Linux internals · reverse engineering · vulnerability research

Full-time on Linux internals, reverse engineering and vulnerability research since January 2026. Sixteen of my patches are in the mainline kernel, two of them co-developed with a MediaTek engineer, and fourteen more are accepted and on their way. Also since January: a published CVE, two paid contracts, and an open Wi-Fi firmware I'm writing from the disassembly.

Available for remote contracts. Linux driver development, reverse engineering, vulnerability research. 📍 Vancouver Island, BC, Canada  ·  ✉️ [email protected]  ·  🌐 justthetip.ca  ·  ☕ Ko-fi

Seven carry a stable tag. Nine have shipped in the stable trees, across eight branches back to 5.10. The oldest bug in the table dates to 2017.

Most of them share a cause. USB and SDIO adapters, and monitor mode, run through code written and tested mainly for PCIe cards doing ordinary client traffic.

Six more mainline commits credit me for reporting, testing or carrying them upstream.

Write and triage collaborator on three of morrownr's repos. Review, tester coordination, and the link between them, linux-wireless and upstream.

• USB-WiFi: adapter reviews, a list of what actually works on Linux, chipset tables and user support. I'm listed as one of its two site maintainers.
• mt76: out-of-tree builds of the mt76 driver for kernels 6.12 through 7.2, so people get current fixes without waiting on a distro. The install scripts handle DKMS and Secure Boot.
• rtw89: the same job for the rtw89 series, writing and testing USB drivers with the aim of getting them upstream.

This USB Wi-Fi family has no mainline support. The vendor's own driver was told upstream to be redesigned from scratch first, and the licence on its firmware is still unresolved. So I'm writing a replacement: my firmware on the chip, the standard Linux stack on the host, no vendor blob.

reverse engineered   boot and init, the USB data path, the transmit and receive
                     rings, firmware load, and the calibration that nulls carrier
                     leakage. From the disassembly, with no source and no datasheet
on air               my own firmware, running standalone, programs the synthesiser
                     and puts a narrow CW carrier where it is commanded. Two targets
                     66 MHz apart landed 66.01 MHz apart, each within 20 kHz, and
                     every peak vanishes with the chip powered down
next                 frames

Automotive keyless entry, 2026. A dozen firmware images for a hardware-security vendor, delivered and in flight. Each delivery is a C reimplementation of that firmware's cryptography and key derivation, checked byte for byte against captured radio traffic or against an emulator.

cores      STM8, ARM Cortex-M0, PIC, HCS12 and HCS12X, V850, R32C, 8051
ciphers    KeeLoq variants, XTEA, AES-128, a DST80-family stream cipher,
           custom block and S-box designs, several PRNGs

The hard part was getting from a stripped flash dump to a function map. Stock tooling gave up on paged flash and the uncommon cores, so I wrote my own function walker, disassembler and emulator.

Linux wireless driver, current. Driver work for a module vendor so their USB part can carry long-range video links. Fixed-rate injection, narrow channels, and getting the result upstream.

Reported through Bugcrowd and HackerOne. Vendor names are withheld where an embargo or agreement applies.

• First CVE, arbitrary file overwrite as root. CVE-2026-20161 (Cisco ThousandEyes). A monitoring agent running as root followed a symlink out of its own log directory, so a local user with low privileges could overwrite any file on the box. Fixed in 1.234.0.

• Five privilege escalations in one enterprise VPN client. A race to SYSTEM and a forced-authentication escalation on Windows. On Linux, a local socket that ran a caller's commands as root, a path traversal through that same socket, and arbitrary file write as root by symlink.

• Windows logon passwords out of the same product. A shared memory object any user could write held the address its credential provider sends passwords to. Point that at your own listener, decrypt with a key hardcoded in the product, and you have someone else's password.

• Denial of service on a Windows endpoint-protection product. A DNS response carrying a few thousand chained compression pointers makes the network filter recurse until it runs out of stack. The process dies and network-level protection stays down. The vendor reproduced it.

• A certificate authority private key shipped inside firmware. A virtual gateway's published image carries one CA key, generated once and identical in every deployment. Pull it out of the public image, forge a certificate the appliance trusts, sit on the management channel. Reproduced by the triager, then closed by the vendor as not applicable.

• Licence forgery on a network management appliance. The signing key was a 512-bit RSA modulus. Factored it, recovered the private key, forged licences on a live appliance.

• SSRF to cloud credentials. DNS rebinding walked through a cloud networking product's SSRF filter and reached the instance metadata service, which hands out the host's cloud credentials.

• Quarantine bypass and audit log forgery on a Linux endpoint product. A world-writable scanning socket speaking a binary protocol. Reverse engineered it into a quarantine bypass and into a way to write fabricated entries into the cloud console's audit log.

• Two account takeovers at a telecom carrier. One takes over a webmail account with no click, through a hole in the HTML sanitiser. The other resets any customer's password by brute forcing a one-time code that has no rate limit.

Further findings across identity, fintech and IoT.

_{justthetip.ca: the writing, and every machine and radio on the lab bench.}