Linux internals · reverse engineering · vulnerability research

Full-time on Linux internals, reverse engineering and vulnerability research since January 2026. Fourteen of my patches are in the mainline kernel. Also since January: a published CVE, two paid contracts, and an open Wi-Fi firmware I'm writing from the disassembly.

Available for remote contracts. Linux driver development, reverse engineering, vulnerability research. 📍 Vancouver Island, BC, Canada  ·  ✉️ devinwittmayer@gmail.com  ·  🌐 justthetip.ca  ·  ☕ Ko-fi

Six carry a stable tag. Five have shipped in the stable trees, across six branches back to 6.1. The oldest bug in the table dates to 2017.

Most of them share a cause. USB and SDIO adapters, and monitor mode, run through code that was only ever tested on PCIe cards doing ordinary client traffic.

Write and triage collaborator on three of morrownr's repos. Review, tester coordination, and the link between them, linux-wireless and upstream.

• USB-WiFi: adapter reviews, a list of what actually works on Linux, chipset tables and user support. I'm listed as one of its two site maintainers.
• mt76: out-of-tree builds of the mt76 driver for kernels 6.12 through 7.2, so people get current fixes without waiting on a distro. The install scripts handle DKMS and Secure Boot.
• rtw89: the same job for the rtw89 series, writing and testing USB drivers with the aim of getting them upstream.

This USB Wi-Fi family has no mainline support. The vendor's own driver was told upstream to be redesigned from scratch first, and the licence on its firmware is still unresolved. So I'm writing a replacement: my firmware on the chip, the standard Linux stack on the host, no vendor blob.

reverse engineered   boot and init, the USB data path, the transmit and receive
                     rings, firmware load, and the calibration that nulls carrier
                     leakage. From the disassembly, with no source and no datasheet
written and running  the calibration, clean on silicon
still to come        first light. No frame, no carrier, nothing on air yet
on-silicon fires     14, each matching the vendor's own emitting register state
                     byte for byte, every one dark

Automotive keyless entry, 2026. A dozen firmware images for a hardware-security vendor, delivered and in flight. Each delivery is a C reimplementation of that firmware's cryptography and key derivation, checked byte for byte against captured radio traffic or against an emulator.

cores      STM8, ARM Cortex-M0, PIC, HCS12 and HCS12X, V850, R32C, 8051
ciphers    KeeLoq variants, XTEA, AES-128, a DST80-family stream cipher,
           custom block and S-box designs, several PRNGs

The hard part was getting from a stripped flash dump to a function map. Stock tooling gave up on paged flash and the uncommon cores, so I wrote my own function walker, disassembler and emulator.

Linux wireless driver, current. Driver work for a module vendor so their USB part can carry long-range video links. Fixed-rate injection, narrow 5 and 10 MHz channels, and getting the result upstream.

Reported through Bugcrowd and HackerOne. Vendor names are withheld where an embargo or agreement applies.

• First CVE, arbitrary file overwrite as root. CVE-2026-20161 (Cisco ThousandEyes). A monitoring agent running as root followed a symlink out of its own log directory, so a local user with low privileges could overwrite any file on the box. Fixed in 1.234.0.

• Five privilege escalations in one enterprise VPN client. A race to SYSTEM and a forced-authentication escalation on Windows. On Linux, a local socket that ran a caller's commands as root, a path traversal through that same socket, and arbitrary file write as root by symlink.

• Windows logon passwords out of the same product. A shared memory object any user could write held the address its credential provider sends passwords to. Point that at your own listener, decrypt with a key hardcoded in the product, and you have someone else's password.

• Denial of service on a Windows endpoint-protection product. A DNS response carrying a few thousand chained compression pointers makes the network filter recurse until it runs out of stack. The process dies and network-level protection stays down. The vendor reproduced it.

• A certificate authority private key shipped inside firmware. A virtual gateway's published image carries one CA key, generated once and identical in every deployment. Pull it out of the public image, forge a certificate the appliance trusts, sit on the management channel. Reproduced by the triager, then closed by the vendor as not applicable.

• Licence forgery on a network management appliance. The signing key was a 512-bit RSA modulus. Factored it, recovered the private key, forged licences on a live appliance.

• SSRF to cloud credentials. DNS rebinding walked through a cloud networking product's SSRF filter and reached the instance metadata service, which hands out the host's cloud credentials.

• Quarantine bypass and audit log forgery on a Linux endpoint product. A world-writable scanning socket speaking a binary protocol. Reverse engineered it into a quarantine bypass and into a way to write fabricated entries into the cloud console's audit log.

• Two account takeovers at a telecom carrier. One takes over a webmail account with no click, through a hole in the HTML sanitiser. The other resets any customer's password by brute forcing a one-time code that has no rate limit.

Further findings across identity, fintech and IoT.

_{justthetip.ca: the writing, and every machine and radio on the lab bench.}