My Favorite Redpill

No! Not the silly manosphere stuff.

Redpills; techniques in which software (specifically malware) can detect whether they are running in some sort of virtualized environment, sandbox or debugger.

Zig's New Io

In version 0.15.1, Zig removed the async and await keywords, anticipating to rework and bring them back as part of a new Io interface. That was pretty exciting, but I didn’t get how it would fully work until I got to try it out in version 0.16.0.

Safety in Zig: Spatial Memory Safety

Zig provides spatial memory safety. It can perform bounds checking at compile time, for comptime known values, and crash with appropriate stack trace for runtime values. This means it prevents out-of-bounds access to arrays etc.

We’ll take a look at 2 simple examples to see how this works in practice.

Writing Custom Wazuh Rules

Wazuh is a powerful open-source security monitoring platform that acts as a SIEM/XDR solution. Though it has some shortcomings, it has tons of strengths, my favorite ones being; its customizability and its open-source nature. This article will be more or less a tutorial on how to write a simple custom wazuh rule to detect potential port scans on a monitored host.

Safety in Zig: How Debug Allocator Works

Zig is not a memory-safe language. It, however, provides some tools to help avoid some memory safety issues. One of the key tools that help achieve this is the debug allocator.

Painless Guide to Linux in-Memory Execution

In-memory execution, a technique that allows programs to be run directly from memory without being written to disk.

Zig as a drop-in replacement for C build systems

A while back I wrote a small neofetch-like program in Zig as a way to learn the language. I always knew Zig could interoperate with C, as I had earlier written a yara rules parser using treesitter and Zig.

Now I wanted to test my neofetch-like program in various environments, and one of those was st.

Pack to the Future: Obfuscating My C2 Agent

This is a follow up on my previous article.

It is generally about my journey in searching for a relatively unknown and easy to understand packer to obfuscate my custom zig C2 agent. If you are generally looking for a tutorial on how to pack binaries, this is not it. I will not go into the details of how packers work, but rather share what led me to the final solution.

Reflections on Writing a Mythic C2 Agent in Zig

Over the past couple of months, I’ve been writing a mythic C2 implant in zig. “Why?”, you ask. Well, it’s all part of my learning process. I also wanted to understand how C2 frameworks work and how zig can be used for offensive tooling.

Writing a Yara Parser

It’s been a while since I wrote yara rules. In fact, the last time I did, I was still using vscode. I needed now to write one. So I chose to look at one of my local yara rules repo. Opened it in nvim and … no syntax highlighting.

Chaos Cryptography

This article was originally published on section.io, May 2022

Quantum Key Distribution

This article was originally published on section.io, February 2022

Clearfake 2: We now have Lumma

I had previously written about my cutting up of clearfake which you can find here.

Quick recap:

• We deobfuscated the powershell obtained from a fake browser update prompt.
• The code executed base64 encoded command with window style hidden option.
• The command downloaded a data.zip file.

Security Slips: The Day I Ran Unknown Code

On March 25th 2025, Troy Hunt, haveibeenpwned’s author, published in his blog about how a sneaky phishing lure got hold of his mailing list. This interesting read made me reminisce about how, not so long ago, I almost fell for a similar thing, albeit mine was not so sophisticated.

Secure Development in Neovim using Snyk

In my previous post I talked about how you can use snyk in your editor as you code and even added snyk-ls as a must have. I had a bit of a tough time finding the correct configuration to achieve this using Neovim. Perhaps you are, right now, on the same path as myself last year. Luckily for you, I gotchu.

Nvim Dev

Here is a quick list of my Neovim setup for dev work. This includes plugins, LSPs and some handy keymaps.

Clearfake Malware Analysis

A while ago (around 7 months ago), I had obtained, through a friend, a sample of clearfake malware that was wrecking havoc in one of his friend’s servers.

This post is about analysis I had done. I have been procrastinating a lot on writing it, so here it goes…

Purplefox Analysis

Originally written Thu, Jun 15, 2023

About

Posts