Reversing a custom key exchange and stream cipher to get on the wire, then a refcounted free that leaves a live pointer, ending in House of Apple on _IO_2_1_stdout_
A transfer that frees a ledger and then copies the dangling pointer into the destination, turned into tcache poisoning, a forged wallet struct and a GOT overwrite
An off-by-one that lands the frame CRC byte on a capacity field, stretching the dump command until it spills the canary and a PIE pointer
A textbook printf(buf) with eight tries, leaking PIE and libc off the stack then overwriting printf@got with system in a single format call
A hand-rolled printf with an undocumented %w specifier that writes one vararg to the address in another, turned into a GOT overwrite on strcspn
A ROP chain limited to three bytes per call, used to speak to a seccomped child process over its socketpair and hand it a negative vault index
Proving a stripped validator is secret-independent, re-implementing its integrity VM and XOR keystream, then taking the uncapped base credit path the 40000 bonus cap was there to hide
Winning a double-fetch race in a Windows capture driver, where the bump allocator alignment that blocks a single-threaded overflow becomes the thing that guarantees the corruption lands
Escaping a Lua 5.5 bytecode sandbox by writing registers past the end of the stack, hijacking a table array pointer, and swapping global_State.frealloc for system
Writeup for Weird config updater from NDIAS Automotive/IoT CTF 2026. A ZIP parser-differential between the validation and extraction paths lets a debug config slip through a release-only check.
Writeup for Chusembly from EHAX CTF 2026. A miscellanious challenge involving sandbox escape and arbitrary Python code execution via an unrestricted custom assembly interpreter.
Pwn/Concurrency challenge involving a TOCTOU race condition where input pipelining is used to beat a 1ms thread timer.
