


Mediatek Flash and Repair Utility

Passive wireless OSINT platform that detects and maps Wi-Fi, Bluetooth, CCTV, IoT devices, and cell towers using radio signal intelligence for…

Firmware for converting consumer LoRa radios into KISS TNC modems with serial CLI, BLE packet sniffing, and APRS/AX.25 compatibility for packet radio…

sniff HDMI DDC (I2C) traffic

Exploit and tooling for Amlogic-based Sonos devices: dumps OTP/eFUSE via an EL3 exploit, extracts LUKS decryption keys, and fetches/decrypts OTA…

Reverse Engineering and Observability toolkit for Draytek firewalls


Decrypt encrypted SonicOSX firmware images

EDID (Enhanced Display Identification Data) Fuzzer

CVE-2017-5693 Denial of service vulnerability in Puma 6 modems

Dictionary Brute Force of the Mikrotik RouterOS 6.x Web Interface

Explotation framework for CVE-2019-11687

Framework for controlling QKD devices and managing symmetric keys. See the [project page here](https://qcomms.gitlab.io/cqptoolkit/)

Demonstrate some functionalities of Morion by generating an exploit for CVE-2022-27646 (stack buffer overflow on Netgear R6700v3 routers).

Python script to exploit CVE-2020-35391 on Tenda F3 V3/V4 routers, enabling unauthorized download of configuration, flash, and syslog files.

This project demonstrates the publicly disclosed CVE-2018-9995 vulnerability found in multiple embedded DVR devices.

Watchguard Sysa-dl file format