Posts on low-level security, exploit dev, CTFs, and Python/Go/C++ internals — by Dominik Czarnota, Staff Security Engineer at Trail of Bits and Pwndbg maintainer.

• 2025-03-16 Hijacking a Python upload server: writeup from Insomni'hack CTF 2025

  This blog post is a write up of an “Upload Server” challenge where we had to hack a simple server written in Python and steal a secret file (flag) from it. The task is from the Insomni’hack CTF 2025 competition that I played with my team, justCatTheFish in Lausanne, Switzerland. We scored 4th place (or 5th overall, though academic teams had separate ranking). Below you can see how it looked like :).

  Read more
• 2025-03-03 When NULL isn't null: mapping memory at 0x0 on Linux

  When we think of a null pointer, NULL in C or nullptr in C++, we typically assume it is “invalid” or “not pointing to a valid memory location”. But what if I tell you that a null pointer can actually point to valid memory under certain conditions? In this post, we will see this on Linux.

  Read more
• 2024-08-04 Debugging running Python scripts with PDB via GDB

  A friend of mine had an interesting case recently where they wanted to debug an already running Python script on Linux and after some testing it turned out this is possible, so let’s see how it can be done in CPython :).

  Read more
• 2024-06-20 Python specialized bytecode and pycjail returns challenge solution

  I gave a talk on “Python specialized bytecode” on Pykonik #70 where I also made a walkthrough over the “pycjail returns” challenge from ångstrom CTF 2024. The video can be found here and its slides here.

  Read more
• 2024-05-16 Understanding AddressSanitizer blog post

  Some time ago during an audit I found an out-of-bounds bug that was not detected by AddressSanitizer. This spawned a whole research at Trail of Bits which I talked and wrote about in details!

  Read more
• 2022-08-21 Pwndbg coding sprints report

  This blog post is a report of the two coding sprints for the Pwndbg project that I organized first on the EuroPython 2022 conference and then, taking inspiration from the previous one, in the Hackerspace Kraków, located in Cracow, Poland.

  Read more
• 2021-02-16 Terrible inet_aton in glibc

  TLDR: The man inet_aton states that “inet_aton() returns nonzero if the address is valid, zero if not” …and so it is sometimes used to check if a string is a valid IP address. Which should be fine, but isn’t, because some implementations are weird.

  Read more
• 2020-06-09 Checking if a mutex is locked in Go

  I have written a blog post about checking if a mutex is locked in Go. It can be found at https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/.

  Read more
• 2020-04-09 Back to the blog

  I haven’t written any post in here for some time and I want to fix that. For now, it is probably worth mentioning that in the meantime I gave many talks, reviewed some articles in Paged Out! and wrote two articles:

  • A blog post on Trail of Bits blog: “Understanding Docker container escapes”
  • An article “from cpython_exploit_ellipsis import *” to Paged Out! #01

  Read more
• 2018-11-12 Reboot your pc from a docker container

  I came back from a PUT Security Day where I gave a talk about Docker security. One of the questions I asked myself when preparing the talk is whether one can reboot their PC (aka host machine) from a docker container.

  Read more
• 2018-02-24 Logs injection or why is logs tailing unsafe

  I have been playing with one of Android apps that pushes some messages to logs based on user input recently and I have noticed that adb logcat is as bad as tail -f when it comes to following logs.

  Read more
• 2017-10-21 JHtC4BSK translatespeak [web] writeup

  This is a writeup of translatespeak{1,2,3} web security related tasks I have prepared for JHtC4BSK CTF that was held mainly for MIMUW students by JHtC.

  Read more
• 2017-06-29 Gynvael's PL stream 006 mission solution

  This is a writeup to small stegano task from Gynvael Coldwind’s polish stream 6th mission (there are small tasks at the end of his livestreams).

  Read more
• 2017-06-25 Google CTF 2017 - Inst Prof [pwn]

  This post is a full writeup and walkthrough of a ‘Inst Prof’ binary exploitation challenge from Google Quals CTF 2017. I have used a return-oriented programming exploitation technique to solve it.

  Read more
• 2017-05-29 Gynvael's PL stream 004 mission solved with angr

  This is an angr writeup to a “spaghetti code” task from Gynvael Coldwind’s polish stream 4th mission (there are small tasks at the end of his livestreams).

  Read more
• 2016-11-09 Security PWNing Conference 2016 oraz CTF od P4

  Niedawno wróciłem z Security PWNing Conference 2016 organizowanej przez wydawnictwo PWN oraz Gynvaela Coldwinda. Z całą pewnością można powiedzieć, że to jedna z lepszych konferencji poświęconych tematyce bezpieczeństwa IT w Polsce.

  Read more
• 2016-06-01 Confidence CTF Teaser 2016 - GoBox and GoBox2 [pwn]

  This is a writeup from Confidence CTF Teaser 2016 - GoBox and GoBox2 tasks from pwn category.

  The program was a Go lang sandbox that asked for input - a valid Go program. Then it compiled and executed it. The binary was running on a server and the goal was to launch external program on it.

  Read more
• 2016-05-02 Google CTF 2016 - For2 [Forensics]

  This is a writeup from Google CTF 2016 - For2 task from forensics category.

  We have got a capture.pcapng file, which is a sniffed USB traffic from an usb mouse (yeah, you can capture it e.g. with Wireshark).

  Read more
• 2016-04-01 C++ Boost.Preprocessor and template loops

  Today I will write a story about how I saved myself a lot of writing with just a few lines of code (that doesn’t mean it took little time :P).

  Read more
• 2015-10-10 One extract to rule them all

  From time to time everyone has to extract an archive. When living in a command line the problem of such task is to remember all of the arguments to every of the tools/programs that let you extract different types of archives.

  Read more

subscribe via RSS

Latest talks

• 2026-04-24 NYU OSIRIS Lab Cybersecurity Club, New York City, USA

  • Pwndbg & Escaping the matrix: exploiting custom QEMU cpu bugs from a HXP CTF 2024 task (slides)

• 2026-04-24 Bug Bash 2026, Washington DC, USA

  • Hacking kiosk interfaces v1.1 (slides)

• 2026-04-17 NYC Systems, New York City, USA

  • [lightning talk] Coordination (or shared state) kills performance (slides)
  • Hacking kiosk interfaces v1.0 (slides)

All talks →