Machines, Networks, Security, and Reversing

Research

• Oct 18, 2026

  I am Chroot! Host File Read in angr

  A host-file read in angr's chroot SimProcedure, its impact on symbolic execution, and the fix to keep guest paths within the simulated filesystem.

• Oct 11, 2026

  Pickle Surprise: Pickle deserialization RCE in oauth2client

  A look at pickle deserialization in oauth2client's Flask integration, its reliance on session signing keys, and lessons for downstream users.

• Oct 4, 2026

  TLS Callback Evasion in angr

  A pointer-width bug in angr's CLE loader misread 64-bit TLS callback addresses. Here's the root cause, fix, and regression test.