# 637th Research Lab

> Security research write-ups: reverse-engineering, vulnerability discovery, and the methodology behind them.

## Posts

- [U-Boot TCP/NFS Vulnerabilities: Integer Underflow and Buffer Overflow in the World's Most Popular Bootloader](https://y637f9qq2x.com/posts/u-boot-tcp-nfs-vulns/): Three CVEs in U-Boot's network stack: a TCP integer underflow that corrupts packet processing and an NFS path overflow that escapes a 2048-byte buffer.
- [Four Vulnerabilities in barebox: From DHCP Parsing to EFI PE Loading](https://y637f9qq2x.com/posts/barebox-sandbox-vulns/): Four CVEs across barebox's network stack, filesystem layer, and EFI loader: an unbounded DHCP option scan, two ext4 parsing flaws, and a PE virtual-size integer overflow.
- [RogueProvision: Windows Privilege Escalation in the Provisioning Engine — the SYSTEM Task That Applies Unsigned Packages](https://y637f9qq2x.com/posts/rogueprovision/): A SYSTEM service applies unsigned .ppkg packages from a folder — no signature, no consent. Microsoft's docs promise otherwise. Honest catch: admin→SYSTEM.
- [Rebuilding a Security Researcher's Mind in an AI — to Invent Attacks, Not Just Find Them](https://y637f9qq2x.com/posts/researchers-mind-in-ai/): Building an AI that reverse-engineers undocumented Windows internals to invent attack techniques — not just find known bugs. Methodology, failures, results.
- [Same Workflow, New Target: AI-Assisted Discovery of CVE-2026-29004 in BusyBox](https://y637f9qq2x.com/posts/cve-2026-29004/): How the AI workflow that found a strongSwan zero-day discovered a 9-year-old heap overflow in BusyBox's DHCPv6 client, plus a full PoC walkthrough.
- [Inside NOFILTER-NFEXEC: A Deep Dive into WFP Implementation and BOF OPSEC Engineering](https://y637f9qq2x.com/posts/nofilter-nfexec/): Implementing the DEF CON 31 NoFilter technique as an OPSEC-hardened Havoc C2 BOF — indirect syscalls, return address spoofing, and AMSI/ETW bypass.
- [Finding a 15-Year-Old Zero-Day in strongSwan with AI-Assisted Code Analysis](https://y637f9qq2x.com/posts/cve-2026-25075/): How I discovered CVE-2026-25075, a bug hiding in strongSwan since 2011, using a structured multi-pass AI analysis workflow.

## About

- [Whoami](https://y637f9qq2x.com/whoami/): About the author.

## Feeds

- [RSS](https://y637f9qq2x.com/rss.xml): Full RSS feed.
- [Sitemap](https://y637f9qq2x.com/sitemap-index.xml): XML sitemap.