Systems engineering, reverse engineering, and offensive security research. Kernel internals, binary exploitation, and web security.https://welsh.co.ke/https://welsh.co.ke/posts/advent-of-ctf-2025-day-1-mission-begins/https://welsh.co.ke/posts/advent-of-ctf-2025-day-1-mission-begins/A beginner-friendly cryptography challenge involving multi-step encoding conversion using CyberChef to decode binary data into the final flag.Sun, 21 Dec 2025 00:00:00 GMThttps://welsh.co.ke/posts/advent-of-ctf-2025-day-2-first-strike/https://welsh.co.ke/posts/advent-of-ctf-2025-day-2-first-strike/Network forensics challenge analyzing FTP traffic to identify compromised credentials during a Krampus Syndicate intrusion attempt.Sun, 21 Dec 2025 00:00:00 GMThttps://welsh.co.ke/posts/advent-of-ctf-2025-day-3-syndicate-infrastructure/https://welsh.co.ke/posts/advent-of-ctf-2025-day-3-syndicate-infrastructure/Advanced DNS reconnaissance challenge involving SPF and DKIM record analysis to uncover hidden infrastructure used by the Krampus Syndicate.Sun, 21 Dec 2025 00:00:00 GMThttps://welsh.co.ke/posts/advent-of-ctf-2025-day-4-elfs-wager/https://welsh.co.ke/posts/advent-of-ctf-2025-day-4-elfs-wager/Reverse engineering challenge involving static analysis of a stripped ELF binary with anti-debugging measures and XOR-based authentication.Sun, 21 Dec 2025 00:00:00 GMThttps://welsh.co.ke/posts/advent-of-ctf-2025-day-5-kramazon/https://welsh.co.ke/posts/advent-of-ctf-2025-day-5-kramazon/Web exploitation challenge targeting a malicious e-commerce platform with cookie manipulation and privilege escalation vulnerabilities.Mon, 22 Dec 2025 00:00:00 GMThttps://welsh.co.ke/posts/binary-whisper-binary-analysis/https://welsh.co.ke/posts/binary-whisper-binary-analysis/A friendly, step-by-step writeup of the Binary Whisper challenge using basic static analysis and a tiny XOR decode script.Sat, 24 Jan 2026 00:00:00 GMThttps://welsh.co.ke/posts/building-a-custom-elf-loader-in-c/https://welsh.co.ke/posts/building-a-custom-elf-loader-in-c/You type ./program and the kernel loads it. Here's how that works: we build a userspace ELF loader in ~300 lines of C that maps PT_LOAD segments, builds a stack by hand, and jumps to the entry point.Thu, 03 Sep 2026 00:00:00 GMThttps://welsh.co.ke/posts/building-my-first-multiboot-toy-kernel-x86-c-assembly/https://welsh.co.ke/posts/building-my-first-multiboot-toy-kernel-x86-c-assembly/How I built a 32-bit freestanding toy kernel that boots through GRUB, enters C cleanly, and now handles CPU exceptions through GDT+IDT setup.Tue, 24 Feb 2026 00:00:00 GMThttps://welsh.co.ke/posts/building-welsh-motorhub-buyer-request-funnel/https://welsh.co.ke/posts/building-welsh-motorhub-buyer-request-funnel/How I built a request-driven car marketplace flow in Kenya: buyer privacy, dealer offer limits, WhatsApp routing, and admin controls.Thu, 28 May 2026 00:00:00 GMThttps://welsh.co.ke/posts/c-from-the-trenches-breaking-the-stack/https://welsh.co.ke/posts/c-from-the-trenches-breaking-the-stack/A deep dive into how C handles memory and how we can use buffer overflows to hijack program execution.Thu, 09 Apr 2026 00:00:00 GMThttps://welsh.co.ke/posts/cve-2026-31431-copy-fail/https://welsh.co.ke/posts/cve-2026-31431-copy-fail/Exploit copy-fail, a kernel LPE that corrupts any file's page cache to gain root in seconds.Sun, 10 May 2026 00:00:00 GMThttps://welsh.co.ke/posts/easy-elf-reversing-kr/https://welsh.co.ke/posts/easy-elf-reversing-kr/Find the password that makes the binary print `Correct!`.Thu, 06 Aug 2026 00:00:00 GMThttps://welsh.co.ke/posts/introduction-to-web-services-and-apis-pt1/https://welsh.co.ke/posts/introduction-to-web-services-and-apis-pt1/Web Services vs APIs, what's the difference? In this post, I break down XML-RPC, JSON-RPC, SOAP, REST and more with real code examplesMon, 01 Jun 2026 00:00:00 GMThttps://welsh.co.ke/posts/mastering-syscall-level-reversing/https://welsh.co.ke/posts/mastering-syscall-level-reversing/A Deep Dive into Operating System Interactions; Why Syscall-Level MattersMon, 15 Jun 2026 00:00:00 GMThttps://welsh.co.ke/posts/mastering-syscall-level-reversing-pt2/https://welsh.co.ke/posts/mastering-syscall-level-reversing-pt2/The hook is the problemFri, 26 Jun 2026 00:00:00 GMThttps://welsh.co.ke/posts/mini-readelf-gluing-it-all-together/https://welsh.co.ke/posts/mini-readelf-gluing-it-all-together/The capstone. Four parts of pieces, headers, sections, symbols, relocations, joined into one tool that reads any ELF. The only new mechanic is the sh_link chain: offset into a table that holds offsets into a table that holds strings.Wed, 09 Sep 2026 00:00:00 GMThttps://welsh.co.ke/posts/n8n-cve-2025-68613-expression-injection/https://welsh.co.ke/posts/n8n-cve-2025-68613-expression-injection/A comprehensive look at CVE-2025-68613 in n8n - how expression injection can lead to remote code execution and what you can do to protect yourself.Thu, 25 Dec 2025 00:00:00 GMThttps://welsh.co.ke/posts/nahamcon-winter-ctf-2025-crypto-writeups/https://welsh.co.ke/posts/nahamcon-winter-ctf-2025-crypto-writeups/Comprehensive writeups for the cryptography challenges from NahamCon Winter CTF 2025, featuring Linear Lines affine cipher analysis and practical solving techniques.Fri, 19 Dec 2025 00:00:00 GMThttps://welsh.co.ke/posts/nahamcon-winter-ctf-2025-mobile-writeups/https://welsh.co.ke/posts/nahamcon-winter-ctf-2025-mobile-writeups/Detailed writeups for mobile security challenges from NahamCon Winter CTF 2025, covering Android APK reverse engineering, vulnerability analysis, and exploitation techniques.Fri, 19 Dec 2025 00:00:00 GMThttps://welsh.co.ke/posts/parsing-elf-binaries-in-c/https://welsh.co.ke/posts/parsing-elf-binaries-in-c/The first step to actually understanding what runs on your machine: read an ELF file yourself. No libelf, no readelf — just mmap and pointer casts. I walk the header and section table of a real binary, and diff my output against the tools that already exist.Tue, 01 Sep 2026 00:00:00 GMThttps://welsh.co.ke/posts/relocations-how-pie-binaries-fix-their-addresses/https://welsh.co.ke/posts/relocations-how-pie-binaries-fix-their-addresses/A PIE binary can't write final addresses because ASLR moves it. The linker leaves placeholders and the loader patches them after mapping. That's a relocation: R_X86_64_RELATIVE, GLOB_DAT and JUMP_SLOT.Sat, 05 Sep 2026 00:00:00 GMThttps://welsh.co.ke/posts/rootme-elf-x86-0-protection/https://welsh.co.ke/posts/rootme-elf-x86-0-protection/Systematic reverse engineering approach for unprotected ELF binaries using static analysis techniques and Ghidra decompilationThu, 18 Dec 2025 00:00:00 GMThttps://welsh.co.ke/posts/rop-emporium-ret2win/https://welsh.co.ke/posts/rop-emporium-ret2win/Today, we are going to break down ret2win, a classic binary exploitation challenge from ROP Emporium.Wed, 15 Apr 2026 00:00:00 GMThttps://welsh.co.ke/posts/symbol-tables-what-function-names-actually-are/https://welsh.co.ke/posts/symbol-tables-what-function-names-actually-are/Function names in a binary are just entries in a table. Two tables actually: .symtab and .dynsym. Here's what each is for, how the struct works, and how to resolve a name from an address.Fri, 04 Sep 2026 00:00:00 GMThttps://welsh.co.ke/posts/the-go-shebang-scripting-without-the-compile-run-friction/https://welsh.co.ke/posts/the-go-shebang-scripting-without-the-compile-run-friction/In traditional Unix Scripting, the `#!` (shebang) tells the kernel which interpreter to use for the file. For Go, which is a compiled language, this is technically a lie. By using a wrapper, you can treat `.go` files as executable scripts that compile and run on the fly.Mon, 13 Apr 2026 00:00:00 GMThttps://welsh.co.ke/posts/tryhackme-cloud-security-pitfalls-writeup/https://welsh.co.ke/posts/tryhackme-cloud-security-pitfalls-writeup/A friendly, SOC-focused walkthrough of cloud migration risks, shared responsibility, logging challenges, and practical monitoring takeaways.Fri, 30 Jan 2026 00:00:00 GMThttps://welsh.co.ke/posts/tryhackme-cyber-kill-chain-writeup/https://welsh.co.ke/posts/tryhackme-cyber-kill-chain-writeup/A comprehensive walkthrough of TryHackMe's Cyber Kill Chain room, exploring each phase of cyber attacks from reconnaissance to actions on objectives, plus a real-world analysis of the Target data breach.Sun, 28 Dec 2025 00:00:00 GMThttps://welsh.co.ke/posts/tryhackme-django-cve-2025-64459/https://welsh.co.ke/posts/tryhackme-django-cve-2025-64459/A friendly walkthrough of Django CVE-2025-64459 - understanding and exploiting ORM query parameter injection vulnerabilities in web applications.Sun, 21 Dec 2025 00:00:00 GMThttps://welsh.co.ke/posts/tryhackme-exploitation-with-curl-hoperation-eggsploit/https://welsh.co.ke/posts/tryhackme-exploitation-with-curl-hoperation-eggsploit/A hands-on walkthrough of TryHackMe's cURL exploitation room - learning HTTP requests, POST data, cookies, sessions, and brute force attacks from the command line.Fri, 26 Dec 2025 00:00:00 GMThttps://welsh.co.ke/posts/tryhackme-first-shift-ctf-probably-just-fine/https://welsh.co.ke/posts/tryhackme-first-shift-ctf-probably-just-fine/A step-by-step SOC investigation through TryHackMe's First Shift CTF scenario, covering threat intel lookups, file hash analysis, and report-driven attribution insights.Tue, 27 Jan 2026 00:00:00 GMThttps://welsh.co.ke/posts/tryhackme-obfuscation-principles-writeup/https://welsh.co.ke/posts/tryhackme-obfuscation-principles-writeup/A comprehensive guide to understanding obfuscation techniques for malware evasion, from basic concatenation to advanced control flow manipulation. Learn how attackers hide their code and how defenders can spot these techniques.Wed, 31 Dec 2025 00:00:00 GMThttps://welsh.co.ke/posts/tryhackme-passwords-cracking-christmas/https://welsh.co.ke/posts/tryhackme-passwords-cracking-christmas/A comprehensive walkthrough of the TryHackMe Passwords room, exploring password-based encryption attacks and defensive strategies during the holiday season.Mon, 15 Dec 2025 00:00:00 GMThttps://welsh.co.ke/posts/tryhackme-web-attack-forensics-drone-alone/https://welsh.co.ke/posts/tryhackme-web-attack-forensics-drone-alone/A comprehensive blue team investigation walkthrough of the TryHackMe Web Attack Forensics room, analyzing malicious web activity and command injection attacks using Splunk.Tue, 16 Dec 2025 00:00:00 GMThttps://welsh.co.ke/posts/tryhackme-x86-architecture-overview-writeup/https://welsh.co.ke/posts/tryhackme-x86-architecture-overview-writeup/A comprehensive guide to x86 CPU architecture fundamentals essential for malware reverse engineering. Learn about registers, memory layout, and stack operations that form the foundation of system exploitation.Mon, 01 Jan 2024 00:00:00 GMThttps://welsh.co.ke/posts/what-happens-when-you-remove-the-lies-from-a-trading-backtest/https://welsh.co.ke/posts/what-happens-when-you-remove-the-lies-from-a-trading-backtest/I built a backtesting engine where look-ahead bias, optimistic fills and unreproducible results are structurally impossible — then ran 860 EMA crossover and RSI configurations across 23 years of daily EURUSD. The honest verdict: the most popular strategies in retail trading are zombies.Mon, 24 Aug 2026 00:00:00 GMThttps://welsh.co.ke/posts/why-c-still-matters-in-reverse-engineering/https://welsh.co.ke/posts/why-c-still-matters-in-reverse-engineering/C is still the GOAT of reverse engineeringTue, 30 Jun 2026 00:00:00 GMT