2026
Posts from this year
Posts
-
The CSC 2026 Payslip Portal: Three Bugs Where the File You Can Write Is the File You Run
Part two of the CSC 2026 finals. After the ransomware recovery came the attack-and-defence round, and one service fell to a chain of three — an unauthenticated CBC cookie became a padding oracle that forged an HR role, an HR-only template preview handed the live PDF generator to a Go template and turned it into a file write, and that file write landed on the one Go source the service re-interprets on every payslip.
-
Reversing the CSC 2026 Ransomware Unlocker: A Fake gdb, a Salt Born in a SIGTRAP Handler, and an Invertible Check
How our team recovered the files a CTF ransomware encrypted at the CSC 2026 finals, by reversing the 4.9 KB unlocker it left behind, finding the salt it computes only inside a SIGTRAP handler, inverting its flag check, and rebuilding its SHA-256 and RC4 key schedule in Python, then restoring 43 files on six hosts from the organisers' inventory with a runbook and two scripts.
-
EEG Basics for Machine Learners: Sampling, Filtering and Band Power
The signal-processing vocabulary needed before training anything on EEG, worked through on a clearly synthetic signal in NumPy, with the pitfalls that quietly inflate reported accuracies.
-
Binary Hardening on Linux: What Canaries, NX, ASLR, RELRO, FORTIFY and CET Actually Stop
A tour of the compiler, linker and kernel mitigations inside a modern Linux binary, what each one prevents and does not prevent, and how to verify all of them with readelf, objdump and checksec.
-
TCP from the Wire: Reading a Real Handshake
A tcpdump capture of one HTTP request over loopback, packet by packet: the three-way handshake, sequence numbers, window scaling, teardown, and where flow and congestion control fit in.
-
Lock-Free Queues and Memory Ordering: An SPSC Ring Buffer Measured Against a Mutex
A single-producer single-consumer ring buffer in C11 atomics, the happens-before argument that makes acquire/release enough, ABA and MPMC caveats, and a measured comparison with pthread_mutex queues.
-
Contrastive Learning Intuition: InfoNCE, Temperature, Alignment and Uniformity
What the InfoNCE loss actually optimizes, why the temperature matters, and a NumPy experiment that trains a two-dimensional embedding with a hand-derived gradient and shows the before and after.
-
conero: Spending One Note Eight Times Because the Subgroup Check Is in the Wrong Function
A write-up of the blockchain challenge conero from the Codegate 2026 qualifiers, where a patched geth implements Monero-style ring signatures, writes a careful canonical-key-image check, and then verifies proofs in a function that never calls it — so one note yields eight key images and drains the pool.
-
GPU Memory Hierarchy and Occupancy: Why a Tiled Kernel Is Just Cache Blocking by Hand
The CUDA execution model, global versus shared memory, coalescing, bank conflicts and occupancy, with a tiled matrix multiplication and a block reduction written out in full and traced back to the cache ideas of the CPU posts.
-
Small ROS: Eighty-One Random-Oracle Equations That Collapse Into One Subset-Sum
A write-up of the crypto challenge Small ROS from the m0leCon 2026 finals, where choosing the rows of an overdetermined random-oracle system turns eighty of its equations into coordinate lookups, leaves one, and reduces the whole verifier to a modular subset-sum that a lattice solves.
-
A Post-Quantum Cryptography Primer: Shor, Grover, ML-KEM and the Hybrid Handshake
Which parts of today's cryptography a large quantum computer would break, what NIST standardised in FIPS 203, 204 and 205, how X25519MLKEM768 protects TLS 1.3 sessions, and how to try ML-KEM yourself with OpenSSL 3.5.
-
Twelve-Factor on a Single VM
Running a real application on one virtual machine with Docker Compose, environment-based config, log streams, automatic TLS and tested backups, without pretending it is a cluster.
-
flagchecker3: A Bytecode VM That Decrypts Itself Only If You Already Know the Flag
A write-up of the Android reversing challenge flagchecker3 from VSLCTF 2026, where the native checker runs a bytecode VM whose instruction stream is XOR-encrypted under a key that every comparison result feeds back into, so a wrong byte derails the decryption and turns the obfuscation into an oracle.
-
What Happens at Generation Time: KV Cache, RoPE and Sampling
The decode loop of a decoder-only transformer explained from the memory up, with KV-cache arithmetic for 7B-class models, a NumPy check of rotary embeddings, and temperature and top-p sampling.
-
MPI from Zero: Ranks, Messages and a 1-D Heat Equation with Halo Exchange
What an MPI program is, how point-to-point and collective communication differ, the deadlock everyone writes once, and a complete heat-equation solver with ghost cells and non-blocking overlap, compiled and checked against Open MPI on a single laptop.
