Original research
Deep-dive security research by NadSec. Exploit chain teardowns, malware reverse engineering, and threat intelligence writeups - all based on original work.
A soundness bug in the Linux BPF verifier's maybe_fork_scalars() - one +1 causes the verifier to skip an ALU instruction on a forked path. For BPF_OR, arbitrary kernel R/W, vtable hijack, modprobe_path overwrite, and full container escape to host root. One-character fix merged by Alexei Starovoitov.
How I reverse-engineered 28 JavaScript modules recovered from b27.icu - a watering-hole domain serving a Safari exploit chain targeting iOS 16.0-17.2. Covers WebKit RCE, PAC bypass, JIT cage escape, and the PACDB rolling hash forgery algorithm.
6,596-line static reverse engineering of 16 recovered JavaScript modules. Full XOR string decryption, WebAssembly extraction, ARM64 gadget scanner reconstruction, and complete class taxonomy of every exploitation primitive.
Reverse engineering of the kernel exploitation stage - a 2MB ARM64 DYLIB targeting IOSurfaceRoot. 649 functions, 265 imported symbols, Corellium anti-analysis, multi-SoC support, and full kill chain integration.