypervisor main players are: KVM and Xen, these projects can be used on a personal laptop as well as in commercial. There are also: Virtual Box which...
- Qemu for the impatient
Why not using qemu? In this article, I am trying to provide some useful qemu configuration for debugging or evaluation purposes. I will assume that reader is already using qemu so I am not going...
- Overlays and underlays networks in SDN
The phenomenon that can be observed nowadays is the exponential growth of the internet. Certainly there can be not a shred of a doubt here just a month ago as the IPv4 addresses ran out,...
- Simple Rootkit
The most intuitive way to write code for linux kernel is to add some code in kernel sources, recompile it and run. This approach is not terribly time consuming because kernel recompilation (even with cc)...
- Single Bit Operations Cheatsheet for C Programmers
Note: This post was originally written in 2015 and has been lightly refreshed for clarity. The content and examples are unchanged — just the presentation got a coat of paint.
subscribe via RSS