https://alighaffarian.github.io/A blog focused on embedded Linux and C programming, along with CTF writeups 2026-10-11T16:58:22+03:30 Ali Ghaffarian https://alighaffarian.github.io/ Jekyll © 2026 Ali Ghaffarian /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-10-08T00:00:00+03:30 2026-10-11T16:57:59+03:30 https://alighaffarian.github.io/posts/running-multi-node-iot-protocol-using-qemu/ Ali Ghaffarian

TL;DR: I didn’t have ESP32 boards to test my token passing protocol (silly_proto v1), so I simulated them. QEMU’s -serial option can redirect an emulated ESP32’s UART to a TCP socket, so I wrote a runner that acts as a central TCP proxy. It forwards the master’s output to every slave and the slaves’ output back to the master. The runner also builds and starts the nodes and shows each one in its...

2026-09-26T00:00:00+03:30 2026-09-26T00:00:00+03:30 https://alighaffarian.github.io/posts/c-bit-fields-are-not-portable/ Ali Ghaffarian

TL;DR When needing to parse a non byte aligned data structure, mapping it directly to C bit fields in a packed struct seems like a clever decoding approach. But the C standard lets the implementation to make some decisions on the binary layout, beyond our control. Although directly casting to a bit field described structure works fine on amd64(gcc) and probably little endian machines in genera...

2026-09-13T00:00:00+03:30 2026-09-13T00:00:00+03:30 https://alighaffarian.github.io/posts/do-me-a-favor-when-x-happens/ Ali Ghaffarian

TL;DR While implementing a custom networking protocol for an IoT project, I ran into a decoupling problem: a central event emitter needed to reset timers owned by separate state machines. Hardcoding this logic into the emitter created a tight coupling anti pattern. I solved this by implementing a thread safe, dynamic callback system in C, complete with hook points and self unregistering callbac...

2026-09-12T00:00:00+03:30 2026-09-18T20:20:14+03:30 https://alighaffarian.github.io/posts/pwn-k17-huge-binary-1-writeup/ Ali Ghaffarian

TL;DR This writeup covers the exploitation of huge-binary-1, chaining an arbitrary stack read with a format string vulnerability. I used the stack read to leak __libc_start_main’s return address and calculate the libc base. Then, I used a format string bug to perform a 16-bit chunked GOT overwrite, replacing printf with system, and passed /bin/sh through a second buffer to get a shell. Contex...