All Posts
Traversing a VMA red-black tree in Linux
void dfs(struct rb_node *node) { struct vm_area_struct *vma; vma = rb_entry(node, struct vm_area_struct, vm_rb); trace_printk("VMA: [0x%px - 0x%px]", (void *)vma->vm_start, (void *)vma->vm_end); if (node->rb_left) dfs(node->rb_left); if (node->rb_right)...
“parent” vs. “real_parent” in struct task_struct
What is the difference between “parent” and “real_parent” in struct task_struct?
read moreHow (not) to use checkpatch.pl with Python 2
How to install pip for Python 2, if you _really_ have to.
read moreCross-compiling an m68k v5.9 Linux Kernel on x86-64 Ubuntu 20.04
How to cross-compile an m68k Linux kernel on Ubuntu 20.04 (x86-64)?
read moreCSAW CTF Final Round 2015: StringIPC write-up
Hijacking vDSO: My write-up for CSAW CTF Final Round 2015: StingIPC.
read more0CTF 2018 Finals: Baby Kernel write-up
Double-Fetch: My write-up for 0CTF 2018 Finals: baby kernel.
read moreReally Awesome CTF 2020: Puffer Overflow write-up
This is basically a Python 3.8 shellcoding challenge (650pt). Challenge instance ready at [raw]88.198.219.20:24155[/raw].We've found an exploitable network service. Exploit it! For your convenience, the source has been provided....
HITCON CTF 2016 Quals: House of Orange write-up
Write-up for HITCON CTF 2016 Quals: House of Orange.
read morePwn2Win CTF 2020: At Your Command write-up
Write-up for Pwn2Win CTF 2020: At Your Command – Playing with File-Stream Oriented Programming!
read morem0leCon CTF 2020 Teaser: BABYK write-up
Write-up for m0leCon CTF 2020 Teaser: BABYK.
read moreI/O APIC: SMP IRQ affinity
How does interrupt handling works in an SMP system?
read morem0leCon CTF 2020 Teaser: BLACKY-ECHO write-up
My write-up for m0leCon CTF 2020 Teaser: BLACK-ECHO.
read moreDEF CON CTF Qualifier 2020: introool write-up
My write-up for DEF CON CTF Qualifier 2020: introool.
read moreMIT 6.828: Operating System Engineering (2018)
Walking through MIT 6.828 Operating System Engineering: Table-of-Contents
read more6.828/2018 Lab 6: Network Driver
Walking through MIT 6.828 Lab 6: Network Driver(default final project).
read more6.828/2018 Lab 5: File system, Spawn and Shell
Walking through MIT 6.828 Lab 5: File system, Spawn and Shell.
read moreIJCTF 2020: babyheap write-up
My write-up for IJCTF 2020: babyheap
read more6.828/2018 Homework: xv6 log
Walking through 6.828 homework: xv6 log.
read more6.828/2018 Homework: Bigger files for xv6
Walking through 6.828/2018 Homework: Bigger files for xv6.
read moreWPICTF 2020: dont@me write-up
Write-up for WPICTF2020: dont@me
read moreWPICTF 2020: dorsia4 write-up
My write-up for WPICTF 2020 PWN challenge: dorsia4 (400pt)
read more6.828/2018 Lab 4: Preemptive Multitasking
Walking through MIT 6.828 Lab 4: Preemptive Multitasking
read more6.828/2018 Homework: Barriers
Walking through 6.828 homework: Barriers
read more6.828/2018 Homework: User-level Threads
If a concurrent thread causes the condition to be true, that thread must either hold the lock on the condition before the sleeping thread acquired it, or after the sleeping thread released it in sleep. If before, the sleeping thread must have seen the new condition...
6.828/2018 Homework: Threads and Locking
My quick walkthrough for MIT 6.828 homework: Threads and Locking.
read more6.828/2018 Lab 3: User Environments
My walkthrough for MIT 6.828/2018 Lab 3: User Environments.
read more6.828/2018 Homework: xv6 CPU alarm
My walkthrough for 6.828 homework: xv6 CPU alarm, as well as xv6 system calls.
read moreNosutarujī, Fujiko F. Fujio
「ノスタル爺」
read more6.828/2018 Lab 2: Memory Management
My code solutions and walkthrough for 6.828 Lab 2: Memory Management.
read more6.828/2018 Lab 1: Booting a PC
A walkthrough for MIT 6.828 (Fall 2018) Lab 1: Booting a PC.
read morePC Assembly Language: Chapter 1, 2
In my last post, I published my solution for the first exercise in the xv6 book for 6.828's 2019 version. Unfortunately, I somehow found it hard getting familiar with RISC-V instructions and, at the same time, trying to understand all these O/S concepts. Moreover,...
6.828/2019 Exercise 1.6.1: pingpong
My solution for 6.828 exercise 1.6.1.
read moreContrailCTF 2019: instant_httpserver write-up
ContrailCTF 2019: instant_httpserver write-up
read moreContrailCTF 2019: welcomechain write-up
ContrailCTF 2019: welcomechain write-up
read moreContrailCTF 2019: EasyShellcode write-up
ContrailCTF 2019: EasyShellcode write-up
read morepwnable.kr: asm write-up
Writing some shellcode – pwnable.kr: asm write-up
read morePlaying with Sigreturn-Oriented Programming (SROP)
Playing with Sigreturn-Oriented Programming (SROP).
read moreFinding link_map and _dl_runtime_resolve() under full RELRO
Addresses of link_map and _dl_runtime_resolve(), previously stored at GOT[1] and GOT[2], no longer get initialized under full RELRO. The good news is, we may still find them!
read moreUnderstanding _dl_runtime_resolve()
Learning _dl_runtime_resolve_xsave(link_map, reloc_index) the hard way, and say hello to .dynamic, .rela.plt, .dynsym, .dynstr!
read moreEven more “hidden” gadgets in __libc_csu_init()
Returning to <__libc_csu_init+93> gives us control on %rsp. Additionally, returning to <__libc_csu_init+95> and <__libc_csu_init+97> let us control %rbp and %rsi, respectively, with shorter payloads.
read moreA “hidden” gadget in __libc_csu_init()
The last two bytes of __libc_csu_init() is actually a “pop rdi; ret” gadget.
read moreROP Emporium: ret2csu write-up
My write-up for ret2csu from ROP Emporium.
read moreDEF CON CTF Qualifier 2015: r0pbaby write-up
My write-up for r0pbaby from DEF CON CTF Qualifier 2015.
read more