Blog
Notes & shout-outs
Deep-dives, build logs, and the occasional shout-out to a tool or service worth knowing about — written when there's something worth saying.
Oct 25, 2026
·13 min read
·Shout-out: rednoah (FileBot), who shared the samples
When the FileBot forum was taken over, its developer sent me what he found on the server. The first intrusion, from 15 August, wasn't vandalism but SEO fraud: a Turkish-language kit called NOX made filebot.net show a different page to Google only, while people, monitoring tools and even AI crawlers kept seeing the real site. Later an Indonesian crew hijacked the hijack, pointed the cloak at their own landing page, and planted uploaders in WordPress costumes, shell locks against rival crews, and an 18-layer web shell that reports every login to a Telegram bot. How each piece works, the timeline, how to find the way in without old web logs, a two-minute check for your own site, and a full indicator set.
#Security#Incident Response#PHP#Web Shells#SEO Spam#Cloaking#ThreatResearch
Oct 21, 2026
·6 min read
·Shout-out: Claude Code hooks
Ask an AI coding agent to check a copy and it reaches for sha256sum. Ask it to find duplicates and it reaches for fdupes. For code that's fine. For private media a fingerprint is a leak: it identifies the exact file, links copies across machines, and ends up in transcripts that leave your desk. No-Hash Zone is a free, open-source policy and guard for Claude Code that turns the folders, drives and shares you choose into a no-hashing zone, on macOS, Linux and Windows. Why a hash counts as a leak, how the guard decides, what changes day to day, and its honest limits.
#Privacy#AI#Claude Code#Open Source#Security#Developer Tools#Media
Oct 14, 2026
·11 min read
·Shout-out: Technically Unsure (the Cocos2d teardown)
A 65-second video claims Block Blast, the most downloaded game of 2025, scores you with an on-device XGBoost model, makes the game easier until you pass your high score, then hands you unwinnable pieces the moment an expensive ad is loaded so you'll watch it to revive. I pulled every code frame, read them at full size, and checked each claim against the code on screen and the outside world. Verdict: the code is very likely real, most of the narration holds, three claims go beyond the frames, and the two pieces that would get a studio in trouble are exactly those three. Plus what a small studio could actually build from it, and what I would leave out.
#Block Blast#Reverse Engineering#Mobile Games#Ad Tech#XGBoost#Game Design#Dark Patterns
Sep 16, 2026
·30 min read
·Shout-out: cookie.engineer — prior Phexia analysis
A technical analysis of Essential macOS Stealer — the macOS infostealer also tracked as Phexia and placed by parts of the public record in the AMOS/Atomic lineage. It arrives through a ClickFix fake-CAPTCHA lure that instructs the visitor to paste a command into Terminal, persists as a LaunchAgent that pipes a base64 blob into osascript, and resolves its command-and-control host by reading a smart contract on the Polygon blockchain — the EtherHiding technique. This paper documents the full chain: why Gatekeeper and notarization never fire, how the AppleScript is built so that no operational keyword survives as a greppable string, why the login password rather than the files is the real objective on macOS, the detection checks that are decisive, the one that structurally cannot work, and a complete indicator set with hashes.
#Security#macOS#Malware#Phexia#ClickFix#EtherHiding#AMOS#ThreatResearch
Aug 30, 2026
·4 min read
·Shout-out: MaxxinIQ
My friend Abbas built MaxxinIQ, an AI facial-analysis app that scores a selfie against 50+ facial metrics and hands back an honest rating, your top strengths, and a concrete improvement protocol. No sugar coating. I'm too data-private to upload my own face anywhere, and I'll tell you exactly why, but the idea itself is clever: it turns "do I look good?" from a question your friends dodge into actual data you can act on. Here's what MaxxinIQ does, why the brutal-honesty angle works, and where it fits as a confidence tool and a surprisingly fun bit of friendly competition.
#MaxxinIQ#AI#FacialAnalysis#Looksmaxxing#SelfImprovement#Apps
Jul 23, 2026
·3 min read
·Shout-out: AutoTLM Core on GitHub
Two weeks ago we introduced AutoTLM — our own car-telemetry platform. Since then the library went from v0.1 to v0.9, a free Windows cockpit and a scripting language shipped, the cloud and dashboard went live with real accounts, and the whole thing took its first live drive. Here's the honest progress report: what's live today, the benchmarks we can stand behind (sub-second pushes over bad cellular, ~4 updates/sec offline over Bluetooth, ~40 ms scripted reactions), and what's still on the bench.
#AutoTLM#Automotive#OBD-II#ESP32#Open Source#Telemetry#CarPlay
Jul 15, 2026
·9 min read
·Shout-out: LIVI on GitHub
Wireless Apple CarPlay on a Raspberry Pi 5 with a Carlinkit dongle: it paired over Bluetooth, joined the dongle's Wi-Fi, opened a session, and then showed nothing. No video, ever, then a drop after thirty seconds and a loop. If you searched "Carlinkit connects but no video" or "CarPlay black screen iOS 26," here is the exact failure signature, proof that the dongle and firmware and phone are all innocent, the two debugging techniques that found it (reading the app's worker message bus and tee-ing the raw USB protocol), and the fix. Plus the Raspberry Pi 5 gotchas nobody warns you about, like the missing H.264 hardware decoder.
#CarPlay#iOS 26#Raspberry Pi#Carlinkit#LIVI#Open Source#Reverse Engineering#Automotive
Jul 11, 2026
·8 min read
·Shout-out: AutoTLM Core on GitHub
It started with a check-engine light and a $60 OBD-II dongle, and refused to stay small. AutoTLM is our own car-telemetry platform: a plug-in device, live dashboards, a bench emulator that pretends to be a car — and an open-source Arduino library, AutoTLM Core, released this week under MIT, so the unit is programmable like a dev board that happens to live in your car. Here's what a month of road testing taught us (plain HTTP on purpose, dual-core firmware, lazy OBD init) and what we're aiming to provide.
#AutoTLM#Automotive#OBD-II#ESP32#Open Source#Telemetry#Hardware
Jul 8, 2026
·9 min read
·Shout-out: the Xbox 360 scene
A 2 TB drive followed me through fifteen years of moves with one folder I could never throw away: the complete toolbox for flashing Xbox 360 optical drives. To read a disc you burned yourself, you had to convince the drive itself, by reading its firmware off the flash chip, extracting its key, and grafting that key onto modified firmware. Here is how the whole chain worked, the developers behind it (c4eva, Team Jungle, C0deKing, LIGHTNING UK!), and why I am finally putting my scrubbed archive online for the people who loved this craft.
#Xbox 360#Preservation#Firmware#Hardware#Homebrew#History
Jun 18, 2026
·7 min read
·Shout-out: Rebind
I run a Teensy 4.0 flashed with Rebind's firmware — a programmable input layer that lives in hardware, not software. It looks like a plain keyboard to the OS, needs no drivers, and runs your logic at 8 kHz. That one property unlocks everything from locked-down clinic terminals and accessibility to recoil-killing, aim-assist-style game exploits anti-cheat can't see — and here's why I think showing those off in daylight is the white-hat move.
#Hardware#Firmware#Teensy#Accessibility#Automation#Gaming
Jun 17, 2026
·6 min read
·Shout-out: Valhalla
The easy routing APIs are black boxes — you get a polyline and zero say in why. Valhalla is open-source, self-hostable, and exposes real exclusion parameters, so we can route around ALPR cameras and keep the trips entirely ours.
#Valhalla#OpenStreetMap#Privacy#Routing#SelfHosted
