// Breaking systems to build better defenses
Harith Dilshan
Offensive Security Engineer. Penetration testing across web, mobile and network, with a habit of reading the binary.
01Read the binary
Under the name,
a real binary.
The field behind this page is the disassembly of fwupd, a small firmware-update receiver I wrote and compiled for arm64. 783 instructions across 28 functions.
One of them trusts the wrong thing.
Mach-O arm64 · Apple clang 21.0.0 · -O2 -fno-inline
02Find the assumption
A length,
read as signed.
fw_write_chunk takes a 32-bit length off the wire into an int and checks it against 0x400. The compiler emits b.le, a signed branch.
Send 0xfffffff0: it reads as −16, slips under the limit, and memcpy gets it sign-extended to 18 exabytes.
CWE-195SIGSEGV (exit 139)
03Patch one byte
6d → 69.
A conditional branch keeps its condition in the low nibble of its first byte. Flip 1101 (LE, signed) to 1001 (LS, unsigned).
Same target, same length, one byte at file offset 0xce8.
04Prove it
Rejected.
Then trusted.
Re-signed and replayed against the same inputs on Apple silicon. Not a model, the actual binaries.
