https://algoatson.github.io/series/breaking-mitigations/ ARMv8.3 signs pointers with a cryptographic MAC in their spare bits; ARMv8.5 tags every allocation with a 4-bit lock the pointer must match. Both are real upgrades over the stack canary — and both are beaten by the same old moves: a leak, a signing gadget, or a brute force the field is too small to resist. en Tue, 16 Jun 2026 02:47:52 +0000 https://algoatson.github.io/p/the-stack-canary-from-the-source/ https://algoatson.github.io/p/the-stack-canary-from-the-source/ Sun, 15 Mar 2026 00:00:00 +0000 pwnglibcinternals Follow one random value from the kernel's AT_RANDOM, through glibc startup, into fs:0x28, and out to every function prologue. Reading the source explains the canary's quirks — the null low byte, the per-process (not per-call) value — and each quirk is a bypass. https://algoatson.github.io/p/ptr-mangle-exit-handlers/ https://algoatson.github.io/p/ptr-mangle-exit-handlers/ Sun, 07 Jun 2026 00:00:00 +0000 pwnglibcinternals glibc stores some function pointers — atexit handlers, TLS destructors, jmp_buf — mangled with a secret guard so you can't just overwrite them with a target. Read how the mangle works, where its guard lives (fs:0x30, the canary's neighbour), and the two moves that defeat it: leak the guard, or zero it. https://algoatson.github.io/p/cet-shadow-stack-ibt/ https://algoatson.github.io/p/cet-shadow-stack-ibt/ Fri, 05 Jun 2026 00:00:00 +0000 pwninternals Intel CET puts return addresses on a second, hardware-protected stack and demands every indirect branch land on an endbr64. That ends classic ROP and JOP. It does not end exploitation — whole-function calls, data-only attacks, and the occasional shadow-stack write all walk right past it. https://algoatson.github.io/p/arm64-pac-and-mte/ https://algoatson.github.io/p/arm64-pac-and-mte/ Tue, 02 Jun 2026 00:00:00 +0000 pwninternalsarm ARMv8.3 signs pointers with a cryptographic MAC in their spare bits; ARMv8.5 tags every allocation with a 4-bit lock the pointer must match. Both are real upgrades over the stack canary — and both are beaten by the same old moves: a leak, a signing gadget, or a brute force the field is too small to resist.