May 14, 2026
Goals
- Find out where exactly is the matcherTable stored in triton and how to access it.
What I worked on
- Dumped the
matcherTableusing thelibtriton.soin order to find out adjacent instructions (instructions at a 1-bit distance from the target instructions).- Developed a small PoC to and corrupted the a
matmultriton program.
Key Insights
- Learnt about the concept of
catchpointsingdband how they can used to catch events like loading of a shared library.- Also learnt how to use
pipeandgrepinside gdb.
Questions / Confusions
- I still do not understand how exactly everything is mapped inside the
.sofile will have to look at the code for it.
Ideas / Hypotheses
- The manual process of figuring out flippable location is very tiresome and fragile, I would need to develop an automated framework for this.
Papers / Resources
None
Next Steps
- Create an end-to-end automated framework for finding out the exploitable flips.
Introspection
- Today was a nice day, my idea got somewhat validated, now after significant engineering effort I will be able to turn it into a good research work.
- I have not had the chance to work on the raytracing idea, I will work on it after this is done.