Hello, world 👋
If you made it all the way here, you might as well check out some of my projects and where I blog
Windows related
- wtf: A distributed, code-coverage guided, customizable, cross-platform snapshot-based fuzzer designed for attacking user and / or kernel-mode targets running on Microsoft Windows,
- windbg-scripts: A collection of JavaScript debugger extensions for WinDbg,
- kdmp-parser / udmp-parser: C++ libraries to parse Windows kernel and usermode dumps,
🔮 clairvoyance: Visualize the virtual address space of a Windows process on a Hilbert curve,- symbolizer: A fast execution trace symbolizer for Windows,
- SiC: Enumerate user mode shared memory mappings on Windows,
- CVE-2021-24086: PoC for CVE-2021-24086, a NULL dereference in tcpip.sys triggered remotely,
- CVE-2021-31166: PoC for CVE-2021-31166, a use-after-free in http.sys triggered remotely,
- CVE-2021-28476: PoC for CVE-2021-28476, a guest-to-host "Hyper-V Remote Code Execution Vulnerability",
- CVE-2021-32537: PoC for CVE-2021-32537, an out-of-bounds memory access that leads to pool corruption in the Windows kernel,
- CVE-2022-28281: PoC for CVE-2022-28281, a Mozilla Firefox Out of bounds write,
- Modern Debugging with WinDbg Preview: Workshop that @hugsy and I ran during Defcon 27.
Exploitation
- Longue vue: Over-the-web remote compromise exploit chain for NETGEAR DGND3700v2 devices,
- Zenith: Remote kernel exploit for the TP-Link AC1750 Smart Wi-Fi Router (Pwn2Own Austin 2021),
- CVE-2019-11708: Full chain for CVE-2019-11708 & CVE-2019-9810,
- CVE-2019-9810: RCE exploit for Firefox on Windows.
Misc
- rp: A fast C++ ROP gadget finder for PE/ELF/Mach-O x86/x64/ARM binaries,
- z3-playground: A bunch of Z3-python scripts that can be used as examples, reminders, etc.
- Theorem prover, symbolic execution and practical reverse-engineering: Presentation I gave in Lille, France in 2015,
- teesee-calc: A simple web application that allows you to visualize and compare total compensation packages.