Finding Hidden JNI Methods: RegisterNatives in a Lab APK
APK where nm -D shows no Java_* exports. Walk JNI_OnLoad, recover the JNINativeMethod table, map Java names to ARM64 IMPs, Frida-trace the native with arguments redacted.
Windows Delegation Edge Cases: Constrained, Unconstrained, and RBCD
Lab klist/setspn dumps redacted, unconstrained vs constrained vs RBCD text diagrams — flags and ACLs, not an abuse chain.
DOM XSS and DOM Clobbering as Trust Problems
Lab HTML+JS page: location.hash into innerHTML, name=form clobber of a config object, harmless redacted payload, CSP as the fix.
Recovering a C++ Vtable From ARM64/x64 Disassembly
Two-class toy hierarchy, virtual dtor plus two methods. objdump/readelf of the compiler vtable, ctor writing the vptr, virtual call through [x0,#16], gdb print of the slot.
ROP vs ret2libc: Classifying `ret` Sites on a Toy Binary
Mental model plus objdump of a toy: ret2libc is whole-function reuse, ROP is fragment reuse. Classify epilogue rets vs pop;ret vs leave;ret. Overflow crash with RIP=0x4141… — no system("/bin/sh") chain.
Active Directory Recon Notes: What Enumerations Reveal
Fake lab DC ldapsearch and PowerView-style listings, 4662/1644/4624 event IDs — inventory, not an attack playbook.
Command Injection Taxonomy for Code Review
Lab Python ping wrapper: subprocess shell=True vs argv list, dangerous call, the fix, ASAN-irrelevant crash on a C popen helper — no reverse shell.
AArch64 Calling Convention, as Read in IDA
AAPCS64 as it shows up in IDA: x0–x7, x29/x30, 16-byte SP, PACIBSP. Toy function with nine integer args so the ninth is on the stack. objdump of prologue and epilogue.