Margin Research Blog

Margin Research’s Social Cyber project was originally hosted on a graph database (DB) technology called DGraph. In an unfortunate turn of events, DGraph ceased to exist as a company, requiring the Margin Research team to migrate our analysis tool to a different graph DB: Neo4J. This brought the question

By Matthew Filbert

So, you’ve heard about Cannoli, the high-performance tracing engine, but don’t know where to start. Perhaps you read the source code but don’t understand how to implement your analysis. Or maybe you’re someone who learns by example and finds inspiration in detailed walkthroughs. If so, this

By Ian Dupont

By Ian Palleiko

Reuters recently reported on November 16 that Pushwoosh, the maker of a software development kit (SDK), was falsely representing itself as an American company when in fact the technology company is based in Russia. Its code is reportedly used in thousands of Apple and Google app store applications, and the

By Justin Sherman

Description This blog details a C++ heap exploitation challenge written for CSAW CTF Finals 2022. This challenge incorporates an OOB heap write primitive to corrupt heap metadata, creating a use-after-free (UAF) by clobbering the C++ std::shared_ptr struct. The challenge is a x86-64 ELF binary linked against glibc v2.

By Ian Dupont

Through our work on SocialCyber, we map sanctioned Russian cyber actors, their contributions to the linux kernel, and the private-sector firms supporting Russian cyber operations.

By Justin Sherman

The best reverse engineer is also a very capable software developer. Why you may ask? Because almost no one reinvents the wheel.

By Ryan Stortz

The website has gotten a facelift! If you've been to our site before you might notice some changes. The most significant change is in our blog backend, making sharing our great research and new tool releases easier with the internet. Another big shift is consolidating all of our presentation material,

By Sophia d'Antoine

A comprehensive guide to MikroTik internals, including IPC, hand-rolled cryptography, and a novel post-authentication jailbreak

By Ian Dupont

By Harrison Green

Cannoli Cannoli is a high-performance tracing engine for qemu-user. It can record a trace of both PCs executed as well as memory operations. It consists of a small patch to QEMU to expose locations to inject some code directly into the JIT, a shared library which is loaded into QEMU

By Brandon Falk