Gynvael Coldwind 🐈

security researcher/programmer ⁂ previously security team @ Google ⁂ Dragon Sector CTF founder/player ⁂ technical livestreamer ⁂ slide maker ⁂ he/him

YouTube[EN]: https://www.youtube.com/@GynvaelEN
YouTube[PL]: https://www.youtube.com/@GynvaelColdwind
Blog: https://gynvael.coldwind.pl
Twitter: https://twitter.com/gynvael

Last Notes

2026-03-04 08:10:49 UTC

My second article in Paged Out! #8 was about the architecture of the terminal emulator on Linux - it's a really obvious thing until you start digging into details, as usual.
Web viewer: https://pagedout.institute/webview.php?issue=8&page=43&article=Linux+terminal+emulator+architecture
PDF download: https://pagedout.institute/?page=issues.php
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/169/886/973/247/193/original/23c4bf9792e62024.png

2026-02-16 10:10:56 UTC

Just got this link on my discord - https://www.kickstarter.com/projects/bitman/bootblock-rebels - passing it along because this book looks fun!

2026-01-11 13:22:40 UTC

A useful chart on what type to use for flags in C/C++ depending on your D&D alignment:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/876/674/893/836/728/original/a3ab712248d6a469.png

2025-12-30 07:31:08 UTC

Glitches in games, especially used for speedrunning, are one of the most fun aspects of hacking to watch!
As an example, check out this video "How Speedrunners BEAT Hollow Knight Silksong In 10 Minutes!" by Abyssoft
https://www.youtube.com/watch?v=M6Jnj-y0G9w

2025-12-27 08:49:30 UTC

Ah Saturday morning! What a great time to...
...write a 1-page article for Paged Out! zine!
Deadline is 4th Jan - just a week away.
CFP: https://pagedout.institute/?page=cfp.php

2025-11-30 09:56:01 UTC

You can write '2' (0x32) anywhere in the filesystem of a Linux-based network switch. How do you get root?
That's basically what my talk at GreHack conference was about - enjoy!
https://youtu.be/F4CudbWHZ7Y?t=504 https://youtu.be/X-ZJH4d2tuE?t=1162

2025-11-24 09:20:12 UTC

Call for articles & art is open for Paged Out! magazine issue #8 - https://pagedout.institute/! (check out the zine if you don't know it - it's free)
As usual, we're looking for 1-page technical articles on topics related to programming, cybersecurity, retro-computing, demoscene, reverse-engineering, CTFs (incl. CTF challenge write-ups), file formats, network protocols, artificial intelligence, and so on. We're also happy to publish articles previously published e.g. on blogs, etc (though in 1-page form of course).
Think about writing something - it's just 1 page, so it's pretty fast to create :)
More info:
https://pagedout.institute/?page=cfp.php
https://pagedout.institute/?page=writing.php

2025-07-02 11:58:03 UTC

Imagine the following situation: your company receives a ZIP file with an invoice, and you're the person responsible for checking if all the details are correct, before sending it off to the payment department. You open the archive, and there's a single PDF inside. You view it, and all the details match—your company's details, seller's company's details, items and total amount are what's expected, and even the bank account number is the same as on previous invoices from this company. As everything looks good, you forward the ZIP with the invoice to the payment team, and move onto reviewing other incoming invoices.
A few days later you receive the same invoice again, but you already have it in the system. Just in case you reach out to the payment department whether it's been paid, and they confirm it has—great, no action required.
Another month passes by, and you get a "payment due" reminder. What's this? You remember it being paid already, so what gives. You ask the payment team, they again confirm the invoice was settled. You phone the seller about this, but they say they received nothing. So you head down the hall to the payment department, you open the invoice on your laptop, and start going through the details with them. But what's this? The destination account number and amount in the wire transfer and the invoice don't match! The payment team manager's face gets a bit red—seems like it was their mistake? But no! They show you the invoice, and the amount and account number match the actual payment... but it doesn't match what you see on your screen! How can this be?
Both of you re-download the ZIP archive from the email you've forwarded and open the PDF inside. And there it is—you see two different invoices. What in the world is happening?
Immediately you report it up the chain, and your boss's boss gets a pair of IT forensics consultants on the job. They investigate, and later you learn that your company has been scammed with a pair of different invoices hidden inside a schizophrenic ZIP file. This means that you—on your work laptop running a certain software stack—saw and approved the correct invoice. But the payment team—running a different software stack—saw the fake invoice inside the ZIP, which they thought was what you had approved. Even later on you find out that the seller's company has been partially compromised and a lot of their customers got fake invoices. But that's water under the bridge at that point, and the money your company transferred is long gone.
Technical details → https://hackarcana.com/article/yet-another-zip-trick
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/783/515/421/638/643/original/56b57f4050b3018d.png

2025-03-29 12:09:42 UTC

Paged Out! #6 is out!
https://pagedout.institute/
Totally free, 80 pages, best issue so far!
'nuff said, enjoy!
(please boot to help spread out the news!)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/245/643/681/847/334/original/dfffcccad7558f8f.png

2025-02-04 13:12:37 UTC

There is still a couple more days to submit your 1-page article to Paged Out! #6!
We're at 41 pages of content out of 50 required. We'll start finalizing the issue when we reach 50. Not much time left, but you can still make it! 🙂
Details: https://pagedout.institute/?page=cfp.php
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/945/788/560/712/522/original/c55c8a54408bdf3c.png