iiinova — where your digital self keeps evolving

Amy B

@nyanbox.stackchk.fail

267 followers 287 following 9 posts

aka itszn (itszen) 0xffff000041414141 Security researcher creating pwnable puzzles infosec.exchange/@nyanbox x.com/itszn13 LLM Art: bsky.app/profile/alternet.site

Posts Replies Media

Amy B @nyanbox.stackchk.fail · 12/01/2026

Employing the Rite Of The Smashing Stack: We locate the Stack Address and a few Gadgets from the LIBC Library Then we overwrite the Stack with our terminale Gadget Chain. Returning To System.

Rite Of The Smashing Stack
This Terminale Rite brings about a Change in Control., What was once a path home is now bound by a chain of Gadgets. Each Return advances towards the final System state. If aligned properly a Shell may be summoned.

100

Amy B @nyanbox.stackchk.fail · 12/01/2026

With this Leak in hand I Forged an ArrayBuffer pointing to any Memory Address I knew the Name of. With this we can now manipulate the entire Memory Space at will. This makes the final Rite possible...

A diagram showing how to construct a Forged ArrayBuffer to read and write to any location in memory.

100

Amy B @nyanbox.stackchk.fail · 12/01/2026

Leaking a Memory Address was the most difficult part! Eventually I realized I could read the Uninitialized padding inside heap allocations. Through heap manipulation this value could be a Pointer By overwriting the lowest byte with 00000101 the Pointer would be read as a Float

A diagram showing how heap chunks can have sections of uninitialized padding. Showing how a 41 byte buffer can partially overwrite this padding. A pointer corrupted by this can be confused as a floating point

100

Amy B @nyanbox.stackchk.fail · 12/01/2026

We can place Controlled-Data after the Array, which Splice will read Out-Of-Bounds This gives us the Rite Of The Type Forgery, allowing us to Forge an arbitrary Object if we know a Memory Address (to bypass ASLR)

Rite Of The Type Forgery card.
Through the Wrong perception of a Memory,
Transmutations are achieved. Data which is viewed must
be shaped in accordance to the Type's Structure, lest it shall crash and burn. A successful Forgery may insite Cursed-Workings within the ENgine for a greater purpose.

100

Amy B @nyanbox.stackchk.fail · 12/01/2026

The Fault derives from a "Time-of-Check Time-of-Use" in the Array.splice invocation. Splice checks bounds with the initial array Length (Time Of Check) In a Callback we can shrink the Array's Length. Then Splice uses the Cached Length, ignoring changes (Time Of Use)

A diagram showing how the Array.splice function will ignore changes to the Array Length during a ValueOf callback. This leads to an Out-Of-Bounds access

100

Amy B @nyanbox.stackchk.fail · 12/01/2026

When MicroQuickJS released, I spent 8.5 hours to summon an Exploit for it. Here is the Fault: var arr = new Array(30) var attack = { valueOf: function() { arr.length = 0 arr.length = 3 return 10 } } arr.splice(attack, 30) I document the full Ritual Process below

A modified version of Cultist Simulator showing cards: Micro Quickjs, Fault in the Work, Loophole, Exploit, and Summoned Shell

181