analyzereversedisclose
> Independent analysis of 0-days, n-days, and malware — written for operators and the people who write the advisories.
The three newest published write-ups. The rest live in the archive.
QEMU v11.1.2 COLO parse_packet_early accepts IPv4 once L2 plus ip_hl fits. It never requires an L4 header. filter-rewriter then reads past a 34-byte frame. ASan heap-buffer-overflow READ. Needs COLO.
QEMU v11.1.2 still only rejects NVMe mappings whose start sits in BAR0. An SGL data block that begins just before BAR0 and runs into MBAR is accepted. Bounce DMA writes guest disk bytes onto CC and resets the live controller.
QEMU v11.1.2 guards the xHCI timers. xhci_complete still DMA-writes the event ring into the doorbell BAR. Async usb-uas complete frees the live XHCITransfer. ASan heap-use-after-free.
03 of 186Showing the newest 3. 183 more published notes are in the archive.
Open archive→Repos that came out of the write-ups. Open GitHub from here if that is what you came for.
Spicy malware. Full kill-chain implant: exploit, escalate, pivot, poison, C2. Windows 10/11 x64 Rust source, released as-is and slightly broken on purpose.
Late-90s IRC TUI that re-keys the Fortinet Hunter Nuitka gate. Static unpack, XOR unmask, Docker cage. The ELF never runs on the host.
02 of 04Showing the newest 2. 2 more repos are in the tree.
Open the tree→PDFs I actually reopen. Shelf notes in my voice, then the book.
Elnaz Rabieinejad, Ali Dehghantanha, Fattane Zarrinkalam, and Sarina Dastgerdy
Twenty SOC practitioners, not a vendor deck. LLMs as drafts and leads for logs and first-pass triage. Nobody in the room trusted them for the high-stakes call.
Alex Matrosov, Eugene Rodionov, and Sergey Bratus
The book I hand people when they ask why the kernel still believes the firmware. Boot path, UEFI, and the malware that lives underneath the OS you thought you were analyzing.
02 of 03Showing the newest 2. 1 more shelf note is in the room.
Open the room→Four lanes. Same standard: enough technical depth to be useful, without turning the site into a drop.
Fresh findings, coordinated when they need to be, written when they are ready.
What the advisory left out — leftover packages, composition, and still-live primitives.
Loaders, C2, host fitness, persistence. Behavioral tells a SOC can actually use.
Composition, vendor logic, and the ugly leftovers that do not fit a tidy label.