Aleks

This stuff seems to be working.

PRIVATE KEY NUMBER FOUR I CAN'T TAKE IT ANYMORE

also worth noting that i will be doing crimes with white monster again at the afterparty. i will NOT cease and desist, and i will NOT apologize sl.ush.fund

I’m just glad that, for once, the sky isn’t falling because of AI. Refreshing.

I gave a talk titled “Recycling via Code Execution” at #teardown conference a bit ago. @crowdsupply.bsky.social just published videos: youtube.com/watch?v=nGEK... it’s about a few of my prior reversing projects with some lessons learned.

Finally, a good use case for an LLM: sort brute force search phrases by likelihood, in order to finally lay to rest one stupid conspiracy theory. I think @filippo had something on this? https://www.anthropic.com/research/ecdsa-curve-origins

Dumping Encrypted Viltrox Lens Firmware - two times blog.29b.net/dispatches/v... Two lenses, two different microcontrollers, two different readout bypass exploits, and two different e-mount implementations.

Gotta catch them all! I’m not a gear hoarder, this just sort of happened while I was repairing a few mamiya m645s. Sold them off as a set to a videographer. The one on top is famously what The Dark Knight was partially shot on.

Janky prototype but it mostly works.

A while back at AHA i talked about maritime communications. That’s a lot of antennas even on a low tech ship. There’s even a few more on the fore-mast behind me.

Original post: infosec.exchange/@fbz/1173545...

You bet it’s an stm32 clone!

Remember how, about 20 years ago, Intel used to just ship you, for free, all volumes of x86 instruction manual? Like, actual printed books. Why did they do that? Must have cost a small fortune! I still have mine somewhere!

Working on something interesting for Sony E-mount.

Hey Mom, look! I’m on WIRED. :)

Besides vulnerability research, we did some fun networking stuff. Martin was having fun with UPnP and i thought we might expand that to IPv6. We tricked some dual homed devices to reach back to us via IPv6 by talking UPnP to them via IPv4. Should try this again. blog.29b.net/talos_archiv...

December 2019 I started digging into Zoom. And then Zoom became kinda important. Never got to publish most of the work, it was hell of a fun time to have a custom implementation zoom client that would let you send fake/malformed stanzas. blog.29b.net/talos_archiv...

So many vulnerabilities! And almost all were just reported and got patched. But for a few, we did get to have some fun. Nicely exploitable RCEs in Memcached, we made a safe vulnerability test and scanned the whole Internet repeatedly to measure adoption rates: blog.29b.net/talos_archiv...

Original post: mastodon.social/@zenofex/117...

Yay I did a thing. occupy-x.com will redirect any requests to one of the known functional nitter instances currently online. Edit the URL to add "occupy-" in front and you should be good to go.

That moment of panic when you temporarily lose muscle memory for a password that you otherwise know by heart and don’t have in password manager… ugh.

Who’s gonna do a Hunter S Thompson style reportage about AI buildout like @nealstephenson.bsky.social did about undersea cables 30 years ago in “Mother Earth Mother Board” www.wired.com/1996/12/ffgl...

There’s this very bizarre form of Yugo-nostalgia going on right now in Portland. A weird mini-festival of Yugo films. I’m really puzzled, but why not?

Original post: infosec.exchange/@nasko/11701...

I’m doing a small talk at #teardown2026 this saturday about some past projects of mine www.crowdsupply.com/teardown/por...

Picked up the cookbook (Dishoom) shortly before starting the novel (Midnight Children) without realizing Mumbai is central to both. House smells amazing. I used to pair music to books but from now on I’m always pairing my cooking.

to get ahold of one, you have to order a light with 660nm photo red emitters from intl-outdoor.com, then email hank with your order number and tell him you want 720nm far red instead. mine's a D4V2 because it was cheap but any that have the 660nm option should work.

The hell is GhidraLite? Somebody is having fun , wonder what it serves you if you visit from a different OS. Bad google.

Did anyone get you this air quality monitor as a gift? I wanted to have it log the data, but didn’t quite trust it with internet access. I dug around a bit, got a root shell and untethered it. Read the writeup: https://blog.29b.net/dispatches/cgs2_decloud/

You get a lot of those happy new year email that you ignore , but this one from WHOI is just amazing https://www.whoi.edu/campaign/why-the-ocean/

Did anyone get you this air quality monitor as a gift? I wanted to have it log the data, but didn’t quite trust it with internet access. I dug around a bit, got a root shell and untethered it. Read the writeup: https://blog.29b.net/dispatches/cgs2_decloud/

Attended a darkroom workshop recently. Analog photoshop. Slightly different technique each time to get the desired effect.

Sigh, a domain hosting a small website for the last 20 years expired. I've forgotten about it for so long that it actually brought up some fun memories. Cheers to all the folks around it, wherever you are!

Attending USENIX Security for the first timehow do academic conferences work? In Seattle till Sunday.

A Borges story about a guy who gets AI to summarize all the world’s information for him, and then summarize the summary, until the AI has the whole world summarized into a single word. He sits alone at his desk, staring at the word, repeating it endlessly, certain he is experiencing everything

Join us for a deep dive into how Cisco Talos uncovered two critical vulnerabilities in the AsIO3.sys driver powering ASUS Armory Crate: blog.talosintelligence.com/decrement-by...

Building a Debugger is now officially released! It guides you through building a whole native x64 debugger from scratch, dispelling all the magic and teaching you a ton about operating systems as it goes. Even if you don't care about building a debugger, you can read it to your cat.

[Blog Post] New high-level API in LIEF that allows the creation of DWARF files. Additionally, I present two plugins designed to export program information from Ghidra and BinaryNinja into a DWARF file. lief.re/blog/2025-05... (Bonus: DWARF file detailing my reverse engineering work on DroidGuard)

Sebastião Salgado died, most amazing photographer among other things. Go find and watch “Salt of the Earth” https://youtu.be/aQ-My45meeo?si=hRPjKaG0zmNO9BUs

Haven't seen this on Bluesky yet: S&P 2027 will take place in Montreal, Canada!

Collaborative reverse engineering is hard not because the tools aren’t right, but because it’s difficult for you to transfer knowledge and insights gained while reverse engineering. Structs and function names are important but connecting the dots is crucial. How do you do this effectively?

Did you know that you can get archived audio lectures from Internet Archive as podcasts in whatever podcatcher you use? Like https://archive.org/details/the-real-world-of-technology

Utterly disappointing, not at all what i expected by the title! Doesn’t even acknowledge prior works of Discordians! It’s all about SRE and making complex chaotic systems more resilient to failure. With a bunch of first-hand experience from big corps who have their shit together!