Recent Posts

  • Decompilers, Annotations, and other ways to read the unreadable

    In Part 2, we mapped the major functions, string references, and 16 CLI commands using nothing but strings, pattern matching, and a Python script. That left us with a suspicious route-engine string:

  • Opcodes, Prologues, and other hidden patterns

    In Part 1, we built a flat MIPS32 firmware binary and stared at 8,496 bytes with no headers, no symbols, and no sections. file said “data.” readelf said nothing. We left off with a question:...

  • Headers, Symbols, and other things you won't find

    Eight years ago I wrote ELF’s Linker’s and other magical creatures – a walkthrough of the ELF binary format, relocations, segments, and even live code injection through /proc/pid/mem. That post ended in a comfortable place:...

  • Before the BSD Kernel Starts: Part Two ARMv8

    Note: This article was written in 2020 as a companion to Part One (AMD64) but was never published. The technical content reflects the state of NetBSD and the RK3399 platform at that time. Published here...

  • rust_tlplib and tlp-tool 0.5.0: PCIe 6.0 Flit Mode

    The rust_tlplib and rtlp-tool libraries had not seen a release in a long time. After getting Gen 4 TLP parsing to a point where it covered everything I needed day-to-day, I left it there. Good...

  • A Transformer Block in CUDA

    December, somewhere over the Pacific on the way to Tokyo. The letGPU challenge open in one browser tab, Ro Salaverry’s The Scaling Era: An Oral History of AI, 2019–2025 on my Kindle. No plan beyond...

  • The GPT-2 Decoder Block: Before Writing Any Code

    At university, long before the current AI period, neural networks were still niche. Academic appeal, limited hardware, results that rarely justified the compute. We wrote simple recurrent networks in C, used them in robotics and...

  • Implement ls

    I ask this in interviews sometimes. Not as a gotcha — as a conversation starter. “Implement ls.” Four words. The answer tells you a lot about where someone’s mental model of the OS ends.

  • How to Parse PCIe TLPs

    PCIe devices are everywhere, but when one misbehaves the kernel logs you with raw TLP headers and no explanation. This post is about making sense of those bytes.

  • Before the BSD Kernel Starts: Part One AMD64

    Note: This article was originally written for and published at Moritz Systems in November 2020. Their website is no longer available; the content is republished here in its original form. The web archive version can...

  • Debugging FFS Mount Failures

    Note: This post was originally written in 2019 and has been lightly refreshed for clarity. The content and examples are unchanged — just the presentation got a coat of paint.

  • Fuzzing NetBSD Filesystems via AFL — Part 2

    Note: This post was originally written in 2019 and has been lightly refreshed for clarity. The content and examples are unchanged — just the presentation got a coat of paint.

  • Write Your Own Fuzzer for the NetBSD Kernel

    Note: This post was originally written in 2019 and has been lightly refreshed for clarity. The content and examples are unchanged — just the presentation got a coat of paint.

  • Short Story of Pages and Virtual Memory: Writing FS for Fun

    Followup Writing Linux Filesystem For Fun After my presentation “Writing Filesystem for Fun” that I did during May C/Cpp meetup I recieved many questions and positive comments. Thus I wanted to do second part of...

  • EuroBSDCon 2018

    This year I attended the EuroBSD conference in Bucharest as a presenter. During my talk, I summarized last year of research and development of Live-patching feature for the FreeBSD kernel.

  • Livepatching the kernel

    One of the interesting features of the modern operating systems is live-patching: availability to do updates of the kernel without the need of rebooting the system. Updates without any downtime can be beneficial for businesses...

  • ELF's Linker's and other magical creatures

    One of the popular topics on many engineering blogs is program startup and ELF file structure. Given that fact, a reader may have some objections about whether another post about ELF makes sense or not....

  • Writing Linux Filesystem for Fun

    In May 2018 I gave a talk for the C/C++ Dublin meetup at the MongoDB office — starting from the historical background of Unix filesystems and finishing with a working implementation of a simple filesystem...

  • Digging into Linux FileSystems

    UNIX Filesystem story goes back to the first implementation of the operating system. Since then, many different implementations and improvements were made. Due to that FileSystems became quite composed but also rock solid piece of...

  • How to Abstract Hardware Accelerator

    At the 2017 Xen Developer Summit I presented on abstracting hardware acceleration devices in cloud environments — covering accelerators in general, then drilling into what virtualization and multi-tenancy actually demand from the hardware and driver...

  • The Xen way

    What is Xen? In terms of open source hypervisor main players are: KVM and Xen, these projects can be used on a personal laptop as well as in commercial. There are also: Virtual Box which...

  • Qemu for the impatient

    Why not using qemu? In this article, I am trying to provide some useful qemu configuration for debugging or evaluation purposes. I will assume that reader is already using qemu so I am not going...

  • Overlays and underlays networks in SDN

    The phenomenon that can be observed nowadays is the exponential growth of the internet. Certainly there can be not a shred of a doubt here just a month ago as the IPv4 addresses ran out,...

  • Simple Rootkit

    The most intuitive way to write code for linux kernel is to add some code in kernel sources, recompile it and run. This approach is not terribly time consuming because kernel recompilation (even with cc)...

  • Single Bit Operations Cheatsheet for C Programmers

    Note: This post was originally written in 2015 and has been lightly refreshed for clarity. The content and examples are unchanged — just the presentation got a coat of paint.