Security research write-ups: reverse-engineering, vulnerability discovery, and the methodology behind them.https://y637f9qq2x.com/https://y637f9qq2x.com/posts/rogueprovision/https://y637f9qq2x.com/posts/rogueprovision/A SYSTEM service silently applies unsigned configuration packages from a folder — no signature, no consent, no interaction. Microsoft's docs promise otherwise. The honest catch: on a normal PC it's admin→SYSTEM, and a symbol's name fooled the analysis into believing otherwise.Mon, 22 Jun 2026 01:00:00 GMTwindowsvulnerability-researchlpeprivilege-escalationprovisioningreverse-engineeringconfused-deputyhttps://y637f9qq2x.com/posts/researchers-mind-in-ai/https://y637f9qq2x.com/posts/researchers-mind-in-ai/AI-driven zero-day finding is spreading fast. This is a report on the harder part: building an AI that autonomously reverse-engineers undocumented Windows internals to invent attack techniques nobody has named — borrowing discovery methods from outside security, doubting its own conclusions, and running unattended for hours without fooling itself.Tue, 16 Jun 2026 01:00:00 GMTvulnerability-researchai-agentsmethodologyautonomous-researchhttps://y637f9qq2x.com/posts/busybox-dhcpv6-heap-overflow/https://y637f9qq2x.com/posts/busybox-dhcpv6-heap-overflow/How the same AI analysis workflow that found a zero-day in strongSwan discovered a 9-year-old heap buffer overflow in BusyBox's DHCPv6 client — plus a full walkthrough of the proof-of-concept development process.Tue, 05 May 2026 00:00:00 GMTcveheap-overflowbusyboxvulnerability-researchhttps://y637f9qq2x.com/posts/nofilter-nfexec/https://y637f9qq2x.com/posts/nofilter-nfexec/A detailed walkthrough of implementing the DEF CON 31 NoFilter WFP technique as an OPSEC-hardened Havoc C2 BOF, including indirect syscalls, return address spoofing, patchless AMSI/ETW bypass, and lessons learned from Havoc BOF development.Thu, 23 Apr 2026 00:00:00 GMThavoc-c2bof-developmentprivilege-escalationopsechttps://y637f9qq2x.com/posts/cve-2026-25075/https://y637f9qq2x.com/posts/cve-2026-25075/How I discovered CVE-2026-25075 — a vulnerability that had been quietly sitting in strongSwan's codebase since 2011 — using a structured, multi-pass AI analysis workflow.Sat, 18 Apr 2026 00:00:00 GMTcveinteger-underflowstrongswanvulnerability-research