Jenn's Avatar

Jenn

@zolutal

PhD Student at ASU | blog.zolutal.io Captain of Shellphish | shellphish.net she/her

37
Followers
58
Following
13
Posts
07.12.2023
Joined
Posts Following

Latest posts by Jenn @zolutal

Sorry, I didn't intend to jump on her or anything with my response :(
I definitely I could've better expressed what I was saying, but the character limit on this site makes it hard. The other responses were very unwarranted though, I don't know why they felt the need to jump in like that.

02.03.2026 07:29 ๐Ÿ‘ 1 ๐Ÿ” 0 ๐Ÿ’ฌ 0 ๐Ÿ“Œ 0

The majority of those in the US military come from a middle class background. Low income backgrounds are slightly underrepresented even. I've heard similar arguments before, but they just don't seem to be reflected in demographic data afaict.
www.cfr.org/backgrounder...

01.03.2026 15:43 ๐Ÿ‘ 4 ๐Ÿ” 0 ๐Ÿ’ฌ 1 ๐Ÿ“Œ 0
Kansas Sends Letters To Trans People Demanding The Immediate Surrender Of Drivers Licenses
"The legislature did not include a grace period."
ERIN REED
FEB 25, 2026
88
5
21
Share
Kansas Sate Capitol // farzinvousoughian

Kansas Sends Letters To Trans People Demanding The Immediate Surrender Of Drivers Licenses "The legislature did not include a grace period." ERIN REED FEB 25, 2026 88 5 21 Share Kansas Sate Capitol // farzinvousoughian

1. Numerous transgender people in Kansas are reporting that the state has sent them a letter demanding the immediate surrender of drivers licenses.

Those driving could be arrested, charged, and see privileges revoked.

Subscribe to support our journalism.

www.erininthemorning.com/p/kansas-sen...

26.02.2026 01:06 ๐Ÿ‘ 6355 ๐Ÿ” 3476 ๐Ÿ’ฌ 239 ๐Ÿ“Œ 910

i don't usually like to post about politics because it's depressing and id rather post about fun security stuff
but there's just such horrifying stuff going on here, denying hormones and surgeries, tapering people on hormones off of them. people are going to die from this...

23.02.2026 22:29 ๐Ÿ‘ 1 ๐Ÿ” 0 ๐Ÿ’ฌ 0 ๐Ÿ“Œ 0
Revisiting Two-Shot Kernel Shellcode Execution From Control Flow Hijacking One of the inspirations for my work on the System Register Hijacking paper was this blog post by Project Zero written by Andrey Konovalov. In the blog post he describes a method of bypassing SMEP/SMAP...

wrote a short blog post about some toying around I did with using kprobes to get around a mitigation in order to disable SMEP/SMAP:
blog.zolutal.io/two-shot-ker...

11.02.2026 17:36 ๐Ÿ‘ 0 ๐Ÿ” 0 ๐Ÿ’ฌ 0 ๐Ÿ“Œ 0
MetaCRiSP 2026

๐Ÿ“ฃ Call for papers!

If you're interested in all things metascience, consider submitting to the 1st Workshop on Metascience and Critical Reflections in Security & Privacy (MetaCRiSP), co-located with IEEE S&P. Deadline's Feb 12, AoE.

CfP & details: metacrisp.org

19.01.2026 21:42 ๐Ÿ‘ 5 ๐Ÿ” 2 ๐Ÿ’ฌ 1 ๐Ÿ“Œ 0

Am I tripping or is this sentence really weird, are they using AMAB here to lop cis men and transfems together...? no comment on the rest of it, but this gave me an ick ngl

"Overwhelmingly white, upper middle class+, and AMAB the FOSS community seems confused, why can't it attract more adherents?"

19.12.2025 18:04 ๐Ÿ‘ 0 ๐Ÿ” 0 ๐Ÿ’ฌ 1 ๐Ÿ“Œ 0
Securinets Quals 2025: Sukunahikona (v8 Exploitation) I played Securinets Quals this weekend with Shellphish; we ended up placing 7th, qualifying us for finals! When I logged on to play, all of the released pwn was already solved or close to solved by @v...

I solved my first ever v8 exploitation challenge this past weekend and did a little writeup on it:
blog.zolutal.io/securinets-s...

08.10.2025 06:07 ๐Ÿ‘ 2 ๐Ÿ” 0 ๐Ÿ’ฌ 0 ๐Ÿ“Œ 0
a screenshot of debug output from doing a successful nested page walk

a screenshot of debug output from doing a successful nested page walk

Success :3

03.10.2025 19:24 ๐Ÿ‘ 1 ๐Ÿ” 1 ๐Ÿ’ฌ 1 ๐Ÿ“Œ 0

that my normal guest page-walking code for converting an L1 virtual address to an L1 physical address was able to be entirely reused to do an L2 physical address to L1 physical address walk by just using the L1 EPTP in place of the L1 cr3 was pretty neat

03.10.2025 19:24 ๐Ÿ‘ 0 ๐Ÿ” 0 ๐Ÿ’ฌ 0 ๐Ÿ“Œ 0

it was actually surprisingly easy to implement, except that I for some reason was treating the result of the nested page walk as an L1 physical address instead of an L2 physical address, just needed one more page walk to finish it off

03.10.2025 19:24 ๐Ÿ‘ 0 ๐Ÿ” 0 ๐Ÿ’ฌ 1 ๐Ÿ“Œ 0
a screenshot of debug output from doing a successful nested page walk

a screenshot of debug output from doing a successful nested page walk

Success :3

03.10.2025 19:24 ๐Ÿ‘ 1 ๐Ÿ” 1 ๐Ÿ’ฌ 1 ๐Ÿ“Œ 0

"Yes please walk the EPT in L1 for the L2 cr3 to get the L2 PML4 physical address in L1 so you can convert that to a virtual address in your VMM to read the L2 PML4E associated with an L2 virtual address" - Statements dreamed up by the utterly Deranged

03.10.2025 08:03 ๐Ÿ‘ 2 ๐Ÿ” 1 ๐Ÿ’ฌ 1 ๐Ÿ“Œ 0
06.09.2025 21:13 ๐Ÿ‘ 303 ๐Ÿ” 28 ๐Ÿ’ฌ 3 ๐Ÿ“Œ 1
The Joys of Linux Kernel ROP Gadget Scanning Linux Kernel ROP gadget scanning is one of those things that seems easy in theory โ€“ just run ROPgadget --binary vmlinux on it! In practice, however, anyone who has used that method has likely had to s...

I finally got around to blogging again!

This time its about the fun rabbit hole I went down last year of trying to improve Linux kernel ROP gadget discovery:
blog.zolutal.io/joys-of-kern...

03.09.2025 23:47 ๐Ÿ‘ 3 ๐Ÿ” 0 ๐Ÿ’ฌ 0 ๐Ÿ“Œ 0
A hole in FineIBT protection Intel's indirect branch tracking (IBT) is a hardware-implemented control-flow-integrity mechani [...]

We brought the FineIBT bypass to the linux-hardening mailing list a few months ago and it has since been addressed by introducing a new paranoid FineIBT mode that adds caller-side checks.
The LWN article that got written about it does a good job describing the issue and fix: lwn.net/Articles/101...

05.05.2025 22:03 ๐Ÿ‘ 0 ๐Ÿ” 0 ๐Ÿ’ฌ 0 ๐Ÿ“Œ 0
System Register Hijacking: Compromising Kernel Integrity By Turning System Registers Against the System | USENIXusenix_logo_notag_white

My first paper is now up on the USENIX Security site :)

We evaluated the prevalence of x86_64/aarch64 system instructions in Linux kernel builds and their applicability to Control Flow Hijacking exploitation, identifying a FineIBT (Kernel CFI) bypass in the process!
www.usenix.org/conference/u...

05.05.2025 21:52 ๐Ÿ‘ 1 ๐Ÿ” 1 ๐Ÿ’ฌ 1 ๐Ÿ“Œ 0