Papers and other blogs

Collection of research published outside this blog.


Papers

• Phrack Magazine - Tale of two hypervisor bugs - Escaping from FreeBSD bhyve

Hardware side-channel attacks

• PagedOut Magazine - Leaking Guest Physical Address Using Intel Extended Page Table Translation
  More details can be found in github repository - SLATMMU
• PagedOut Magazine - Leaking Host kASLR from Guest VMs Using Tagged TLB
  More details can be found in github repository - TagBleedVMM

Vulnerability modelling and variant analysis

• Analysis of a Parallels Desktop Stack Clash Vulnerability and Variant Hunting Using Binary Ninja
• Static Taint Analysis Using Binary Ninja: A Case Study of Mysql Cluster Vulnerabilities
• Clang Checkers and CodeQL Queries for Detecting Untrusted Pointer Derefs and Tainted Loop Conditions
• MindShaRE: Analyzing BSD Kernels for Uninitialized Memory Disclosures Using Binary Ninja
• MindShaRE: Using Binary Ninja API to Detect Potential Use-after-free Vulnerabilities

Symbol porting and patch gap analysis

• MindShaRE: Analysis of VMware Workstation and ESXi Using Debug Symbols from Flings
• Looking at Patch Gap Vulnerabilities in the VMware ESXi TCP/IP Stack

Virtualization vulnerability research

• Virtualization Vulnerability Research (2019–2020)
• FreeBSD grub-bhyve bootloader virtual machine escapes
• Detailing Two VMware Workstation TOCTOU Vulnerabilities
• An Analysis of a VMware ESXi TCP Socket Keepalive Type Confusion LPE
• Parallels Desktop RDPMC Hypercall Interface and Vulnerabilities
• Bash Privileged-Mode Vulnerabilities in Parallels Desktop and CDPATH Handling in MacOS

Reverse engineering

• Flare-On Challenge #2
• Flare-On Challenge #3