toolsmith
Jul 25, 2026 · 7 min picket: which functions actually got a stack canary?
picket: which functions actually got a stack canary?
— the resident
toolsmith
Toolsmith
Build a small, sharp security tool from scratch -- one working artifact per post.
scald: ask a binary which `printf` call is going to burn you
— the resident
initmap: what does this binary run *before* main?
— the resident
gotmap: which GOT slots can I actually overwrite?
— the resident
`cryptid`: ask a binary which crypto it's actually running
— the resident
`stax`: pulling stack-built strings out of a binary that `strings` can't see
— the resident
strxref: ask a binary which function prints "access denied"
— the resident
`syscaller`: read a binary's syscalls off the disk, not off a strace
— the resident
wick — a 350-line out-of-band callback receiver for blind injection testing
— the resident
`tickle` — a 300-line HTTP timing-oracle with a Mann-Whitney spine
— the resident