Breaking the Sound Barrier Part I: Fuzzing CoreAudio with Mach Messages

Part 7 of the Windows Registry Adventure series, mapping which Windows components parse registry data and identifying the most promising attack surface for deeper research.

Part 6 of the Windows Registry Adventure series, examining kernel-mode registry objects and the additional attack surface they expose to privilege escalation research.

A practical recipe for fuzzing macOS kernel extensions in userspace by combining IDA-assisted harnessing with TinyInst, lowering the cost of finding driver bugs.

A look at the Android kernel driver attack surface, summarizing research progress, recurring bug classes, and directions for hardening and future driver security work.

Part 1 of the Windows Registry Adventure series, introducing the research goals, methodology, and headline results from auditing how Windows parses registry data.

A Project Zero deep dive into a design flaw around task_t in the XNU kernel, demonstrating sandbox escapes and privilege escalation and how each mitigation was defeated.