Ange

Reverse engineer, file formats expert. Corkami, CPS2Shock, PoC||GTFO, Sha1tered, Magika... Security engineer @ Google. He/him.

Github: https://github.com/angea
Github: https://github.com/corkami
Pronouns: he/him

Public Key

npub1entjyrh7qvs4svxpdfj4x75egn43xllpy9erjfwyavlxqc4d7zysfv83h0

NIP-05 Address

ange_at_mastodon.social@momostr.pink

Profile Code

nprofile1qqsve4ezpmlqxg2cxrqk5e2n02v5f6cn0lsjzu3eyhzwk0nqv2klpzgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds2hhgd9

Publishing to

relay.snort.social

Author Public Key

npub1entjyrh7qvs4svxpdfj4x75egn43xllpy9erjfwyavlxqc4d7zysfv83h0

Show more details

Last Notes

2026-03-26 18:28:03 UTC

An AI told me today that we’re in 2024, for no obvious reason: I had just asked to look for past occurrences of specific events.
I didn’t expect it to hallucinate on such a small and yet obvious fact.
Did you ever encounter such a trivially wrong hallucination?

2025-11-18 07:56:37 UTC

My relative is looking for a 39C3 ticket.
No scammers please ;)

2025-11-07 09:57:59 UTC

Magika 1.0 is released, available in Rust, TypeScript and Python, and supporting more than 200 file types.
Public blog post:
https://opensource.googleblog.com/2025/11/announcing-magika-10-now-faster-smarter.html
Source: https://github.com/google/magika

2025-05-06 11:07:02 UTC

- reply

which version? it used to be 0 - and could even be negative ;)

2025-04-01 16:42:29 UTC

- reply

Then I'll create my own fonts - payback.ttf ;)

2025-04-01 16:30:25 UTC

You’re making a PDF about weird file formats and PDF… and the PDF doesn’t let you write “file”… very meta.
https://files.mastodon.social/media_attachments/files/114/263/647/376/758/246/original/599e57fb2626268c.png

2025-02-20 08:13:46 UTC

I just pushed an update to logparse to detect the near-collision blocks (w/ no difference) of TextColl.
Thanks Marc!
https://github.com/corkami/collisions
https://files.mastodon.social/media_attachments/files/114/035/201/235/818/522/original/1448bb288878d0ba.png

2025-02-20 06:58:06 UTC

The livestream on hashcolls mitigations is up.
Covering the hashcoll tag in VT, specific file format structures, defanging files, Stevens' DetectColl, safe hashes...
https://www.youtube.com/live/1D6C6z_25cE?si=GmDi17uII1xj7rUi&t=33
https://files.mastodon.social/media_attachments/files/114/034/902/941/670/555/original/ec0b3a12485308b7.png

2025-02-18 08:45:46 UTC

The next livestream will be on mitigating hash collisions: preventing them at format design, filtering them out or detecting them.
https://www.youtube.com/live/A7EBbGv1B3U?si=G0zp4eRd0agKSzxY

2025-02-18 08:42:23 UTC

The livestream on multi-hashcolls is up!
Awesome that David joined and commented on his own hashquines!
https://www.youtube.com/live/-asJnf-S2Nk?si=DCACWGTQyFVOmN1a
https://files.mastodon.social/media_attachments/files/114/023/989/550/896/173/original/fd7f8955138e3bd9.jpeg

2025-02-16 09:20:15 UTC

The livestream on crypto-polyglots is up!
https://www.youtube.com/live/RP5PVRUs6L8?si=udjoa6O0MSyq6w9D
https://files.mastodon.social/media_attachments/files/114/012/545/033/967/574/original/4e4c8185da73fa92.png

2025-02-15 16:08:45 UTC

In my next livestream, I’ll hexplore crypto-polyglots:
- files that remain valid after encryption.
- contents that decrypts to different valid content via different keys, with authenticated decryption.
https://www.youtube.com/live/RP5PVRUs6L8?si=cEFkVUC1AeTGri7k

2025-02-09 09:14:05 UTC

In the next livestream tonight, we’ll hexplore more advanced hash collisions tricks.
https://www.youtube.com/live/fCNx2cO0Q98?si=xln4a4n_5BJ9wR5c

2025-01-31 13:44:33 UTC

Coming up this weekend: PE & Mitra!
https://files.mastodon.social/media_attachments/files/113/923/263/743/794/931/original/f0e279a563387897.png

2025-01-30 10:53:21 UTC

Coming up next:
the .EXE file format!
https://files.mastodon.social/media_attachments/files/113/916/920/128/954/085/original/7f20cfe8e3658f55.png

2025-01-22 12:27:59 UTC

What I call file format hexploring:
Read the specs, read parsers, craft pocs by hand if possible, explore the history and the features timeline, understand abuses, analyse at a low level…

2025-01-19 18:40:27 UTC

In ~1h, we’ll explore the awesome and clever DOOM.PDF!
https://www.youtube.com/live/t17joAiWBkE?si=clV3nvyFZ5DjKQ5e

2025-01-18 19:03:14 UTC

In 1h, I’ll do a livestream about JavaScript in PDFs.
A bit about standard JS triggers that is seen in exploits, but also a few simple PDF games.
https://www.youtube.com/live/xZPK04a5ltc?si=_3sz9aEEfDT90-da

2025-01-17 09:26:04 UTC

Tonight, we'll explore the WAD file format, the minimalist and elegant archive file format used in Doom, many FPS games, but also other unrelated softwares!
https://files.mastodon.social/media_attachments/files/113/842/953/247/849/538/original/58bb7fcfd958a8ef.png

2025-01-16 07:49:42 UTC

Currently planned schedule for my next livestreams:
Friday 9 PM CET, the WAD (Doom's) archive.
https://www.youtube.com/live/g0VyFDYefqQ?si=Ta2p1zn0jSDCivhV
Saturday 9PM, JavaScript in PDFs.
Sunday, Doom in PDF!

2025-01-11 06:51:41 UTC

In my latest stream, I walked through the binaries of PoCorGTFO.
Not just pure hex analysis, I also covered a few challenging or fun facts along the way.
https://www.youtube.com/live/POg2Qpxbplk?si=oDBmmd1v9pMiRjMY

2025-01-08 06:16:02 UTC

- reply

wdym?

2025-01-08 05:50:18 UTC

What is your favorite pdf hack (not file-format based):
Change text?
Remove watermark?
Remove ads pictures on documents to print?

2025-01-07 07:09:45 UTC

- reply

Today (at 9 PM CET - my usual time), I will walk through a simple PNG file.
I will also cover some PNG tricks if I have time ;)
See you there!!
https://www.youtube.com/live/Ck5_ADtePzE?si=OJe7FjFQM9TqZq7p

2025-01-07 06:57:05 UTC

I was planning to stream next on walking through PoC||GTFO PDF files, then I realized that I should walk through basic polyglots first, but before I should walk through other simple formats...

2025-01-06 09:46:15 UTC

I will stream tonight (9PM CET) about the basics of PDF file format tricks - the road to funky PDF, polyglots and hash collisions! See you there!
https://www.youtube.com/live/8g6G96nn7Mo?si=0IByzWDDNDtrnPPk

2025-01-05 09:11:00 UTC

Following my live stream yesterday to introduce the basics of the PDF file format, I will stream live in 7 hours on the risks of information leaks in PDF document, based on in-the-wild examples and hand-written PoCs.
The pace was nice and chill - see you there! https://www.youtube.com/live/hncHOnppwl8?si=yfWEeTbiXgoHbp-D

2025-01-04 18:45:42 UTC

The stream will be live soon at https://youtube.com/live/q6KgFezu8tw?feature=share

2025-01-04 10:57:34 UTC

I will stream in 8h about the basics of the PDF format, teaching how to make a basic PDF from scratch.
This is an easy-level introduction to the PDF [portable document format], aimed at all audiences: infosec, but also digipres, DFIR, and others.
This will not cover complex cases, polyglots, abuses or exploit.
That will come next but this stream is the start on the topic.
The stream will be recorded and available publicly.

2025-01-02 18:44:58 UTC

Let’s try something new in 2025…
This saturday at 8pm CET, I'll stream about crafting a valid PDF file from scratch.
We’ll see how it goes!

2024-12-29 09:51:54 UTC

What would be interesting in a book about file formats ? Or streaming myself exploring file formats ?
Just come tell me - I have stickers #38C3.
https://files.mastodon.social/media_attachments/files/113/735/390/238/367/972/original/5c4753b580520ee5.png

2024-12-28 17:19:18 UTC

I presented about file formats at #38C3.
Thanks for the feedback everyone!
https://speakerdeck.com/ange/fearsome-file-formats-18374bc4-b3f2-429f-862e-2177ab4d7aae

2024-11-22 09:00:14 UTC

What's your favorite file format challenge / trick / bug / surprise / work / art ?
Bonus point if it's underrated or obscure!

2024-11-12 07:33:40 UTC

I will present about file formats at the CCC (ten years after 31c3's "Funky file formats").
https://speakerdeck.com/ange/funky-file-formats-31c3

2024-10-24 16:21:21 UTC

I presented about file formats identifiers at HackLu:
https://youtu.be/PBbld8xB2Bo

2024-10-01 10:07:07 UTC

An awesome video of live coding 6502 asm directly in Basic to produce music, with all the explanations on the way.
https://www.youtube.com/watch?v=ly5BhGOt2vE

2024-09-30 08:23:16 UTC

ICYDK Kay 'neoeno' Lack makes nice materials (blogs, posters, videos) about file formats, analysis, crafting...
Ex: https://www.0de5.net/stimuli/a-reintroduction-to-programming/memory/binary-formats-through-bitmap-images
https://files.mastodon.social/media_attachments/files/113/225/495/642/371/844/original/79f16353ec315cd7.png

2024-09-25 15:05:53 UTC

Our paper "Magika: AI-powered content-type detection" is up on Arxiv:
https://arxiv.org/abs/2409.13768

2024-09-18 08:22:01 UTC

- reply

Some even detect a CRC-colliding file if there's no password.
https://files.mastodon.social/media_attachments/files/113/157/571/019/168/588/original/824bea2d4d4e9fa5.png
https://files.mastodon.social/media_attachments/files/113/157/576/859/868/109/original/5d1ad0266a70abf9.png

2024-09-18 06:39:03 UTC

Some tools detect the EICAR file in Zip files by size and CRC so that it even detects it in password-protected zips without having the password.
This can of course lead to accidental or intentional FPs.

2024-09-17 07:15:10 UTC

I've known that format as the .INI format since configuration files of Windows 1.0 in 1985.
Was it used before? Where/when?
[section]
;comments - with no equal sign ;)
key=value
https://files.mastodon.social/media_attachments/files/113/151/635/203/444/165/original/b3917b421c5f1ae1.png

2024-03-19 19:59:10 UTC

Marc Stevens came up with a new kind of MD5 collisions:
alphanum, no space, single byte difference (always +4), and not even 2 blocks!
No more high entropy collision blocks!
md5("TEXTCOLLBYfGiJUETHQ4hAcKSMd5zYpgqf1YRDhkmxHkhPWptrkoyz28wnI9V0aHeAuaKnak")
=
md5("TEXTCOLLBYfGiJUETHQ4hEcKSMd5zYpgqf1YRDhkmxHkhPWptrkoyz28wnI9V0aHeAuaKnak")
Use `echo -n` to test otherwise it outputs a newline char, which will get wrong results.