Introducing usb-racer
TL;DR: Introducing usb-racer, a tool for pentesting Time-of-check/Time-of-use (TOCTOU) issues with USB storage devices. usb-racer One issue that we are always on the lookout for when performing an embedded assessment…
Galactical Bug Hunting: How we discovered new issues in CD Projekt Red’s Gaming Platform
TL;DR: We analyzed the way on which GOG Galaxy 2.0 (a gaming platform owned by CD Projekt Red, creators of world-wide known games such as Cyberpunk 2077 and The Witcher…
NosyMonkey: API hooking and code injection made easy!
By Alex Popovici As a researcher I often run into situations in which I need to make a compiled binary do things that it wouldn’t normally do or change the…
Compromising Garmin’s Sport Watches: A Deep Dive into GarminOS and its MonkeyC Virtual Machine
By Tao Sauvage TL;DR: I reversed the firmware of my Garmin Forerunner 245 Music back in 2022 and found a dozen or so vulnerabilities in their support for Connect IQ…
Userland Execution of Binaries Directly from Python
By Vincent Berg TL;DR: If you are familiar with what a userland binary execution tool does and you just want to see the code and/or test it, skip the rest…
nanopb Protobuf Decompiler
by Michael Milvich Here at Anvil we have increasingly run into embedded systems utilizing the nanopb - Protocol Buffers for Embedded Systems project. Nanopb is a small code size Protocol…
Information Security BASICS
by Blair Crossman Introduction This blog post is for the ambitious network administrator who has been promoted to head of information security and wants to demonstrably improve the organization's security…
Silly proof of concept: Anti-phishing using perceptual hashing algorithms
by Diego Freijo Welcome to the first dispatch coming out of the Ministry of Silly Ideas! It’s a space we’ve got inside Anvil where we encourage ourselves to come up…
Early-Career Security Engineer: Anvil Offers a Foundation for Growth
Introduction This blog post is written by Abhijeet Pate, who works as a security engineer at Anvil. The post talks about how he got started with Anvil, his transition from…