# Coding

I snapshot Capstone output on a corpus of public functions. A Capstone bump changed formatting and CI went red. Goo…

lenaetwMEMBERstarted 23 Aug 2026, 22:41

Last ReplypassiveTuesday, 03:30

Last bit of the last word. Tests used sizes % 64 != 0 except the one that mattered. Fuzzer found it on a 64-bit bou…

paveldbgMEMBERstarted 19 Jul 2026, 08:20

Last Replyshlddbl20 Aug 2026, 10:59

I stored match offsets in a roaring bitmap. Query time dropped. Memory went up. Worth it for the lab dashboard. If …

wrpkruMEMBERstarted 7 Jan 2026, 08:46

Last Replycrc32isa18 Aug 2026, 05:13

Whitespace in the alphabet. Padding rules. A URL-safe variant in one file. I used a crate after the third bug. The …

echoGUESTstarted 22 Jan 2026, 06:40

Last Replypopftrap16 Aug 2026, 13:25

Needed a one-instruction stub. Go assembler, not Cgo. It was fine. The build tags were not. If you mix Go asm and c…

sgdtMEMBERstarted 15 Aug 2026, 20:28

Last Replyptesmear15 Aug 2026, 22:23

mmap a hostile file, then a truncating writer on another handle. You will have a bad day. I read() into a cap now. …

dirqlMEMBERstarted 3 Sep 2025, 19:38

Last Replyasidroll11 Aug 2026, 06:14

Someone used CRC32 to key a map of modules. Collisions in the lab corpus. I switched to blake3 truncated. Checksums…

freshmodeMEMBERstarted 2 Jul 2026, 17:51

Last Replysmmuevent10 Aug 2026, 18:32

I rewrote a 3k-line C parser in Rust. It was nicer. The C version still ships because the firmware team will not ta…

kirillrrMEMBERstarted 6 Aug 2026, 03:14

Last Replyfsgsbase8 Aug 2026, 02:10

16 bytes per line, ASCII pane, offset. No colors. No plugins. I paste it into tickets. xxd is fine. I wanted one I …

ssbdMEMBERstarted 20 Feb 2026, 07:52

Last Replyshowregs6 Aug 2026, 03:43

libFuzzer, 12 hours, 4 crashes. All my fault. I fixed 3 and documented the 4th as 'do not do that'. If you ship a p…

Lab drop folders get huge by accident. A default cap made a colleague angry and then grateful. Caps are product fea…

dmitrireMEMBERstarted 26 Jul 2026, 06:43

Last Replymethodptr27 Jul 2026, 13:43

Parser written on x86, deployed on ARM64 CI. A u32 field was host-endian by accident. Tests were little-endian-only…

ibrsMEMBERstarted 8 Feb 2026, 05:55

Last Replycancelrtn22 Jul 2026, 09:12

I wanted 'simpler than YAML'. I wrote a grammar. Users wrote YAML in it anyway. I vendored a YAML parser. Do not wr…

yukiuefiMEMBERstarted 13 Jul 2026, 10:21

Last Replyiommu13 Jul 2026, 19:52

Untrusted ZIP from a drop folder. I cap uncompressed size, entry count, and nested ZIPs. Then I still extract to a …

umipMEMBERstarted 4 Feb 2026, 00:34

Last Replylookaside7 Jul 2026, 10:35

It worked. It was slower. The sandboxing was nice. I still run the native one. WASI is not a personality. It is a d…

ninafidMEMBERstarted 19 Jun 2026, 00:23

Last Replyvxlab21 Jun 2026, 19:59

Intern table held pointers into a buffer I freed on reload. Looks like 'random corruption'. Was lifetime. If you in…

eliasetwMEMBERstarted 16 Jun 2026, 09:00

Last Replybhdis17 Jun 2026, 04:10

I needed exports and nothing else. The GUI took 20 seconds to open. The script printed them in 0.1. GUIs are for ex…

--pretty, --color=always in a pipe, --force without a dry-run. I have been burned. Dry-run is default for destructi…

I stored a tag and a payload. A helper trusted the caller on the tag. The caller lied. Fuzzer found it. If the tag …

fola_adeSENIORvendorstarted 18 May 2026, 17:49

Last Replyxtest23 May 2026, 09:45

CSV: bugcheck, image, build, license tag, hash. No full dumps in the zip. Pointers only. People keep asking for the…

colereMEMBERstarted 4 May 2026, 15:13

Last Replyx64dbgbp5 May 2026, 00:15

Config was XML. I converted it to a smaller JSON at ingest and threw the XML away. Life improved. If you can avoid …

nevaMEMBERstarted 14 Apr 2026, 00:19

Last Replytlscb15 Apr 2026, 17:59

Three functions: need(n), take(n), remain(). Every parser bug I still write is because I did not use them. Paste yo…

Last Replyrdtscp15 Apr 2026, 06:07

Reproducible build check as a test. Two dirs, same flags, cmp. It failed because of an embedded __DATE__. I killed …

sibirMEMBERstarted 23 Mar 2026, 11:47

Last Replybtbalias30 Mar 2026, 00:59

Vendor 'JSON' log was NDJSON. My parser expected a list. I read the first 8KB and guessed. Guessed wrong. Sniff the…

molotMEMBERstarted 28 Mar 2026, 09:04

Last Replyshadow_spb29 Mar 2026, 05:02

Optional header checksum. Easy to fix after a patch. I compute it so loaders do not shrug. I do not use it as integ…

Last Replytebself14 Mar 2026, 11:13

dotnet portable PDB in a mixed tree. My old PDB parser shrugged. I added the portable path. Tests against public sa…

Last Replyxend14 Jan 2026, 06:07

A deny_unknown_fields struct and a vendor added a field. We failed closed in a good way, then I had to ship a permi…

Last Replypcodevm25 Dec 2025, 14:39

I needed build-id and nothing else. Full ELF library was overkill. 80 lines, aligned reads, done. If you only need …

syzbotMEMBERstarted 9 Dec 2025, 22:47

Last Replyiamflex20 Dec 2025, 00:32

Version info strings. I treated them as UTF-8 and got mojibake in the lab UI. They are UTF-16LE. Always. I added a …

Last Replyfixup18 Dec 2025, 00:39

Power-of-two buffer, claimed empty/full distinguished by a count, tests used even sizes. Odd size in production los…

rcustallMEMBERstarted 27 Nov 2025, 00:40

Last Replydmitrire28 Nov 2025, 07:53

MSVC-looking flags on clang-cl silently dropped -fsanitize=address until I used the clang-cl form. Paste your worki…

kprobeSENIORvendorstarted 20 Nov 2025, 12:50

Last Replybsrscan22 Nov 2025, 02:28

I implemented unsigned varint off a blog post. The blog post was wrong. The spec was not. Tests against a known-goo…

landlockMEMBERstarted 7 Nov 2025, 19:42

Last Replypopcnt8 Nov 2025, 16:42

It was not protobuf. I wasted a morning on protoc. It was a home-grown TLV with a 16-bit type and a 32-bit length. …

pieelfMEMBERstarted 19 Oct 2025, 12:38

Last Replyspidump20 Oct 2025, 00:22

I used all three this year. Capstone is everywhere. Zydis is nicer on x86. iced is what I reach for in Rust. Pick o…

retpolineMEMBERstarted 13 Oct 2025, 18:25

Last Replyttdpos14 Oct 2025, 20:22

Length field, then alloc, then copy. Saturating add in the patch. Hunt the old immediate. Grep your own trees. The …

xfghashMEMBERstarted 2 Oct 2025, 08:52

Last Replykdserial3 Oct 2025, 18:00

I needed to load a .obj from a lab compiler. COMDATs will end you. If you see IMAGE_COMDAT_SELECT_*, close the edit…

cfgwatchMEMBERstarted 25 Sep 2025, 03:05

Last Replyuefivar27 Sep 2025, 01:35

Hot set vs slow set. One Themida-shaped loop in the hot set and you are done. The fast/slow split is the whole game…

Last Replysleighjit18 Sep 2025, 19:03