637th Research Lab
What happens when I stop trusting and start looking.
A SYSTEM service silently applies unsigned configuration packages from a folder — no signature, no consent, no interaction. Microsoft's docs promise otherwise. The honest catch: on a normal PC it's admin→SYSTEM, and a symbol's name fooled the analysis into believing otherwise.
ReadAI-driven zero-day finding is spreading fast. This is a report on the harder part: building an AI that autonomously reverse-engineers undocumented Windows internals to invent attack techniques nobody has named — borrowing discovery methods from outside security, doubting its own conclusions, and running unattended for hours without fooling itself.
ReadHow the same AI analysis workflow that found a zero-day in strongSwan discovered a 9-year-old heap buffer overflow in BusyBox's DHCPv6 client — plus a full walkthrough of the proof-of-concept development process.
ReadA detailed walkthrough of implementing the DEF CON 31 NoFilter WFP technique as an OPSEC-hardened Havoc C2 BOF, including indirect syscalls, return address spoofing, patchless AMSI/ETW bypass, and lessons learned from Havoc BOF development.
ReadHow I discovered CVE-2026-25075 — a vulnerability that had been quietly sitting in strongSwan's codebase since 2011 — using a structured, multi-pass AI analysis workflow.
ReadA SYSTEM service silently applies unsigned configuration packages from a folder — no signature, no consent, no interaction. Microsoft's docs promise otherwise. The honest catch: on a normal PC it's admin→SYSTEM, and a symbol's name fooled the analysis into believing otherwise.
AI-driven zero-day finding is spreading fast. This is a report on the harder part: building an AI that autonomously reverse-engineers undocumented Windows internals to invent attack techniques nobody has named — borrowing discovery methods from outside security, doubting its own conclusions, and running unattended for hours without fooling itself.
How the same AI analysis workflow that found a zero-day in strongSwan discovered a 9-year-old heap buffer overflow in BusyBox's DHCPv6 client — plus a full walkthrough of the proof-of-concept development process.
A detailed walkthrough of implementing the DEF CON 31 NoFilter WFP technique as an OPSEC-hardened Havoc C2 BOF, including indirect syscalls, return address spoofing, patchless AMSI/ETW bypass, and lessons learned from Havoc BOF development.
