All Posts

Arbitrary read/write is not code execution. This post walks the road from read64/write64 to a real native call inside the WebContent sandbox on iOS 26.1: disabling the GC, parking a thread inside dlopen, making dyld's own allocator install our interpose table, the three locks in that path which 26.1 now checks in ways 18.6 did not - and the default-false embedder preference that silently disables the phone-number trigger on stock hardware.

Coming from V8 and landing in JavaScriptCore. Building the addrof/fakeobj/read64/write64 ladder from a single out-of-bounds write, and the JSC-specific walls (the gigacage, butterflies, NaN-boxing) that make the last step harder than it is in V8.

Slides, demo, and code from my PgDay Armenia 2026 talk on debugging Postgres crashes with core dumps and GDB.

A practical guide to getting into V8 and browser exploitation, coming from classic libc-based pwn. Covering the mental model, debug environment, core primitives, and what surprised me along the way.