Pwn

Lexi and I gave a talk about vulnerabilities in PGP implementations and related software. Find writeups and recordings on gpg.fail. Slides are here. The impacts reach from changing the content of signed messages without access to the private key, over tricking a user into decrypting data of the attacker’s choice, to memory corruption in the ASCII-armor decoder.

Conference presentation (slides | recording) of our paper “DUMPLING: Fine-grained Differential JavaScript Engine Fuzzing” at NDSS 2025. It received a Distinguished Paper Award.

The master’s thesis presentation of our differential JavaScript engine fuzzer “Dumpling”. The thesis was published as a paper at NDSS 2025 and received a Distinguished Paper Award.

This is a writeup of an easy/medium pwn challenge called “Profile” featuring a type confusion, some GOT overwriting, and a funny but unnecessary one gadget exploit for the fun of it.

Solution to the Cyber Security Rumble Finals challenge simple-asm.

A talk by ju256 and me about V8, Chrome’s JavaScript engine, with case studies of common bugs. The slides are available, although some context depends on the spoken presentation. We may give the talk again and have it recorded.