Zero Day Engineering
A firsthand account of modern Chrome-specific exploit mitigations encountered while zero day engineering for Google Chrome across renderer, network service, and browser process.
Read more
On April 3rd, 2025, I had presented my work on reverse-engineering the hardware internals of Qualcomm Hexagon ISDB JTAG at Black Hat Asia 2025, Singapore. Hexagon is a tightly restricted proprietary architecture which doesn't permit low-level debugging – a challenge which I was tasked to conquer under a private commercial R&D contract.
Read more
On November 16th, 2024, I gave a keynote at VXCON 2024 conference, Hong Kong. I offered my insights on how AI is changing the art of vulnerability research.
Read more
On November 15th, 2024, I gave a workshop on browser exploitation at VXCON 2024 conference, Hong Kong. In this workshop I taught my full process of exploiting a non-trivial vulnerability in Google Chrome's v8 JavaScript engine, from zero-knowledge patch to novel exploit concept. The slide deck holds the skeleton of my methodology.
Read more
On September 14, 2024, I had participated in the Off By One Security Podcast by SANS. I presented my Probabilistic Theory of Fuzzing there for the first time – and explained how practical low-level fuzzing works through it. In this follow-up article I release the slides of my podcast - while tackling selected questions and comments from the livestream chat that didn’t make it into the live Q&A.
Read more
Technical conference talk at Hack in the Box x Positive Hack Days 2024 (Bangkok). A survey of the modern state of the art of JavaScript engine vulnerability research, covering V8, JavaScriptCore, and SpiderMonkey.
Read more
In April 2021 I had participated in the Pwn2Own Vancouver competition as an independent solo entrant - and a female first. I successfully demonstrated a zero-day virtual machine escape against the Parallels hypervisor. This post documents the event, releases the exploit source code, and provides a full technical walkthrough video.
Read more
Quick analysis and research insights for the recently reported RCE vulnerability in Chromium WebRTC code and embedders.
Read more
I reverse engineered a bunch of recent zero-day bugs targeting Qualcomm Linux kernel & ARM Mali GPU. This technical deep-dive walks through the bugs after providing a background information on the target systems.
Read more
I analyzed the security patches of a recently disclosed Chrome 0-day attack to derive additional information about the vulnerability, and clarify practical threat impact.
Read more
I wrote an exploit for a JavaScript JIT Type Confusion vulnerability in Jscript9.dll. This writeup covers my technique and releases the source code. The exploit technique that I show here is universal, and it continues to be popular in the browser exploitation field. My specific implementation includes a fully dynamic ASLR bypass, plus state-of-the-art process continuation to avoid crash.
Read more
At Pwn2Own Vancouver 2021 I have demonstrated an 0day VM escape exploit for Parallels Desktop hypervisor ($40,000 cash bounty). The exploit chain that I developed was based on logic issues. In this deep technical presentation I share the technical details of the exploit, as well as various preliminary and contextual knowledge related to it.
Read more
Conference talk at Positive Hack Days 2021 (Moscow). A survey of modern attack techniques against Google Chrome: renderer memory corruption, V8 JavaScript engine exploitation, and sandbox escapes.
Read more
I reverse engineered a complex binary patch for a bug in VMware ESXi. In this article I outline my methodology, which is universal and can be applied beyond hypervisors.
Read more
A story of a trivial *no-bug, by-design* guest-to-host VM escape on latest Parallels Desktop for Mac with bonus persistence, as enabled by the software vendor's product design decisions and certain properties of the Unix interactive shells.
Read moreI found a security bug in Microsoft Hyper-V root partition kernel component ($15,000 cash bounty). This article analyzes the vulnerability.
Read more
Presented at the Chaos Communication Congress 2020. A deep dive into Qualcomm's Hexagon DSP diagnostic protocol, its internals, and its usefulness for baseband and firmware reverse engineering.
Read more
Presented at Power of Community 2020 (Seoul). A comprehensive survey of the state of hypervisor vulnerability research: attack surfaces, published exploits, methodological approaches, and the evolution of the field.
Read more
I reverse engineered the core system internals of Microsoft Hyper-V hypercall interface by using the Linux Integration Services kernel drivers (LIS). This technical note documents my research output.
Read moreA technical outline of the Apple bootchain's heap implementation — classical first-fit free-list allocator with 30 bins, immediate coalescing, and a layered set of security mitigations. Common across SecuROM, iBoot, and other bootloaders; foundational reading for heap-based exploit development against the Secure Boot procedure.
Read moreA generalized perspective on Apple devices' bootchain memory layout across all stages of the boot process, with a focus on SecuROM and iBoot. Includes a detailed memory map of iPhone 5 during boot, and recommendations on hardening — ASLR, region disjoining, and task management refactoring.
Read moreOriginally published in Phrack Magazine, Volume 0x0f, Issue 0x45. A novel exploitation technique for CVE-2013-0007, a highly entropic remote code execution vulnerability in Microsoft XML Core Services. The technique uses the vulnerability itself to leak stack information and self-patch the crashing code path.
Read more