post


pwning with… “QEMU”?
This post is about exploiting IOPL privilege escalation using QEMU’s Firmware Configuration (fw_cfg) device.
fetipop
Novel technique I found in the linux kernel useful to exploit restricted dirty pagetable scenarios in a completely reliable and leakless way, through a new kind of “Oriented Programming”.
krwx
Writeup for the kernel pwn challenge that I wrote for ToH CTF 2025. In this post I will talk about a way of bypassing kCFI (norand) using BPF filters.