0x66726f6dbah//R&D Dept. in SolarPV

I study how complex systems fail. Kernel internals, binary exploitation, protocol analysis, and the occasional compiler bug. Located somewhere between the kernel and userspace.

affilREDACTED (for rn, sry :/)

prog I do a shitload of reverse engineering of chinese IP, mostly for fun, other because monies go brrrrrr

prevReverse Engineered malware from CN threats, dealt with FEOC, and other relational comparitives

01 Publications

2024

Phantom Mappings: Exploiting Memory Aliasing in the Linux Page Cache * Best Paper

USENIX Security '24

kernel memory safety LPE

2024

SyscallGraph: Static Taint Tracking Across Privilege Boundaries

IEEE S&P '24

static analysis taint tracking LLVM

2023

KCFI Bypass via Speculative Type Confusion in JIT-compiled Code

CCS '23

spectre CFI JIT

2022

Dead Code Resurrection: Weaponizing Compiler Optimizations for Code Reuse

NDSS '22

ROP compiler exploit dev

02 Environment

bash - holloway@void: ~

$ uname -a

Linux void 6.8.0-custom #1 SMP x86_64 GNU/Linux

$ cat .interests

kernel exploitation * binary analysis * fuzzing * type safety * compilers

side-channel attacks * formal verification * reversing * hardware security

$ ls -la tools/

drwxr-xr-x gdb-pwndbg/

drwxr-xr-x ida-pro/

drwxr-xr-x angr-scripts/

drwxr-xr-x syzkaller-configs/

-rwxr-xr-x kernel-build.sh

$ echo $EDITOR

vim # obviously

03 Projects

C / Python

syzpatch

Kernel syscall fuzzer with semantic-aware mutation for structured input types. 3× faster bug discovery on fs drivers.

-> github

Rust

qemu-introspect

QEMU plugin for live kernel memory introspection. Tracks object lifetimes and flags dangling references.

-> github

Python / LLVM

cfgraft

Control-flow graph diffing for stripped binaries. Identifies structural changes across patch versions.

-> github

C++

specprobe

Micro-benchmarking suite for speculative execution side-channels. Covers Spectre v1/v2, MDS, and TAA variants.

-> github

04 Notes & Writing

2024-11-02 THe Red Divorce by 27' -> 2024-09-15 Writing a QEMU TCG plugin from scratch in Rust ->

05 Contact

email 0x66726f6dbah@atomicmail.io

pgp 0xDEAD C0DE 4F32 A819

github github.com/0x66726f6dbah

mastodon @holloway@infosec.exchange