Corkami

reverse engineering & visual documentations

[Ange @angealbertini]

Hi newcomers!
I've been contributing to Magika since 2023 (it became public in 2024).

Magika is not AI slop: it's useful in its own way, and used in production.
The recent Rust release doesn't change how Magika is fundamentally working.

[Smukx.E @5mukx]

This repository offering in depth dissections of binary file formats, including PE, ELF, Mach-O, and more. An essential resource for reverse engineers and developers to uncover the structure of executables and libraries.

https://t.co/WdPDTGavsr

[Corkami @corkami]

😊

[Ange @angealbertini]

In PagedOut 6, I showed many PDF tricks by dissecting a crazy yet fully working handmade “Hello World” PDF file.

[Ange @angealbertini]

I made in PagedOut 6 an illustration on the basics of the PDF format.

[Ange @angealbertini]

New year resolution #2:
✅ try streaming.

Week #1:
From PDF basics to PoC||GTFO polyglots.

Thanks to everyone for the support!

[Ange @angealbertini]

After the next stream, I'll start redoing my first streams in french! You'll have time to catch up in the meantime. I'll resume english streams afterwards.

Après le prochain direct, je referais mes 7 premiers directs, mais en français cette fois!
Partagez SVP!

[Ange @angealbertini]

Today, I crafted manually tiny polyglot files as easy examples.
In my next stream (tomorrow @ 9PM CET),
I'll walk through some real polyglots:
the releases of PoC||GTFO.
https://t.co/nhtMrCKtn6

[Suraj @PwnFunction]

lately @corkami has been dropping some fire content

[Ange @angealbertini]

My stream about crafting a PDF file from scratch is over.
https://t.co/0sGTZBjtiH
It was pretty chill to take the time to answer questions, thanks again for joining!

[Ange @angealbertini]

Let’s try something new in 2025…
This saturday at 8pm CET, I'll stream about crafting a valid PDF file from scratch.
We’ll see how it goes!

[Ange @angealbertini]

I presented about file formats at #38C3.
Thanks for the feedback everyone!
https://t.co/RaEEFT93BK

[Ange @angealbertini]

The Woff v2 format pushes things further: standard tags are now implicit via an enum, tables-specific transformations are applied to improve compression, and Brotli compression (2013-) is used.

[Ange @angealbertini]

The Woff (Web Open Font Format) is an alternate form of TTF/OTF, in which tables are typically compressed individually w/ Zlib. Besides, the content remains similar and Woff files can be turned back to TTF/OTF.

[Ange @angealbertini]

OTF (OpenType) fonts files are similar to TTF: The version looks like a magic, similar directory / table structure, some tables are shared w/ TTF (OS/2, maxp, cmap...), some are exclusive (CFF ^ glyf, loca).

[Ange @angealbertini]

TTF fonts spaghetti:
- the number of elements in the glyf table is set in the maxp table.
- the relative offsets of the elements in the glyf table are given by the loca table.
- the format of the loca table is specified in the head table.

[Ange @angealbertini]

TTF (and vector fonts in general) are very complex.

A tiny font with a single defined glyph made of a single rectangle... 0x590 (1424) bytes!

They even contain some bytecode!

[Ange @angealbertini]

TTF (TrueType fonts) have no magic, start directly with a directory table pointing to each tagged-tables. The format is uncompressed, many tables start with a version number. Standard software can add their own custom tables (ex: FontForge).

[Ange @angealbertini]

BPG - Better Portable Graphics - was created by Fabrice Bellard (LzExe / FFMpeg / QEmu...) and has a very compact header with variable integers, yet it has a proper magic.

[Ange @angealbertini]

Binary properties list is a serialization format with a PDF-like structure: a magic, a trailer, an xref table, and objects referencing each others.
Which makes it easy to move objects around or overlap them.