Software engineer, hacker
Alameda, CA
Joined June 2009
- Tweets218
- Following567
- Followers1.2K
- Likes212
Just saw the @JomboyMedia / @Jomboy_ about @Padres pitcher Mason Miller tipping pitches. I have a bit of software I wrote that analyzes pitchers for possible tipped pitches and ran it on Miller before seeing the video. Cool to see that it actually was confirmed in real life! Some screenshots with output data shown here. The short of it: software was able to predict slider vs fastball with great accuracy using just his set position. MLB teams have to have their own version of software like this, right???
Here are a few binaries lifted from the Perplexity VM. They include some CLI tools with some undocumented functionality for "Internal employee-only operations", some python scripts that outline the protobuf communication scheme, notebook operations, some guest -> host vsock stuff, and more... Reverse engineers: have fun! mega.nz/file/R0JQyTIS#pHw2zH…
1
119
[1/2] This is the XOR algorithm that deobfuscates the on-device LLM weights found in Chrome's OptGuideOnDeviceModel. The XOR algorithm resets per encoded region. Once the weights are deobfuscated, they can be used to run inference outside of the Chrome sandbox.
I found some Sony XCP protected CD's online which contain the infamous First 4 Internet rootkit. I've been reverse engineering the binaries and found out how the DRM in the autorun works. Sony's official player listens for fake opcodes, converts them into real opcodes to play the CD. If the fake opcodes are not found, the audio is scrambled with an LCG: state = (2683 · state + 3593) mod 65521 which turns the output audio into noise.
Looks like the annual "lock myself in my office for two weeks doing reverse engineering challenges" time of year is only 17-days away. #flareon13
2
188
Fun fact: Apple has an internal API called "HolyInquisition" in their WebContentAnalysis binary. It's a kernel configuration interface that sets up the local web proxy used to enforce the "Limit Adult Websites" filter at the network level. Blog post coming soon with full RE and oracle code to query Apple's Bloom filter domain blocklist, and an old LSM artifact for plaintext web page content classification.
4
229
Ran some pitch tipping pose estimation experiments on 30 MLB starting pitchers. Only found a couple that have some slight variations in their fastball vs offspeed pitch set poses. This is an example of a good one and one that's slightly different.
1
375
Found an interesting function while reverse engineering Apple's libcoreroutine.dylib. It's called [RTVisitRedactionUtilities shouldRedactAllVisitsForCurrentRegion] and it redacts location history data if your phone RF signal is in China.
Fun project for the day. Using Chrome's OptGuideOnDeviceModel to reverse engineer its own weights so they can be used outside of Chrome.
4
303
Two quality of life updates that I put in a codex CLI fork:
1. Option to remove text gutters
2. A "discover" model mode, where you prompt it, and it will decide an appropriate model and reasoning level for you based on the task, every time
225
I broke Kindle's DRM protection tonight through a mix of static and dynamic analysis. AES key is derived from accountSecrets, kindle device ID, and voucher path. Book is decrypted in parts using OpenSSL from Ion blobs and then decompressed with LZMA.
Blog post is up: hacked.codes/2026/breaking-k…
My Windows reverse engineering and exploit research workflow has been:
1. Pick a binary to research like tcpip.sys
2. Use github.com/joshterrill/post-… to automate seeing existing binary versions, download, and generate diffs from them
3. Load the resulting .binexport's and .bindiff into an LLM and ask it to analyze
4. Look up the build number of previous Windows version that old binary existed in from uupdump.net/ such as 26100.8328 and create a VM from it
5. Write code and test, working backwards from LLM analysis
Video of Kindle DRM being broken. Simple lldb script attaches to Kindle app, puts breakpoint on EVP_DecryptInit_ex and when you start paging through a book, AES and IV keys are dumped. It takes ~1 minute for the process attach + continue to take place, all the action is at the beginning and end of the video. Full blog post + code will be coming within the next week.