Security research: fuzzing, mobile, and vulnerability discovery. Zola 2026-07-31T00:00:00+00:00 https://john.dearmas.xyz/tags/meta/atom.xml 2026-07-31T00:00:00+00:00 2026-07-31T00:00:00+00:00 John De Armas https://john.dearmas.xyz/research/hello/ <p>Short version: I needed somewhere to put writeups that isn't a gist, a PDF attached to a bug report, or a thread nobody can find six months later.</p> <h2 id="what-goes-here">what goes here<a class="post-anchor" href="#what-goes-here" aria-label="Anchor link for: what-goes-here"><span aria-hidden="true">#</span></a> </h2> <ul> <li><strong>Fuzzing work.</strong> Harness design, corpus construction, coverage analysis, and the unglamorous part where you spend three days figuring out why the target won't fork.</li> <li><strong>Vulnerability writeups.</strong> Root cause, reachability, exploitability, and an honest assessment of impact — including when the answer is "less than it looks."</li> <li><strong>Reverse engineering notes.</strong> Mobile internals, IPC surfaces, and protocol archaeology.</li> </ul> <h2 id="what-does-not-go-here">what does not go here<a class="post-anchor" href="#what-does-not-go-here" aria-label="Anchor link for: what-does-not-go-here"><span aria-hidden="true">#</span></a> </h2> <p>Anything unpatched or under embargo. Every writeup carries its disclosure status in the header block, and a post does not exist until that status says it can.</p> <h2 id="the-stack">the stack<a class="post-anchor" href="#the-stack" aria-label="Anchor link for: the-stack"><span aria-hidden="true">#</span></a> </h2> <p>Static site, no JavaScript, no analytics, no third-party requests:</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name z-function">zola</span><span class="z-string"> build</span></span> <span class="giallo-l"><span class="z-entity z-name z-function">rsync</span><span class="z-constant z-other"> -az --delete</span><span class="z-string"> public/ dxyz:/var/www/john.dearmas.xyz/</span></span></code></pre> <p>That's the whole pipeline.</p>