radare2 on the second attempt
If you bounced off radare2 the first time, you probably tried to learn it the wrong way. A small command set, a clearer mental model of the namespace, and a target binary worth opening.
BLOG
NOTES FROM THE METAL
Deep-dives on binary, exploitation, and reverse engineering. Everything that didn't fit into a lesson.
Reverse Engineering & Tooling
Disassemblers, decompilers, debuggers, and the workflow around them.
GDB commands worth learning past break and continue
A short tour of the GDB commands that turn an interactive session into something faster than printf debugging — watchpoints, commands, display, tui, find, and conditional breakpoints.
Reading objdump output without going cross-eyed
objdump is a workhorse and a wall of text in equal measure. The right flags and a sense of which section answers which question turn it into something you actually use.
What Ghidra's decompiler is doing when it shows you C
Ghidra's decompiler turns assembly into something that looks like C. The pipeline runs through a curious IR called P-code, and what it can't recover matters as much as what it can.
Background reading for a first Ghidra session
What to know before you open Ghidra: enough x86-64 to read function prologues, what decompilation actually produces, and the rename-retype-comment loop that makes a binary readable.
Exploit Development
Memory corruption, primitives, mitigations, and the craft of writing working exploits.
Why stack canaries are often 0x00
Glibc stack canaries on x86_64 always contain a literal NUL byte at their lowest address. The reason for that placement comes straight out of the bug class they're built to catch.
pwntools features most tutorials skip
If your pwntools knowledge starts and ends at recvuntil and sendline, you're using maybe ten percent of the library. The other ninety is where the time savings live.
Reading other people's exploits without getting lost
Public exploit code is a fantastic teacher and an easy way to drown. Where to find quality code, how to read it backwards, and what to do when you stall.
Notes on triaging a crash
You hit a SIGSEGV. Now what? How to capture the crash, classify it, and decide whether it's worth chasing toward an exploit.
When to stop reversing and start fuzzing
Reverse-engineering and fuzzing solve different problems on different attack surfaces. A practical guide to picking the right one (or both) for the target in front of you.
How printf finds its arguments
Variadic functions, the System V AMD64 ABI, and what va_list is really doing. Plus why a wrong format string is a security problem, not just a bug.
Building a minimal exploit-dev environment
A no-fluff setup for binary exploitation: Ubuntu in a VM, gcc, gdb with pwndbg, pwntools, checksec, ropper. The shortest path to writing your first exploit.
Why strcpy is still in the standard library
Everyone tells you not to use strcpy. The honest history of its replacements is messier than the slogan suggests, and explains why the function won't go away.
Vulnerabilities & Case Studies
Famous bugs read slowly — what they were, why they worked, what changed afterwards.
Stuxnet as a teaching artefact
Read like a piece of engineering rather than a thriller, Stuxnet is one of the cleanest case studies of modular malware design that the field has. Here is what students get from sitting with it.
What Spectre changed about how we write code
Spectre exposed a CPU design assumption rather than a single fixable bug. The response is now baked into compilers, kernels, browsers, and language runtimes — eight years of slow change under one name.
The Log4Shell exploit chain, slowly
A walk through the Log4Shell chain step by step, from a string in a log message to a remote class load and a shell. With the supply chain implications nobody had quite reckoned with.
Why EternalBlue worked
EternalBlue caused WannaCry and NotPetya, but the underlying bug is more interesting than the press coverage suggested. A type confusion between two SMB transaction structures, plus careful heap grooming.
Heartbleed, twelve years later
A missing bounds check in OpenSSL's heartbeat handler leaked 64KB of process memory per request. A look back at the bug, the response, and what changed about how we ship TLS.
Foundations
C, assembly, the loader, the kernel — the prerequisite layer the rest of the field assumes.
Maths for cryptography, the honest version
How much maths do you actually need to read and use cryptography in real systems? Less than the reputation suggests. Modular arithmetic, group intuition, finite fields at a definitional level, and you're equipped.
What to know before reading the Linux kernel source
The kernel uses a small bag of C tricks again and again. Learn the four or five idioms first and the source becomes readable instead of cryptic.
How the Linux loader starts your program
From execve to main, a guided tour of what the kernel and the dynamic linker do before your code ever runs. Trace it yourself with strace and ltrace.
Assembly comfort levels, and which one you actually need
Four levels of assembly fluency, what each one buys you, and which one matches your goals. Most people overshoot.
What mmap does under the hood
mmap is the substrate underneath file I/O, malloc, and shared library loading. A close look at the syscall, demand paging, and what /proc/self/maps reveals.
The C you need before learning exploit development
Pointer fluency, struct memory layout, the call stack, what malloc returns, function pointers, and undefined behaviour — the slice of C that exploit dev assumes you've internalised.
The difference between a section and a segment
ELF has both, they overlap, and the distinction trips up everyone reading the docs for the first time. Here's the short version, with readelf output.
Career & Learning Path
Where to go after the obvious starting points, and how the various binary tracks differ.
Moving from CTF challenges to real targets
CTF binaries are puzzles with one bug; real software is a city with many. The mindset, scoping, and patience the transition takes — without the hype.
From bug bounty to vulnerability research
Bug bounty hunters wondering whether to go deep into VR. The real workflow shift, the skill differences, the economic reality, and where the two worlds genuinely overlap.
Web security to native code: what carries over
Web testers eyeing binary work want to know what's transferable. The answer is more than zero and less than they hope. Here's the honest split.
How to read a CVE properly
A CVE record is the address of the bug, not the bug itself. Where to find the patch, the advisory, the exploit, and which order to read them in.
The HTB Pro Labs prerequisite nobody mentions
Pro Labs are harder networks more than they are harder boxes. The Windows internals and AD depth that catches people out, written for someone about to commit a hundred quid.
After PortSwigger Academy: where to go for binary work
You've finished the Web Security Academy and want to learn binary exploitation. The honest version of what you'll need to relearn, and the cleanest paths in.