637th Research Lab
What happens when trusting stops and breaking starts.
Three CVEs in U-Boot's network stack: a TCP integer underflow that corrupts packet processing and an NFS path overflow that escapes a 2048-byte buffer.
ReadFour CVEs across barebox's network stack, filesystem layer, and EFI loader: an unbounded DHCP option scan, two ext4 parsing flaws, and a PE virtual-size integer overflow.
ReadA SYSTEM service applies unsigned .ppkg packages from a folder — no signature, no consent. Microsoft's docs promise otherwise. Honest catch: admin→SYSTEM.
ReadBuilding an AI that reverse-engineers undocumented Windows internals to invent attack techniques — not just find known bugs. Methodology, failures, results.
ReadHow the AI workflow that found a strongSwan zero-day discovered a 9-year-old heap overflow in BusyBox's DHCPv6 client, plus a full PoC walkthrough.
ReadImplementing the DEF CON 31 NoFilter technique as an OPSEC-hardened Havoc C2 BOF — indirect syscalls, return address spoofing, and AMSI/ETW bypass.
ReadHow I discovered CVE-2026-25075, a bug hiding in strongSwan since 2011, using a structured multi-pass AI analysis workflow.
ReadThree CVEs in U-Boot's network stack: a TCP integer underflow that corrupts packet processing and an NFS path overflow that escapes a 2048-byte buffer.
Four CVEs across barebox's network stack, filesystem layer, and EFI loader: an unbounded DHCP option scan, two ext4 parsing flaws, and a PE virtual-size integer overflow.
A SYSTEM service applies unsigned .ppkg packages from a folder — no signature, no consent. Microsoft's docs promise otherwise. Honest catch: admin→SYSTEM.
Building an AI that reverse-engineers undocumented Windows internals to invent attack techniques — not just find known bugs. Methodology, failures, results.
