0x_welsh
Reverse engineering, systems programming and vulnerability research. ELF, x86-64, kernels.
- CVE-2026-31431Linux kernel LPEcvss 7.8
- CVE-2025-55182React RCEcvss 10.0
- CVE-2025-68613n8n expression injection
Featured
The capstone. Four parts of pieces, headers, sections, symbols, relocations, joined into one tool that reads any ELF. The only new mechanic is the sh_link chain: offset into a table that holds offsets into a table that holds strings.
elf-from-scratch · part 5 · 2026-09-09 · 3m
Edr and AV products hook ntdll to sit between a program and the kernel. Here is how that hooking works, how it gets spotted, and how direct syscalls are used to slip past it.
syscall-level-reversing · part 2 · 2026-06-26 · 9m
Exploit copy-fail, a kernel LPE that corrupts any file's page cache to gain root in seconds.
2026-05-10 · 7m
Series
- ELF From Scratch5 parts
Reading, mapping and executing ELF binaries by hand. No libelf, no readelf, no dynamic linker — just bytes and C.
1 → 2 → 3 → 4 → 5
- Syscall-Level Reversing2 parts
The boundary between a program and the kernel: how to recognise a syscall in a disassembly, and how that layer gets hooked.
1 → 2
- Web Services & APIs1 part
From what a WSDL actually declares to the business-logic bugs hiding behind the operations it advertises.
Recent
all →- Mini-Readelf: Gluing It All Together3m
- Relocations: How PIE Binaries Fix Their Addresses4m
- Symbol Tables: What Function Names Actually Are5m
- Building a Custom ELF Loader from Scratch, in C8m
- Parsing ELF Binaries in C5m
- Easy Elf (reversing.kr)2m
- Why C still matters for Reverse Engineering6m
- Syscall-Level Reversing, Part 2: Unhooking and Direct Syscalls9m
- Syscall-Level Reversing, Part 1: Why the Kernel Boundary Matters5m
- Introduction to Web Services and APIs3m
- Building Welsh Motorhub's Buyer Request Funnel2m
- Copy Fail: CVE-2026-31431 (TryHackMe)7m
Topics
all →Build
- elf-explorerParse ELF headers, sections and symbols from scratch
- elf-loaderUserspace ELF loader in C — maps segments, builds a stack, jumps to entry