Research

This paper re-introduces and clarifies the shared identity model, and establishes the relevant new concepts. It explores broader technological and civilizational implications of the model being accurate. It concludes with a controlled disclosure of a critical, unpatchable vulnerability in the human cognitive stack; exemplified with a proof-of-concept attack via AI technology, as caught in the wild.

A firsthand account of modern Chrome-specific exploit mitigations encountered while zero day engineering for Google Chrome across renderer, network service, and browser process.

Reverse-engineering the hardware internals of Qualcomm Hexagon ISDB JTAG — a tightly restricted proprietary architecture that doesn't permit low-level debugging. Presented at Black Hat Asia 2025, Singapore.

Full process of exploiting a non-trivial vulnerability in Chrome's v8 JavaScript engine, from zero-knowledge patch to novel exploit concept. Workshop at VXCON 2024, Hong Kong.

How AI is changing the art of vulnerability research. Keynote at VXCON 2024, Hong Kong.

The Probabilistic Theory of Fuzzing, and how practical low-level fuzzing works through it. With selected questions from the Off By One Security Podcast livestream.

Survey of modern vulnerability research techniques across V8, JavaScriptCore, and SpiderMonkey engines. Presented at HITB×PHDays 2024.

First female solo entrant at Pwn2Own Vancouver. Zero-day virtual machine escape against the Parallels hypervisor. Full technical walkthrough and exploit source code.

Analysis and research insights for a RCE vulnerability in Chromium WebRTC code and embedders.

Reverse engineering of zero-day bugs targeting Qualcomm Linux kernel and ARM Mali GPU. Technical deep-dive on the bugs and their target systems.

Analysis of security patches for a Chrome 0-day attack to derive additional vulnerability information and clarify practical threat impact.

Exploit for a JavaScript JIT Type Confusion vulnerability in Jscript9.dll. Universal technique with fully dynamic ASLR bypass and state-of-the-art process continuation.

Technical deep-dive on the Pwn2Own 2021 Parallels Desktop VM escape exploit chain, built on logic issues.

Survey of modern attack techniques against Google Chrome: renderer memory corruption, V8 JavaScript engine exploitation, and sandbox escapes. Presented at PHDays 2021.

Reverse engineering a complex binary patch for a VMware ESXi bug. Universal methodology applicable beyond hypervisors.

A no-bug, by-design guest-to-host VM escape on Parallels Desktop for Mac, enabled by product design decisions and Unix shell properties.

Security bug in Microsoft Hyper-V root partition kernel component. $15,000 cash bounty.

Deep dive into Qualcomm's Hexagon DSP diagnostic protocol and its applications for baseband and firmware reverse engineering. Presented at Chaos Communications Congress 2020.

Comprehensive survey of hypervisor vulnerability research: attack surfaces, published exploits, and methodological approaches. Presented at POC 2020.

Core system internals of Microsoft Hyper-V hypercall interface, reverse engineered via the Linux Integration Services kernel drivers.

Apple bootchain heap implementation — classical first-fit free-list allocator with 30 bins, immediate coalescing, and layered security mitigations. Foundational for heap-based exploit development against Secure Boot.

Apple devices' bootchain memory layout across all boot stages, with a focus on SecuROM and iBoot. Detailed memory map of iPhone 5 during boot, with hardening recommendations.

Technical analysis of CVE-2013-0007 (Microsoft XML Core Services Use-After-Free), exploitation techniques, and heap manipulation strategies with Internet Explorer. Phrack #69.

In-depth analysis of Ibank, a trojan targeting Russian online banking systems. Virus Bulletin.

Statistical analysis of TDSS malware infections based on removal tool data. Virus Bulletin.

Detection and analysis of bootkit malware. Co-authored with Dmitry Oleksiuk. Virus Bulletin.

Methods for retrieving reliable information from compromised systems. Co-authored with Dmitry Oleksiuk. Virus Bulletin.

Detailed technical analysis of TDSS (Tidserv) rootkit, including persistence mechanisms and bypass techniques. Virus Bulletin.

Evolution of malware self-defense and antivirus evasion techniques.

Evolution of rootkit technology and capabilities as a distinct malware class.