Benjamin Ali glitchfox
Vulnerability research & reverse engineering.
I find and responsibly disclose memory-safety bugs in C/C++ parsers of untrusted input — file-format decoders, network-protocol codecs, and archive libraries. Each finding is fuzzed (AFL++ with AddressSanitizer / UndefinedBehaviorSanitizer), root-caused to the underlying defect, and sent to the maintainer with a minimal proof-of-concept and a verified fix under coordinated disclosure — several already merged upstream with credit. Based in Banbury, UK.
I also reverse engineer hardware and embedded firmware: recovering undocumented BLE protocols, display drivers and flash layouts from vendor binaries, and writing replacement firmware for the devices they run on.
Recent advisories
Recent writeups
- Writing firmware for a watch that had none published: reverse engineering the Ollee Watch One 25 Aug 2026
An STM32WB board that turns a Casio F-91W into a smartwatch, with no public documentation. Its own firmware gave up the display map, the character font and two undocumented BLE commands — enough to write a replacement that kept time on my wrist. Then I bricked it with four bytes of vector table.
-
Three memory-safety bugs in libtsm's terminal escape-sequence parser — but the part worth remembering isn't the bugs, it's how a clean-gate target got chosen from a thin pool, and the moment the fork I fuzzed turned out to be the wrong place to send the report.
-
I reported four memory-safety bugs in zchunk privately; the same afternoon an independent contributor opened a public PR fixing one of them — but not its sibling. The part worth remembering is how a narrow fix leaves a matching hole one field over, and why reporting the whole cluster matters.
Focus
- Parsers & decoders of untrusted input — audio, media, file formats
- Reverse engineering & binary analysis
- Root-causing crashes to the defect, then a verified fix