Building a Debugger is now officially released! It guides you through building a whole native x64 debugger from scratch, dispelling all the magic and teaching you a ton about operating systems as it goes. Even if you don't care about building a debugger, you can read it to your cat.

Our OffensiveCon talk on stateful baseband emulation (and how improper string handling led to baseband RCE) is available on YouTube: youtu.be/zoAITq7jUM8. It has been a pleasure; awesome conference, brilliant people. Slides and paper: www.danielklischies.net/research/bas...

A small slide deck for a 15 minute impulse talk at Cycon 2025 in Talinn: docs.google.com/presentation...

This time a little bit of something about concurrent programming in Rust: carstein.github.io/rust/2025/05...

A friend of mine is organizing a course about reversing binary files and protocols: hackarcana.com/workshop-ses... recommendation++

I had so much hope for MPK but why oh why is the PKRU register writable from the user space...

This time something non-technical: carstein.github.io/short/2025/0...

Still experimenting with struct diagraming. Any recomendations for tools like asciiflow?

Wrote a short article about structures in C and Rust: carstein.github.io/rust/2025/03... This is pretty much teaser about upcoming KVM series.

I've started writing a short intro to KVM and realized all C struct visualizers suck, so I had to make my own pictures by hand. Still doesn't look like I imagined it in my head.

Today I'm just chillin

I’m very excited to announce that we at V8 Security have finally published our first version of Fuzzilli that understands Wasm! Go check it out at https://github.com/googleprojectzero/fuzzilli. While we still have a way to go in improving it, we think it shows a promising approach!

It's out and make for a very interesting read: github.com/google/secur... IMO, AMD should own it and release a microcode SDK.... @sirdarckcat.bsky.social

Roughly three weeks ago I was invited as a guest speaker by guys from @doyensec.bsky.social for their lunch and learn session. Such invitations are great because and I greatly appreciate them. Yesterday I have recived this 'thank you' gift. You guys rock.

Refuting a bullshit bug bounty report from (probably) a LLM is my least favorite way to spend my friday afternoon. What a waste of time and energy. Hashtag BegBount.

And the prize for the least irony-aware crowd goes to linkedin commentators. www.linkedin.com/posts/austin...

Looks like I'm going to offensiveCon. See you all there.

Great talk by Dominik! #cybersecurity #vulnerability #securityresearch #0day #bugbounty #fuzzing

I've started using ghostty (as an experiment). I like it, it works well and I really like the default theme. Right, I love how it looks but I have zero idea what it is the default theme. It just doesn't seems to be saved anywhere so I can't set the same theme in all other apps. I'm sad.

Project Zero is hiring 👀 No need to tell y'all that the team is awesome

In the end everything was ok. It turned out all components were working correctly but for some reason my monitor wasn't. It was strange - laptop connected via usb-c was ok, but display port was not. Troubleshooting tip: never assume anything, check everything.

Bit unorthodox, but ... Watching videos like www.youtube.com/watch?v=Y891... gives me some thought. If you are a large organization looking for a PM, TPM or a manager you should have your recruiters trawling games like this (or EVE) in search of a capable candidates.

Last PC I built from scratch was almost 10 years ago. I was not looking forward to the next one - I hate cabling, I hate how modern PCs are just a nest of wires and there is a little elegance while one crams all those unwieldy cabling around the badly manufactured chasis.

I thinks Steve is my spirit animal

All the @chompie.rip presentations have great content but the graphics... I would kill for having such great slides.

Watch the recording of my #ekoparty talk "Advanced #Fuzzing with #LibAFL" here: youtu.be/FI7C37lz4Rg?... Thanks @fede-k.bsky.social for this amazing event!

Would you like to work with great folks to secure something important? LinkedIn security is hiring -- with more roles coming, including a Sr. Director for Risk and Compliance. I'd love to work with you! No jerks, please.

I was the victim as awell - pwned via a modified rustc wrapper on a repo that the rust-analyzer run automatically upon opening. So, beware what repo you clone and open :)

Yet again I need to pass the opportunity to intern at Vector 35 because they require permission to work in US. What happened to a proud american tradition of hiring undocumented migrants to do the work nobody else wants to do - like writing unit tests? On more serious note - y'all should apply.

Pro-tip: after doing an interview don't immediately attempt to connect with the person doing the interview on LinkedIn. There is nothing wrong with it but at least wait till you know the outcome of the recruitment - otherwise it is bit weird and you put the person in awkward situation.

If you enjoy programming and lower levels of the stack, this is a talk you want to watch: www.youtube.com/watch?v=WDfr...

Guess what just arrived. @halvarflake.bsky.social do you want to test it?

100 days. 300 words per day. About pretty much anything. That was a task I set for myself. It was a little bit about getting back to the rythm of writing but mostly it was about forcing myself to use the split keyboard that I have built - and I can slowly see the effects.

#BookChallenge #1 Peter Watts / Echopraxia

Internet: oh lol, how could you even leave the running webshell on a server you were pentesting me who left a meterpreter on a production box for over a year:

So many new followers, so much expectations, such a strong temptation to slump into shitposting...

Just wrote up some basic article how to handle Errors in Rust - the intro is just Rust 101 but I also wanted to share some less-basic tips. carstein.github.io/rust/2024/11...

For armchair generals among us - this just got released: www.youtube.com/watch?v=WJZR...

That looks quite interesting if you are into this kind of things.

In Rust, when you want to have a collection of different trait objects you face certain restrictions - namely your implementation must be object-safe. That eliminates `async` functions because they return `impl Future`. You can either implement that async yourself or use docs.rs/async-trait/...

I am slowly returning to writing and I have decided to reuse some of my older content. I originally published it as a series of notes on Mastodon but I think it would be a good idea (or not) to immortalize it here. After all I need to publish something here. carstein.github.io/short/2024/1...