djad04

exactly and at the time I wasn’t planning for it to end up on Hacker News. if I knew I woul've made it much more direct without all the basics

yes i understand that the problem is that I was writing this as I was investigating. I had a huge file of notes that I kept adding to as I went, than got back to add again each time and eventually turned that into the writeup. So what you're reading is quite literally my path towards understanding and solving the problem, rather than something I wrote afterwards with a predefined structure and roadmap

well it is a deep dive if i just shrink its size to 25% it would be the same thing that already exists around, calif itself did an article on it and there are thousands of articles around that say little to nothing about it, they just explain the thing on the surface so honestly i dont see the purpose on doing another thing like that, this is meant to show everything in detail, i know not lot of people will read it, it was not made to be read by a mass audience but the few that will at least i hope that they will deeply understand what's happening. for the images well since its a long writeup i tried to make it a little less boring by taking some inspiration from how Calif's Research Lab presents their work, cause i've always found there way of showing things intresting and its different than everything else out there, in the end the writeup has my personality on it and when i write something i always like to do it in my own way.if I showed you my internship reports, university presentations and other writeups, you'd probably notice the same style I just like doing things in a way that I enjoy.

I'm the one who wrote this.I originally tried submitting it here myself but without much luck so glad to see someone else shared it! Thanks for bringing it here.

also if anyone has another working PoC for that specific build I'd really appreciate if they could share it because looking at how the exploit works it does something that is not done on any other solution that i found for other builds, none of them hold the spot with a resize (key “1050” is sent twice) than make an intermediate buffer from the next field("1999") fall there.it’s the only approach I’ve seen that uses a repeated key like that.

I wonder whether there's a more direct way to achieve that as in the solutions for other builds. If there is, I think it would be interesting to compare the reliability of the different approaches based on the memory manipulation itself rather than how they reach the target