Ali / 3lyly0 • Vulnerability Research & Systems Archive

Investigating how complex systems behave when pushed past their limits.

I take apart browsers, embedded network protocols, and native applications to understand what happens beneath the abstractions - turning subtle software flaws into documented research, exploits, and tools.

Explore Research → About Ali

Selected Work

Research Investigations

Complete Archive →

New

SHA-256/SHA-384 Type Confusion OOB Write Explained: When a struct Lies About Its Age, the Kernel Believes It

From 15 out-of-bounds bytes to full root and a walk out of a chroot jail: a technical teardown of a Linux kernel exploit chain that starts with a size mix-up between SHA-256 and SHA-384 inside a custom crypto module, travels through MSG_COPY, pipe_buffer, and struct page, and ends with a data-only write into cred followed by swapping task->fs for init_fs.

#linux-kernel #exploit-development #heap-exploitation #type-confusion #privilege-escalation

New

SafeStack Bypass Explained: The Vault Is Solid, the Ledger Isn't

SafeStack splits your stack so a buffer overflow can only smash the half nobody misses. Solid plan, except the pointer that defines where the smashable half lives is stored in TLS, and TLS was sitting right next to the overflow. This is the story of how one bad memory layout took down a shadow stack, a canary, and a homemade CFI check in a single chain.

#Binary Exploitation #Memory Safety #SafeStack +2

New

MQTT Debug Topic Leaks Explained: When Your Device Keeps a Diary Anyone Can Read

A retained MQTT debug topic is the IoT equivalent of leaving the master key on a public noticeboard that never gets cleaned. Here is how firmware analysis, weak broker credentials, and one forgotten retain flag turn a thermostat into a leaky vault.

#MQTT #IoT #Firmware Analysis +2

New

Side-Channel ECDSA Explained: When Your Division Algorithm Can't Keep a Secret

How a custom binary modular division implementation leaks the ECDSA nonce through traced function calls, and how an attacker can recover the private key from the execution trace alone.

#cryptography #ecdsa #side-channel +2

New

Non-Transitive Comparators Explained: When Sorting Quietly Walks Off the Array

A comparison function that looks innocent can turn qsort into an out-of-bounds write primitive. This article breaks down how integer overflow in comparators breaks the assumptions of insertion sort, forces the slow path with a memory limit, and opens a full chain from stack corruption to code execution.

#Memory Corruption #Integer Overflow #qsort +2

Why take systems apart?

Read the conversational Q&A exploring my background, reverse engineering methodology, CTF experience, and the curiosity driving this research space.

Read the Q&A →