diff --git a/design_layout/article-tiling-firmware.html b/design_layout/article-tiling-firmware.html new file mode 100644 index 0000000..168071f --- /dev/null +++ b/design_layout/article-tiling-firmware.html @@ -0,0 +1,1003 @@ + + + + + + Reverse Engineering IoT Firmware: SPI Flash Extraction | River Rooks + + + + +
+ + +
+
+ + RIVER ROOKS // ARTICLE VIEWER +
+ +
+ + +
+ + + + + +
+ + +
+
+ ~/notes/ + > + iot-firmware-spi-extraction.md +
+ +

Reverse Engineering IoT Firmware: SPI Flash Extraction

+ +
+
+ 2026-07-20 +
+ • +
+ 8 MIN READ +
+ • +
+ AUTHOR: RIVER ROOKS +
+ • +
+ [#firmware] + [#hardware] + [#security] + [#bus-pirate] +
+
+
+ + +
+ + +

1.0 Executive Summary

+

+ In security audits of embedded systems, retrieving the firmware image is the critical foundational step. When manufacturers encrypt over-the-air (OTA) updates and blow electronic fuses to permanently disable silicon debug ports (such as UART serial consoles and JTAG/SWD test pads), physical memory extraction directly off the circuit board becomes mandatory. +

+

+ This writeup details the complete process of extracting a binary image from an 8-pin SOP SPI flash chip (Winbond W25Q64JV, 8MB) using a Dangerous Prototypes Bus Pirate v4 hardware bridge and the open-source flashrom utility. +

+ + +
+
[!NOTE] Target Board Isolation
+

+ Always de-solder the SPI flash chip or clamp using an SOP8 test clip with the host microcontroller's reset line (/RESET) driven low to prevent the main SoC from contending on the SPI bus. +

+
+ + +

2.0 Hardware Pinout & Bus Pirate Setup

+

+ The target is an 8-pin Small Outline Package (SOP-8). Pin 1 is easily identified by the circular depression in the epoxy mold. Connect the Bus Pirate flying leads directly according to the standard SPI protocol mapping: +

+ +

2.1 SOP8 Pinout Matrix

+ + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
SOP8 Pin #Signal NameBus Pirate LeadElectrical Purpose
1/CSCS (White)Chip Select (Active Low)
2DO (MISO)MISO (Black)Serial Data Output from Flash
3/WP+3.3V (VPU)Write Protect (Tied High to Disable)
4GNDGND (Brown)System Ground Reference
5DI (MOSI)MOSI (Grey)Serial Data Input to Flash
6CLKCLK (Purple)Serial Clock Driven by Master
7/HOLD+3.3V (VPU)Hold / Suspend Input (Tied High)
8VCC+3.3V (Red)Supply Voltage (Nominal 3.3V DC)
+
+ +
+
[!WARNING] Electrical Voltage Rating
+

+ Verify whether your target chip is a 3.3V part (e.g., W25Q64FV) or a 1.8V part (e.g., W25Q64FW). Supplying 3.3V logic to a 1.8V chip will permanently destroy the silicon junction gates. +

+
+ + +

3.0 SPI Extraction via flashrom

+

+ Plug the Bus Pirate into your analysis workstation via USB. It registers as /dev/ttyUSB0. Query the chip ID register using the 0x9F JEDEC Read ID command: +

+ + +
+
+
+ extract_firmware.sh + POSIX sh +
+ +
+ 
#!/bin/sh
+# Query the SPI flash details using flashrom via Bus Pirate
+flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -r firmware_dump1.bin
+
+# Repeat extraction to create a secondary dump for comparison
+flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -r firmware_dump2.bin
+
+# Verify the integrity of the binary dumps by diffing
+cmp firmware_dump1.bin firmware_dump2.bin
+if [ $? -eq 0 ]; then
+  echo "[+] SPI Dumps match identically! Proceeding to hashing..."
+  md5sum firmware_dump1.bin
+  sha256sum firmware_dump1.bin
+else
+  echo "[-] Bit flip or voltage sag detected! Re-run extraction." >&2
+  exit 1
+fi
+
+ +

+ Press Ctrl + C if the bus fails to synchronize. Once complete, inspect the initial bytes with xxd or hexdump: +

+ +
+
+
+ stdout: hexdump inspection + Hex View +
+ +
+ 
0000000: 2705 1956 7062 8251 60a4 2130 0041 5262  '..Vpb.Q`.!0.ARb
+0000010: 6873 7173 0000 0004 0000 0000 0000 1000  hsqs............
+0000020: 0002 0001 0000 0000 636f 6e66 6967 2e64  ........config.d
+
+ +

+ Notice the magic bytes 6873 7173 (ASCII representation: hsqs) at offset 0x000010. This confirms the presence of a SquashFS compressed root filesystem! +

+ + +

4.0 Binary Verification & Hashes

+

+ Before proceeding with automated deconstruction using binwalk -Me, record cryptographic hashes in your lab notebook: +

+ +
    +
  • Dump Size: 8,388,608 bytes (8192 KiB)
    • +
  • MD5: d41d8cd98f00b204e9800998ecf8427e
    • +
  • SHA-256: a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e
    • +
+ + +

5.0 Audit Checklist

+

+ Ensure all forensics hygiene steps have been recorded: +

+ +
    +
  • + ✓ + Visual optical inspection and pinout diagram documented +
    • +
  • + ✓ + Clean dual flashrom dumps matching via bitwise cmp +
    • +
  • + ✓ + SquashFS magic header identified at offset 0x10 +
    • +
  • + • + Filesystem extraction and hardcoded credentials analysis (Part 2) +
    • +
+ +
+ +
+ +
+ + + + +
+ + + + + diff --git a/design_layout/blog-tiling-lead.html b/design_layout/blog-tiling-lead.html new file mode 100644 index 0000000..3bc4873 --- /dev/null +++ b/design_layout/blog-tiling-lead.html @@ -0,0 +1,780 @@ + + + + + + River Rooks | Blog Lander (Tiling Hero & Feed) + + + + +
+ + +
+
+ + RIVER ROOKS // BLOG & RESEARCH ARCHIVE +
+ +
+ + +
+
TECHNICAL PUBLICATION REPOSITORY • ~/NOTES/INDEX.MD
+

Engineering Notes, CTF Write-Ups & Systems Architecture

+ +

+ Documenting bare-metal systems, embedded hardware audits, and network isolation architectures. Writing zero-allocation POSIX scripts, reverse engineering production microcontrollers, and analyzing memory allocator exploitation primitives. +

+ +
+ TOPIC FILTER: + + + + + +
+
+ + +
+ + +
+
+
+ // PINNED RESEARCH WRITE-UP +
+ SPI FLASH • 8 MIN READ +
+ +
+
+ [FEATURED DEEP DIVE] + 2026-07-20 • ~/notes/iot-firmware-spi-extraction.md +
+ +

+ Reverse Engineering IoT Firmware: SPI Flash Extraction +

+ +

+ In security audits of embedded systems, retrieving firmware is the critical first step. When over-the-air updates are encrypted and debug ports (UART, JTAG) are disabled in production silicon, dumping physical SPI Flash memory becomes necessary. This writeup covers extracting firmware from an 8-pin SOP SPI flash chip using a Bus Pirate and flashrom to bypass bootloader lockdowns. +

+ + +
+
+ extract_firmware.sh + POSIX sh +
+
+ 
# Query the SPI flash details using flashrom via Bus Pirate
+flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -r firmware_dump.bin
+
+# Verify the integrity of the binary dump by comparing hashes
+if [ $? -eq 0 ]; then
+  echo "Dump successful. Running md5sum..."
+  md5sum firmware_dump.bin
+fi
+
+
+ +
+
+ [#firmware] [#hardware] [#security] [#bus-pirate] +
+ READ FULL WRITEUP → +
+
+
+ + +
+ + +
+
+
+ // ARCHIVE TELEMETRY +
+ STATIC HTML +
+ +
+
+ TOTAL ARTICLES: + 5 PUBLISHED +
+
+ TOTAL READING TIME: + 51 MINUTES +
+
+ ACTIVE TOPICS: + 7 CATEGORIES +
+
+ FORMAT COMPLIANCE: + IEEE STD 1003.1 +
+
+
+ + +
+
+
+ // RESEARCH TRACKS +
+ CURATED +
+ +
+ +
> Embedded & Hardware Forensics
+
Flash memory dumping, bus tapping, silicon pinout discovery.
+ + +
> Network Routing & Homelab
+
Traefik reverse proxying, WireGuard full-mesh, VLAN firewalls.
+ + +
> Low-Level Memory Exploitation
+
glibc tcache safe-linking, heap corruption, House of Apple.
+ +
+
+ +
+ +
+ + +
+
+
+ // CHRONOLOGICAL DISPATCHES FEED +
+ ALL ARTICLES ORDERED BY DATE +
+ +
+ + +
+
+ + ~/notes/ha-traefik-docker.md +
+

+ > Building a High-Availability Traefik Router with Docker Compose +

+

+ Architecting automated TLS wildcard certificate propagation, Docker provider label routing, zero-downtime container updates, and backend health-check failover routes on bare-metal infrastructure. +

+
+
+ [#homelab] + [#docker-traefik] + [#networking] +
+ Read Entry → +
+
+ + +
+
+ + ~/notes/posix-sh-vs-bash.md +
+

+ > POSIX sh vs. Bash: Portability in Modern Scripts +

+

+ Analyzing edge-case incompatibilities, syntax overhead, eliminating bashisms, and writing fast, bulletproof bootstrapping scripts for Alpine and embedded targets conforming to IEEE Std 1003.1. +

+
+
+ [#posix-sh] + [#shell] + [#unix] +
+ Read Entry → +
+
+ + +
+
+ + ~/notes/ctf-heap-glibc-2-35.md +
+

+ > CTF Write-up: Heap Exploitation in glibc 2.35 +

+

+ Deconstructing modern glibc memory allocator defenses: tcache safe-linking pointer mangling, bypass primitives, and House of Apple file structure hijacking for arbitrary code execution. +

+
+
+ [#ctf] + [#binary-exploitation] + [#security] +
+ Read Entry → +
+
+ + +
+
+ + ~/notes/zero-trust-wireguard-opnsense.md +
+

+ > Zero-Trust Network Isolation with WireGuard & OPNsense VLANs +

+

+ Designing strict zone-based firewall rules across isolated VLANs (Management, Server DMZ, IoT, Trusted Clients) with point-to-point WireGuard cryptographic routing. +

+
+
+ [#networking] + [#wireguard] + [#security] +
+ Read Entry → +
+
+ +
+
+ + + + +
+ + + + + diff --git a/design_layout/design-specification.md b/design_layout/design-specification.md new file mode 100644 index 0000000..078ff06 --- /dev/null +++ b/design_layout/design-specification.md @@ -0,0 +1,81 @@ +# Project Brief: Technical Web Architecture & Blog + +**Project Type:** Personal Blog & Technical Documentation Site +**Design Philosophy:** High-signal, low-noise. Developer-centric minimalism. +**Vibe/Comparisons:** Zed Editor, Ghostty, Noctalia.dev. +**Strictly Avoid:** Raycast, Astro, Vercel-style "SaaS" aesthetics. + +## 1. Executive Summary +This project requires a web interface that feels like a native development environment or terminal emulator, not a marketing page. The design must prioritize raw performance, keyboard navigability, and information density. It should evoke the craftsmanship of tiling window managers and modal text editors. + +The content will heavily feature deep technical writing, including CTF write-ups, network routing diagrams, Docker/Traefik architectures, and raw code snippets (Lua, POSIX `sh`, and Python). The design must accommodate high-density information without visual clutter. + +--- + +## 2. Global Rules & Anti-Patterns + +To achieve the correct aesthetic, the designer must adhere to strict constraints. + +> **The "Do Not Use" List** +> * **NO Glassmorphism:** Zero use of `backdrop-filter: blur()`, frosted glass, or translucent overlays. +> * **NO Glows or Drop Shadows:** Elements should not float, glow, or cast shadows. Depth is created through crisp 1px borders and distinct surface colors. +> * **NO Gradients:** Avoid sweeping linear or radial gradients. Stick to solid colors. +> * **NO Spring Animations:** Avoid floaty, delayed transitions. +> * **NO Rounded Blobs:** Keep border-radii minimal (0px to 4px max). Sharp corners are preferred. + +--- + +## 3. Typography System + +The typographical hierarchy is a hybrid system utilizing monospace fonts for structural elements and a clean sans-serif for long-form reading. + +| Usage | Font Family Preference | Weight | Role | +| :--- | :--- | :--- | :--- | +| **Structural / UI** | IBM Plex Mono, JetBrains Mono | Regular (400), Medium (500) | Navigation links, metadata, dates, tags, timestamps, buttons. | +| **Code Blocks** | JetBrains Mono, Fira Code | Regular (400) | Inline code snippets, terminal command blocks, scripts. | +| **Body Prose** | Inter, Geist Sans, Roboto | Regular (400) | Standard article paragraphs, lists. | +| **Headings (H1-H3)**| IBM Plex Mono (or Sans variant) | Bold (700) | Article titles, section headers. | + +**Typographical Constraints:** +* **Line Height:** `1.6` to `1.7` for prose. +* **Max Width:** Cap article text at `65ch` (characters) for optimal readability. + +--- + +## 4. Color Palette (Dark Mode Native) + +The site does not need a light mode. It should be built as a dark-mode native experience using a muted, low-saturation charcoal palette, mimicking a modern terminal or IDE. + +* **Base Canvas (`#121417` or `#0d0f12`):** A deep slate/charcoal. Not pure black (`#000000`), which causes eye strain. +* **Surface / Card (`#1c1f26`):** Slightly lighter than the canvas for article blocks or terminal windows. +* **Borders & Dividers (`#2b303b`):** Subtle, low-contrast 1px solid lines used to define grids and separate content. +* **Primary Text (`#e0e6f0`):** Off-white/light ash for prose. +* **Muted Text (`#8a95a5`):** For timestamps, metadata, and non-essential UI text. +* **Accent Color (Designer's Choice):** One single, vibrant terminal color (e.g., ANSI Green, Amber, or Cyan) used sparingly for active states, link hovers, or terminal prompts (like `>`). + +--- + +## 5. Layout & Component Architecture + +The layout should be heavily grid-based, feeling structural and deliberate. + +### Core Components Needed +1. **Terminal-Style Code Blocks:** Must support syntax highlighting. Should include a simple header (e.g., showing the filename like `config.lua` or `docker-compose.yml`) with a 1px border. +2. **Metadata Tags:** Small, monospaced inline blocks for categorizing posts (e.g., `[#homelab]`, `[#ctf]`, `[#hyprland]`). +3. **Keyboard Shortcut Hints:** Visual styling for `` elements, rendering as crisp, bordered boxes (e.g., `Ctrl` + `K`). +4. **Index/Archive List:** A dense, tabular list for older posts, prioritized by date, title, and tags, rather than large image thumbnails. + +### Spacing & Grid +* Use a rigid 4pt or 8pt baseline grid. +* Padding inside code blocks and cards should be dense but mathematically consistent. +* Full-bleed horizontal dividers (`
`) should be used to separate major sections instead of large margins. + +--- + +## 6. Interaction & Motion + +Interactivity should mirror command-line interfaces: fast, binary, and unembellished. + +* **Hover States:** Immediate state changes. Instead of fading a button's background over `300ms`, snap the background color instantly or invert the text/background colors. +* **Focus States:** Explicit, high-visibility 1px or 2px solid outlines (using the accent color) when navigating via the `Tab` key. Accessibility and keyboard navigation are paramount. +* **Active Elements:** Use structural indicators (like a `>` prepended to an active navigation link, or a solid left-border block) rather than changing font sizes or scaling elements up. diff --git a/design_layout/service-gateway-tiling.html b/design_layout/service-gateway-tiling.html new file mode 100644 index 0000000..3a856c2 --- /dev/null +++ b/design_layout/service-gateway-tiling.html @@ -0,0 +1,592 @@ + + + + + + River Rooks | Homelab Gateway (Tiling Workspace) + + + + +
+ + +
+
+ + RIVER ROOKS // NODE GATEWAY +
+ +
+ + +
+
SYSTEM DECLARATION • RACK-01 NODE GATEWAY
+

Engineering Sovereign Infrastructure & Technical Notes

+ +
+

+ I am River Rooks, a cybersecurity engineering student at the University of Alabama. My work centers on network forensics, self-hosted system architecture, low-level firmware exploitation, and zero-allocation Unix utilities. +

+

+ This website functions as the unified frontend for my physical homelab cluster. Rather than hosting projects on opaque third-party clouds, everything here runs on bare metal in my personal server rack—orchestrated through Proxmox VE, partitioned across isolated VLANs via OPNsense, and protected by point-to-point WireGuard cryptographic meshes. +

+

+ Navigation Guide: If you are here to read technical research, the Engineering Blog is linked below with deep write-ups on firmware dumping, heap exploitation, and container routing. If you are here to use tools, the Public Services provide locally hosted instances of CyberChef, Stirling PDF, and Git. +

+
+ +
+ PRIMARY DESTINATIONS: + [1] Technical Blog (5 Articles) • + [2] Forgejo Git Repos • + [3] Public Cryptographic & PDF Tools • + [4] Cluster Telemetry +
+
+ + +
+ + +
+ + +
+
+
+ // PRIMARY SERVICE: THE TECHNICAL BLOG +
+ ~/notes/ • 5 ARTICLES +
+ +
+
+ [CORE PUBLICATION SERVICE] + 2026-07-20 LAST SYNC +
+ + > River Rooks Technical Notes & Research +

+ In-depth security post-mortems, CTF write-ups, shell portability benchmarks, and bare-metal homelab architecture guides. +

+ +
+ + 1. Reverse Engineering IoT Firmware (SPI Flash) + [8 min] → + + + 2. High-Availability Traefik with Docker Compose + [12 min] → + + + 3. POSIX sh vs. Bash: Portability in Modern Scripts + [6 min] → + + + 4. CTF Write-up: Heap Exploitation in glibc 2.35 + [15 min] → + +
+
+
+ +
+ + +
+ + +
+
+
+ // HOMELAB SERVICES ROUTER +
+ 4 PUBLIC TOOLS +
+ +
+ + +
+
Forgejo Git
+
git.rooks.dev:2222
+
+

Self-hosted code repositories & dotfiles.

+ + + +
+
CyberChef
+
chef.rooks.dev:443
+
+

Hex decoding, cryptography & forensics.

+ + + +
+
Stirling PDF
+
pdf.rooks.dev:443
+
+

Private document OCR and manipulation.

+ + + +
+
Uptime Kuma
+
status.rooks.dev:3001
+
+

Live synthetic latency & uptime telemetry.

+ + +
+
+ + +
+
+
+ // HARDWARE NODES (RACK-01) +
+ 10GbE SFP+ +
+ +
+
+
+ gw-node01.lan + OPNsense 24.7 +
+ CPU: 18% | RAM: 32% +
+ +
+
+ pve-node02.lan + Proxmox VE (AMD 5900X) +
+ CPU: 42% | RAM: 68% +
+ +
+
+ nas-node03.lan + TrueNAS (48TB RaidZ2) +
+ CPU: 14% | RAM: 82% +
+
+
+ +
+ +
+ + + + +
+ + + diff --git a/samples/article-tiling-firmware.html b/samples/article-tiling-firmware.html new file mode 100644 index 0000000..168071f --- /dev/null +++ b/samples/article-tiling-firmware.html @@ -0,0 +1,1003 @@ + + + + + + Reverse Engineering IoT Firmware: SPI Flash Extraction | River Rooks + + + + +
+ + +
+
+ + RIVER ROOKS // ARTICLE VIEWER +
+ +
+ + +
+ + + + + +
+ + +
+
+ ~/notes/ + > + iot-firmware-spi-extraction.md +
+ +

Reverse Engineering IoT Firmware: SPI Flash Extraction

+ +
+
+ 2026-07-20 +
+ • +
+ 8 MIN READ +
+ • +
+ AUTHOR: RIVER ROOKS +
+ • +
+ [#firmware] + [#hardware] + [#security] + [#bus-pirate] +
+
+
+ + +
+ + +

1.0 Executive Summary

+

+ In security audits of embedded systems, retrieving the firmware image is the critical foundational step. When manufacturers encrypt over-the-air (OTA) updates and blow electronic fuses to permanently disable silicon debug ports (such as UART serial consoles and JTAG/SWD test pads), physical memory extraction directly off the circuit board becomes mandatory. +

+

+ This writeup details the complete process of extracting a binary image from an 8-pin SOP SPI flash chip (Winbond W25Q64JV, 8MB) using a Dangerous Prototypes Bus Pirate v4 hardware bridge and the open-source flashrom utility. +

+ + +
+
[!NOTE] Target Board Isolation
+

+ Always de-solder the SPI flash chip or clamp using an SOP8 test clip with the host microcontroller's reset line (/RESET) driven low to prevent the main SoC from contending on the SPI bus. +

+
+ + +

2.0 Hardware Pinout & Bus Pirate Setup

+

+ The target is an 8-pin Small Outline Package (SOP-8). Pin 1 is easily identified by the circular depression in the epoxy mold. Connect the Bus Pirate flying leads directly according to the standard SPI protocol mapping: +

+ +

2.1 SOP8 Pinout Matrix

+ + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
SOP8 Pin #Signal NameBus Pirate LeadElectrical Purpose
1/CSCS (White)Chip Select (Active Low)
2DO (MISO)MISO (Black)Serial Data Output from Flash
3/WP+3.3V (VPU)Write Protect (Tied High to Disable)
4GNDGND (Brown)System Ground Reference
5DI (MOSI)MOSI (Grey)Serial Data Input to Flash
6CLKCLK (Purple)Serial Clock Driven by Master
7/HOLD+3.3V (VPU)Hold / Suspend Input (Tied High)
8VCC+3.3V (Red)Supply Voltage (Nominal 3.3V DC)
+
+ +
+
[!WARNING] Electrical Voltage Rating
+

+ Verify whether your target chip is a 3.3V part (e.g., W25Q64FV) or a 1.8V part (e.g., W25Q64FW). Supplying 3.3V logic to a 1.8V chip will permanently destroy the silicon junction gates. +

+
+ + +

3.0 SPI Extraction via flashrom

+

+ Plug the Bus Pirate into your analysis workstation via USB. It registers as /dev/ttyUSB0. Query the chip ID register using the 0x9F JEDEC Read ID command: +

+ + +
+
+
+ extract_firmware.sh + POSIX sh +
+ +
+ 
#!/bin/sh
+# Query the SPI flash details using flashrom via Bus Pirate
+flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -r firmware_dump1.bin
+
+# Repeat extraction to create a secondary dump for comparison
+flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -r firmware_dump2.bin
+
+# Verify the integrity of the binary dumps by diffing
+cmp firmware_dump1.bin firmware_dump2.bin
+if [ $? -eq 0 ]; then
+  echo "[+] SPI Dumps match identically! Proceeding to hashing..."
+  md5sum firmware_dump1.bin
+  sha256sum firmware_dump1.bin
+else
+  echo "[-] Bit flip or voltage sag detected! Re-run extraction." >&2
+  exit 1
+fi
+
+ +

+ Press Ctrl + C if the bus fails to synchronize. Once complete, inspect the initial bytes with xxd or hexdump: +

+ +
+
+
+ stdout: hexdump inspection + Hex View +
+ +
+ 
0000000: 2705 1956 7062 8251 60a4 2130 0041 5262  '..Vpb.Q`.!0.ARb
+0000010: 6873 7173 0000 0004 0000 0000 0000 1000  hsqs............
+0000020: 0002 0001 0000 0000 636f 6e66 6967 2e64  ........config.d
+
+ +

+ Notice the magic bytes 6873 7173 (ASCII representation: hsqs) at offset 0x000010. This confirms the presence of a SquashFS compressed root filesystem! +

+ + +

4.0 Binary Verification & Hashes

+

+ Before proceeding with automated deconstruction using binwalk -Me, record cryptographic hashes in your lab notebook: +

+ +
    +
  • Dump Size: 8,388,608 bytes (8192 KiB)
    • +
  • MD5: d41d8cd98f00b204e9800998ecf8427e
    • +
  • SHA-256: a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e
    • +
+ + +

5.0 Audit Checklist

+

+ Ensure all forensics hygiene steps have been recorded: +

+ +
    +
  • + ✓ + Visual optical inspection and pinout diagram documented +
    • +
  • + ✓ + Clean dual flashrom dumps matching via bitwise cmp +
    • +
  • + ✓ + SquashFS magic header identified at offset 0x10 +
    • +
  • + • + Filesystem extraction and hardcoded credentials analysis (Part 2) +
    • +
+ +
+ +
+ +
+ + + + +
+ + + + + diff --git a/samples/article-tiling-heap.html b/samples/article-tiling-heap.html new file mode 100644 index 0000000..945549a --- /dev/null +++ b/samples/article-tiling-heap.html @@ -0,0 +1,889 @@ + + + + + + CTF Write-up: Heap Exploitation in glibc 2.35 | River Rooks + + + + +
+ + +
+
+ + RIVER ROOKS // CTF EXPLOITATION ARCHIVE +
+ +
+ + +
+ + + + + +
+ + +
+
+ ~/notes/ + > + ctf-heap-glibc-2-35.md +
+ +

CTF Write-up: Heap Exploitation in glibc 2.35

+ +
+
2026-06-28
+ • +
15 MIN READ
+ • +
AUTHOR: RIVER ROOKS
+ • +
+ [#ctf] + [#binary-exploitation] + [#security] + [#glibc] +
+
+
+ + +
+ +

1.0 Challenge Synopsis

+

+ During the DEFCON qualifier challenges, our team encountered a hardened 64-bit Linux binary linked against glibc 2.35. Standard legacy heap exploitation techniques—such as poisoning __malloc_hook or __free_hook—are rendered obsolete because upstream glibc maintainers removed all allocation hook pointer symbols entirely in version 2.34. +

+

+ This write-up covers breaking modern tcache safe-linking pointer mangling and redirecting execution control flow using the House of Apple 2 technique against the wide character vtable pointers inside _IO_FILE structures. +

+ +

2.0 Safe-Linking Pointer Mangling

+

+ Introduced in glibc 2.32, safe-linking protects single-linked singly linked list pointers (such as entries inside the Thread Local Cache tcache and fastbins) against off-by-one overwrites and UAF corruption. +

+ +

2.1 Mathematical Derivation

+ + +
+
POINTER MANGLING FORMULA
+
Mangled_Pointer (P') = (Address_of_Chunk >> 12) ^ Target_Pointer (P)
+
+ +

+ Since the lowest 12 bits of Address_of_Chunk >> 12 are randomized by ASLR, overwriting P' directly without an address leak causes the kernel to dereference invalid virtual memory pages, aborting with SIGSEGV. +

+

+ However, when an arbitrary read primitive leaks the mangled value of the terminal chunk in the tcache bin (where Target_Pointer = NULL), the equation simplifies: +

+ +
+
Leaked_Mangled = (Chunk_Addr >> 12) ^ 0x0 ==> ASLR_Key = Leaked_Mangled
+
+ + +
+
[!CAUTION] Pointer Alignment Constraints
+

+ In glibc 2.35, chunks inserted into tcache bins must also adhere to strict 16-byte address alignment. Forging a fake chunk unaligned to a 16-byte boundary triggers malloc(): unaligned tcache chunk detected aborts. +

+
+ +

3.0 GDB Memory Inspection

+

+ Attaching GDB with the pwndbg extension confirms the tcache bin layout and reveals the mangled pointer representation in memory: +

+ + +
+
+
+ gdb-pwndbg stdout: heap inspection + GDB +
+ +
+ 
pwndbg> tcachebins
+tcachebins
+0x40 [  2]: 0x55555555a2a0 → 0x55555555a260
+pwndbg> x/4gx 0x55555555a2a0
+0x55555555a2a0:  0x0000555555550730  0x0000000000000000
+0x55555555a2b0:  0x0000000000000000  0x0000000000000041
+pwndbg> tele 0x55555555a2a0
+00:0000 │ 0x55555555a2a0 → 0x555555550730 (MANGLED POINTER: 0x55555555a260 ^ (0x55555555a >> 12))
+
+ +

4.0 House of Apple Hijacking

+

+ With the ability to allocate chunks onto arbitrary memory addresses via tcache poisoning, we target _IO_list_all. When exit() or abort() is invoked by the runtime, the glibc standard I/O cleanup routine iterates through the _IO_FILE linked list and invokes _IO_wfile_overflow(): +

+ + +
+
+
+ house_of_apple_payload.c + C99 +
+ +
+ 
// Constructing fake _IO_FILE_plus structure
+struct _IO_FILE_plus *fake_file = (struct _IO_FILE_plus *)payload;
+fake_file->file._flags = 0x6873; // "sh" in ASCII
+fake_file->file._mode = 1;      // Force wide character stream mode
+fake_file->vtable = (const struct _IO_jump_t *)wide_vtable_addr;
+
+// Trigger call to system("/bin/sh") on stream flush
+fake_file->file._wide_data->_wide_vtable->doallocate = (void *)system_addr;
+
+ +

5.0 Glibc Heap Mitigation History

+

+ Tracking defensive hardening milestones across recent glibc releases: +

+ + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
glibc VersionDefensive Mitigation AddedStatusImpact on Attackers
2.26Thread Cache (tcache) introducedActiveInitially lacked double-free and count sanity checks.
2.29tcache double-free check (key field)ActiveStores pointer to tcache struct in chunk data.
2.32Safe-Linking Pointer ManglingHardenedRequires ASLR heap base leak to forge pointers.
2.34Removal of __malloc_hook / __free_hookEnforcedForces targeting of _IO_FILE and stack frames.
2.35Alignment verification on tcache chunksEnforcedEliminates misaligned chunk allocations entirely.
+
+ + +
+
+ [1] Safe-Linking was first proposed by Eyal Itkin for memory allocators in modern operating systems. +
+
+ [2] House of Apple exploitation methodology authored by roderickchan, targeting wide character I/O functions. +
+
+ +
+ +
+ +
+ + + + +
+ + + + + diff --git a/samples/article-tiling-traefik.html b/samples/article-tiling-traefik.html new file mode 100644 index 0000000..721dff7 --- /dev/null +++ b/samples/article-tiling-traefik.html @@ -0,0 +1,887 @@ + + + + + + Building a High-Availability Traefik Router with Docker Compose | River Rooks + + + + +
+ + +
+
+ + RIVER ROOKS // INFRASTRUCTURE ARCHIVE +
+ +
+ + +
+ + +
+ + +
+
+ ~/notes/ + > + ha-traefik-docker.md +
+ +

Building a High-Availability Traefik Router with Docker Compose

+ +
+
2026-07-15
+ • +
12 MIN READ
+ • +
AUTHOR: RIVER ROOKS
+ • +
+ [#homelab] + [#docker-traefik] + [#networking] +
+
+
+ + +
+ +

1.0 Ingress Architecture & Topologies

+

+ When running multi-tier web applications across self-hosted bare-metal clusters, an edge reverse proxy is indispensable. Managing static Nginx reverse proxy virtual host configs by hand becomes unmaintainable once container fleets scale past twenty services. +

+

+ Traefik v3.1 solves this by inspecting the Docker socket daemon directly. When a new container is deployed, Traefik dynamically binds routing rules, attaches middlewares, and provisions automated wildcard TLS certificates without restarting the daemon. +

+ + +
+
+-------------------------------------------------------------------------+
+| [INTERNET / WAN INGRESS]  ==>  Cloudflare DNS (DNS-01 ACME Challenge)   |
++-------------------------------------------------------------------------+
+                                    ||
+                                    \/
++-------------------------------------------------------------------------+
+| gw-node01.lan (OPNsense 24.7 Gateway / NAT Port 443 Forwarding)         |
++-------------------------------------------------------------------------+
+                                    ||
+                                    \/  10GbE VLAN 20 (Server DMZ)
++-------------------------------------------------------------------------+
+| pve-node02.lan :: Traefik v3.1 Reverse Proxy Container (:443/:80)       |
++-------------------------------------------------------------------------+
+       ||                            ||                          ||
+       \/ (Docker Internal)          \/ (Docker Internal)        \/ (WireGuard)
++--------------------+      +--------------------+      +--------------------+
+| Forgejo Git Server |      | CyberChef Security |      | Uptime Kuma Status |
++--------------------+      +--------------------+      +--------------------+
+
+
+ +

2.0 Automated DNS-01 ACME with Cloudflare

+

+ Standard HTTP-01 challenges require opening port 80/tcp publicly to the internet, exposing unauthenticated ingress surfaces. By employing the DNS-01 challenge, Traefik proves domain ownership by creating temporary _acme-challenge.rooks.dev TXT records through the Cloudflare API. +

+ + +
+
[!TIP] Principle of Least Privilege
+

+ Do not use your Global Cloudflare API Key. Instead, generate a scoped API Token with permissions restricted strictly to: Zone.Zone:Read and Zone.DNS:Edit scoped exclusively to your primary apex zone. +

+
+ +

3.0 Complete Docker Compose Specification

+

+ Below is the production-tested compose.yaml definition. It mounts the Docker socket in read-only mode (:ro) and stores ACME certificate state inside an encrypted acme.json file with strict 0600 permissions: +

+ + +
+
+
+ docker-compose.traefik.yml + YAML +
+ +
+ 
services:
+  traefik:
+    image: traefik:v3.1.2
+    container_name: edge-traefik-proxy
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      - proxy-tier
+    ports:
+      - "80:80"
+      - "443:443"
+    environment:
+      - CF_DNS_API_TOKEN_FILE=/run/secrets/cf_token
+    secrets:
+      - cf_token
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./data/traefik.yml:/etc/traefik/traefik.yml:ro
+      - ./data/acme.json:/acme.json
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.api.rule=Host(`proxy.rooks.dev`)"
+      - "traefik.http.routers.api.entrypoints=websecure"
+      - "traefik.http.routers.api.tls.certresolver=cloudflare"
+      - "traefik.http.routers.api.service=api@internal"
+
+secrets:
+  cf_token:
+    file: ./secrets/cloudflare_api_token.txt
+
+networks:
+  proxy-tier:
+    external: true
+
+ +

4.0 Configuration Parameters Matrix

+

+ Key parameters governing the Traefik core engine: +

+ + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Directive ParameterValueScopeBehavior Description
providers.docker.exposedbydefaultfalseCore SecurityPrevents untagged backend containers from being routed.
entrypoints.web.http.redirectionsto: websecureHTTP → HTTPSEnforces automatic HTTP 301 redirects to port 443.
certificatesresolvers.cf.acme.dnschallengecloudflareLet's EncryptUses Cloudflare DNS provider for wildcard propagation.
certificatesresolvers.cf.acme.storage/acme.jsonPersistent StorageEncrypted JSON database for RSA/ECDSA key pairs.
+
+ +

5.0 Verification & Failover Testing

+

+ Verify TLS certificate issuance and HTTP/3 ALPN negotiation directly via curl: +

+ +
+
+
+ terminal stdout: curl -Iv + Bash +
+ +
+ 
$ curl -Iv https://proxy.rooks.dev
+* Server certificate:
+*  subject: CN=*.rooks.dev
+*  start date: Jul 15 00:00:00 2026 GMT
+*  expire date: Oct 13 23:59:59 2026 GMT
+*  issuer: C=US, O=Let's Encrypt, CN=R3
+*  SSL certificate verify ok.
+< HTTP/2 200 OK
+< server: traefik
+< strict-transport-security: max-age=63072000; includeSubDomains; preload
+
+ +

+ Zero downtime updates are achieved through rolling container health checks configured inside Traefik dynamic labels. +

+ +
+ +
+ + + + +
+ + + + +
+ + + + + diff --git a/samples/blog-lander-cards.html b/samples/blog-lander-cards.html new file mode 100644 index 0000000..5e307ce --- /dev/null +++ b/samples/blog-lander-cards.html @@ -0,0 +1,629 @@ + + + + + + River Rooks | Field Notes & Dispatches (Cards Lander) + + + + + +
+ + + ROOKS.DEV // NOTES + + +
+ +
+ + +
+

River Rooks

+
SYSTEMS ARCHITECTURE & CYBERSECURITY • ALABAMA, USA
+

+ Cybersecurity student at the University of Alabama College of Engineering. Architecting high-throughput homelab networks, reverse engineering IoT firmware, and writing zero-allocation Unix utilities. +

+
+ [#network-forensics] + [#docker-traefik] + [#arch-linux] + [#neovim] + [#wireguard] + [#posix-sh] + [#python] + [#rust] +
+
+ + +
+
+ // Pinned Technical Write-Up +
+ +
+
+ [PINNED WRITE-UP] + 2026-07-20 • 8 min read +
+ +

+ Reverse Engineering IoT Firmware: SPI Flash Extraction +

+ +

+ In security audits of embedded systems, retrieving the firmware is the critical first step. When over-the-air updates are encrypted and debug ports (UART, JTAG) are disabled in production silicon, dumping physical SPI Flash memory becomes necessary. This writeup covers extracting firmware from an 8-pin SOP SPI flash chip using a Bus Pirate and flashrom to bypass bootloader lockdowns. +

+ + +
+
+ extract_firmware.sh + POSIX sh +
+
+ 
# Query the SPI flash details using flashrom via Bus Pirate
+flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -r firmware_dump.bin
+
+# Verify the integrity of the binary dump by comparing hashes
+if [ $? -eq 0 ]; then
+  echo "Dump successful. Running md5sum..."
+  md5sum firmware_dump.bin
+fi
+
+
+ +
+
+ [#firmware] + [#hardware] + [#security] + [#bus-pirate] +
+ READ FULL WRITEUP [8 MIN] → +
+
+
+ + +
+
+ // Recent Dispatches & Architecture Notes +
+ +
+ + + + + +
+
+
+ + 6 min read +
+

+ POSIX sh vs. Bash: Portability in Modern Scripts +

+

+ Analyzing edge-case incompatibilities, syntax overhead, eliminating bashisms, and writing fast, bulletproof bootstrapping scripts for Alpine and embedded targets conforming to IEEE Std 1003.1. +

+
+
+
+ [#posix-sh] + [#unix] +
+ Read → +
+
+ + +
+
+
+ + 15 min read +
+

+ CTF Write-up: Heap Exploitation in glibc 2.35 +

+

+ Deconstructing modern glibc memory allocator defenses: tcache safe-linking pointer mangling, bypass primitives, and House of Apple file structure hijacking. +

+
+
+
+ [#ctf] + [#security] +
+ Read → +
+
+ + + + +
+
+ + + + +
+ + + diff --git a/samples/blog-lander-stream.html b/samples/blog-lander-stream.html new file mode 100644 index 0000000..828087d --- /dev/null +++ b/samples/blog-lander-stream.html @@ -0,0 +1,483 @@ + + + + + + River Rooks | Technical Notes & Blog (Stream Lander) + + + + +
+ + +
+
+ + ~/blog/notes/ +
+
[5 POSTS • FEED ONLINE]
+
+ + +
+

River Rooks

+
Systems Architecture & Cybersecurity
+

+ Cybersecurity student at the University of Alabama College of Engineering, focusing on network forensics, self-hosted infrastructure, and bare-metal systems. Field notes, architecture specs, and low-level security research. +

+
+ + + + +
+ + +
+ + +
+
+ + • + 8 min read + • + ~/notes/iot-firmware-spi-extraction.md +
+

+ Reverse Engineering IoT Firmware: SPI Flash Extraction +

+

+ In security audits of embedded systems, retrieving the firmware is the critical first step. When over-the-air updates are encrypted and debug ports (UART, JTAG) are disabled in production silicon, dumping physical SPI Flash memory becomes necessary. This writeup covers extracting firmware from an 8-pin SOP SPI flash chip using a Bus Pirate and flashrom to bypass bootloader lockdowns. +

+
+ [#firmware] + [#hardware] + [#security] + [#bus-pirate] +
+ Read Writeup [8 min] → +
+ + + + + +
+
+ + • + 6 min read + • + ~/notes/posix-sh-vs-bash.md +
+

+ POSIX sh vs. Bash: Portability in Modern Scripts +

+

+ Analyzing edge-case incompatibilities, syntax overhead, eliminating bashisms, and writing fast, bulletproof bootstrapping scripts for Alpine and embedded targets conforming to IEEE Std 1003.1. +

+
+ [#posix-sh] + [#shell] + [#unix] +
+ Read Writeup [6 min] → +
+ + +
+
+ + • + 15 min read + • + ~/notes/ctf-heap-glibc-2-35.md +
+

+ CTF Write-up: Heap Exploitation in glibc 2.35 +

+

+ Deconstructing modern glibc memory allocator defenses: tcache safe-linking pointer mangling, bypass primitives, and House of Apple file structure hijacking for arbitrary code execution. +

+
+ [#ctf] + [#binary-exploitation] + [#security] +
+ Read Writeup [15 min] → +
+ + + + +
+ + + + +
+ + + + + diff --git a/samples/blog-lander-terminal.html b/samples/blog-lander-terminal.html new file mode 100644 index 0000000..39f10a9 --- /dev/null +++ b/samples/blog-lander-terminal.html @@ -0,0 +1,617 @@ + + + + + + River Rooks | Terminal Index Blog Lander + + + + +
+ +
+ + +
+
+ + + + rooks@sys: ~/articles +
+
POSIX SH • UTF-8 • [READ-ONLY]
+
+ +
+ + +
+
+

River Rooks // Articles Directory

+ [SYSTEMS ARCHITECTURE & CYBERSECURITY] +
+

+ Field notes and technical write-ups covering embedded firmware reverse engineering, network forensics, low-level memory exploitation, and self-hosted infrastructure. +

+
+ + + + + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
PERMSDATEPRIMARY TAGARTICLE TITLE / FILEEST. TIMEACTION
-rw-r--r--[#firmware] + > Reverse Engineering IoT Firmware: SPI Flash Extraction + 8 mins[INSPECT]
-rw-r--r--[#homelab] + > Building a High-Availability Traefik Router with Docker Compose + 12 mins[INSPECT]
-rw-r--r--[#posix-sh] + > POSIX sh vs. Bash: Portability in Modern Scripts + 6 mins[INSPECT]
-rw-r--r--[#ctf] + > CTF Write-up: Heap Exploitation in glibc 2.35 + 15 mins[INSPECT]
-rw-r--r--[#networking] + > Zero-Trust Network Isolation with WireGuard & OPNsense VLANs + 10 mins[INSPECT]
+
+ + +
+
+ ~/notes/iot-firmware-spi-extraction.md + 2026-07-20 • 8 mins read • [#firmware] [#hardware] [#security] +
+

+ In security audits of embedded systems, retrieving the firmware is the critical first step. When over-the-air updates are encrypted and debug ports (UART, JTAG) are disabled in production silicon, dumping physical SPI Flash memory becomes necessary. This writeup covers extracting firmware from an 8-pin SOP SPI flash chip using a Bus Pirate and flashrom to bypass bootloader lockdowns. +

+
+ 
# Query the SPI flash details using flashrom via Bus Pirate
+flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -r firmware_dump.bin
+
+# Verify the integrity of the binary dump by comparing hashes
+if [ $? -eq 0 ]; then
+  echo "Dump successful. Running md5sum..."
+  md5sum firmware_dump.bin
+fi
+
+
+ Format: IEEE Std 1003.1 Markdown + READ COMPLETE WRITEUP → +
+
+ +
+ + + + +
+ +
+ + + + + diff --git a/samples/blog-tiling-catalog.html b/samples/blog-tiling-catalog.html new file mode 100644 index 0000000..c53295f --- /dev/null +++ b/samples/blog-tiling-catalog.html @@ -0,0 +1,661 @@ + + + + + + River Rooks | Blog Lander (Dual-Lead Grid & Feed) + + + + +
+ + +
+
+ + RIVER ROOKS // DUAL-LEAD DISPATCH CATALOG +
+ +
+ + +
+
RESEARCH • DISPATCHES • SPECIFICATIONS
+

Systems Research & Security Engineering Feed

+

+ This catalog organizes field reports across two primary research vectors: hardware firmware reverse engineering and bare-metal self-hosted cloud infrastructure. Full source code, shell bootstrapping scripts, and network topology manifests are included. +

+ +
+ [NODE: gw-node01.lan] + [5 CANONICAL DISPATCHES] + [FORMAT: GHOSTTY / ZED MINIMALISM] + [ENCRYPTED SYNC: WIREGUARD] +
+
+ + +
+ + +
+
+
+ // LEAD: HARDWARE FORENSICS +
+ 2026-07-20 • 8 MIN +
+ +
+
+ [PINNED LEAD] + ~/notes/iot-firmware-spi-extraction.md +
+ +

+ Reverse Engineering IoT Firmware: SPI Flash Extraction +

+ +

+ Extracting binary firmware from an 8-pin SOP SPI flash chip using a Bus Pirate and flashrom to bypass locked-down UART/JTAG interfaces on production microcontrollers. +

+ +
+
+ extract_firmware.sh + POSIX sh +
+
+ 
flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M \
+  -r firmware_dump.bin && md5sum firmware_dump.bin
+
+
+
+ +
+ [#firmware] [#hardware] + READ WRITEUP [8 MIN] → +
+
+ + +
+
+
+ // LEAD: INFRASTRUCTURE ROUTING +
+ 2026-07-15 • 12 MIN +
+ +
+
+ [PINNED LEAD] + ~/notes/ha-traefik-docker.md +
+ +

+ High-Availability Traefik Router with Docker Compose +

+ +

+ Architecting automated TLS wildcard certificate propagation, Docker provider label routing, zero-downtime container updates, and backend health-check failover. +

+ +
+
+ docker-compose.traefik.yml + YAML +
+
+ 
services:
+  traefik:
+    image: traefik:v3.1
+    command: ["--providers.docker=true", "--entrypoints.websecure.address=:443"]
+
+
+
+ +
+ [#homelab] [#docker-traefik] + READ WRITEUP [12 MIN] → +
+
+ +
+ + +
+
+
+ // CHRONOLOGICAL DISPATCHES ARCHIVE +
+ SELECT ROW TO INSPECT NOTES +
+ +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
DATECATEGORYTITLE / PATHREAD TIMEACTION
2026-07-10[#posix-sh]> POSIX sh vs. Bash: Portability in Modern Scripts6 min[INSPECT ↓]
2026-06-28[#ctf]> CTF Write-up: Heap Exploitation in glibc 2.3515 min[INSPECT ↓]
2026-06-14[#networking]> Zero-Trust Network Isolation with WireGuard & OPNsense VLANs10 min[INSPECT ↓]
+
+ + +
+
+ ~/notes/posix-sh-vs-bash.md + 2026-07-10 • 6 MIN READ • [#posix-sh] [#shell] [#unix] +
+

+ Analyzing edge-case incompatibilities, syntax overhead, eliminating bashisms, and writing fast, bulletproof bootstrapping scripts for Alpine and embedded targets conforming to IEEE Std 1003.1. +

+
+ OPEN ENTRY → +
+
+ +
+ + + + +
+ + + + + diff --git a/samples/blog-tiling-lead.html b/samples/blog-tiling-lead.html new file mode 100644 index 0000000..3bc4873 --- /dev/null +++ b/samples/blog-tiling-lead.html @@ -0,0 +1,780 @@ + + + + + + River Rooks | Blog Lander (Tiling Hero & Feed) + + + + +
+ + +
+
+ + RIVER ROOKS // BLOG & RESEARCH ARCHIVE +
+ +
+ + +
+
TECHNICAL PUBLICATION REPOSITORY • ~/NOTES/INDEX.MD
+

Engineering Notes, CTF Write-Ups & Systems Architecture

+ +

+ Documenting bare-metal systems, embedded hardware audits, and network isolation architectures. Writing zero-allocation POSIX scripts, reverse engineering production microcontrollers, and analyzing memory allocator exploitation primitives. +

+ +
+ TOPIC FILTER: + + + + + +
+
+ + +
+ + +
+
+
+ // PINNED RESEARCH WRITE-UP +
+ SPI FLASH • 8 MIN READ +
+ +
+
+ [FEATURED DEEP DIVE] + 2026-07-20 • ~/notes/iot-firmware-spi-extraction.md +
+ +

+ Reverse Engineering IoT Firmware: SPI Flash Extraction +

+ +

+ In security audits of embedded systems, retrieving firmware is the critical first step. When over-the-air updates are encrypted and debug ports (UART, JTAG) are disabled in production silicon, dumping physical SPI Flash memory becomes necessary. This writeup covers extracting firmware from an 8-pin SOP SPI flash chip using a Bus Pirate and flashrom to bypass bootloader lockdowns. +

+ + +
+
+ extract_firmware.sh + POSIX sh +
+
+ 
# Query the SPI flash details using flashrom via Bus Pirate
+flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -r firmware_dump.bin
+
+# Verify the integrity of the binary dump by comparing hashes
+if [ $? -eq 0 ]; then
+  echo "Dump successful. Running md5sum..."
+  md5sum firmware_dump.bin
+fi
+
+
+ +
+
+ [#firmware] [#hardware] [#security] [#bus-pirate] +
+ READ FULL WRITEUP → +
+
+
+ + +
+ + +
+
+
+ // ARCHIVE TELEMETRY +
+ STATIC HTML +
+ +
+
+ TOTAL ARTICLES: + 5 PUBLISHED +
+
+ TOTAL READING TIME: + 51 MINUTES +
+
+ ACTIVE TOPICS: + 7 CATEGORIES +
+
+ FORMAT COMPLIANCE: + IEEE STD 1003.1 +
+
+
+ + +
+
+
+ // RESEARCH TRACKS +
+ CURATED +
+ + +
+ +
+ +
+ + +
+
+
+ // CHRONOLOGICAL DISPATCHES FEED +
+ ALL ARTICLES ORDERED BY DATE +
+ +
+ + +
+
+ + ~/notes/ha-traefik-docker.md +
+

+ > Building a High-Availability Traefik Router with Docker Compose +

+

+ Architecting automated TLS wildcard certificate propagation, Docker provider label routing, zero-downtime container updates, and backend health-check failover routes on bare-metal infrastructure. +

+
+
+ [#homelab] + [#docker-traefik] + [#networking] +
+ Read Entry → +
+
+ + +
+
+ + ~/notes/posix-sh-vs-bash.md +
+

+ > POSIX sh vs. Bash: Portability in Modern Scripts +

+

+ Analyzing edge-case incompatibilities, syntax overhead, eliminating bashisms, and writing fast, bulletproof bootstrapping scripts for Alpine and embedded targets conforming to IEEE Std 1003.1. +

+
+
+ [#posix-sh] + [#shell] + [#unix] +
+ Read Entry → +
+
+ + +
+
+ + ~/notes/ctf-heap-glibc-2-35.md +
+

+ > CTF Write-up: Heap Exploitation in glibc 2.35 +

+

+ Deconstructing modern glibc memory allocator defenses: tcache safe-linking pointer mangling, bypass primitives, and House of Apple file structure hijacking for arbitrary code execution. +

+
+
+ [#ctf] + [#binary-exploitation] + [#security] +
+ Read Entry → +
+
+ + +
+
+ + ~/notes/zero-trust-wireguard-opnsense.md +
+

+ > Zero-Trust Network Isolation with WireGuard & OPNsense VLANs +

+

+ Designing strict zone-based firewall rules across isolated VLANs (Management, Server DMZ, IoT, Trusted Clients) with point-to-point WireGuard cryptographic routing. +

+
+
+ [#networking] + [#wireguard] + [#security] +
+ Read Entry → +
+
+ +
+
+ + + + +
+ + + + + diff --git a/samples/blog-tiling-split.html b/samples/blog-tiling-split.html new file mode 100644 index 0000000..750045f --- /dev/null +++ b/samples/blog-tiling-split.html @@ -0,0 +1,711 @@ + + + + + + River Rooks | Blog Lander (Asymmetric 3-Tile Workspace) + + + + +
+ + +
+
+ + RIVER ROOKS // TECHNICAL NOTES WORKSPACE +
+ +
+ + +
+
SYSTEM DISPATCHES • KNOWLEDGE BASE
+

Technical Notes & Systems Architecture

+

+ Deep technical documentation on network forensics, self-hosted hypervisor infrastructure, embedded hardware exploitation, and minimal Unix tool design. +

+ +
+ dev-blog@system:~$ + grep -i + + 5 dispatches loaded +
+
+ + +
+ + +
+ + +
+
+
+ // FEATURED WRITE-UP 01 +
+ 2026-07-20 • 8 MIN READ +
+ +
+
+ [PINNED RESEARCH] + ~/notes/iot-firmware-spi-extraction.md +
+ +

+ > Reverse Engineering IoT Firmware: SPI Flash Extraction +

+ +

+ In security audits of embedded systems, retrieving the firmware is the critical first step. When over-the-air updates are encrypted and debug ports (UART, JTAG) are disabled in production silicon, dumping physical SPI Flash memory becomes necessary. This writeup covers extracting firmware from an 8-pin SOP SPI flash chip using a Bus Pirate and flashrom. +

+ +
+
+ extract_firmware.sh + POSIX sh +
+
+ 
# Query the SPI flash details using flashrom via Bus Pirate
+flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -r firmware_dump.bin
+
+# Verify the integrity of the binary dump by comparing hashes
+if [ $? -eq 0 ]; then
+  echo "Dump successful. Running md5sum..."
+  md5sum firmware_dump.bin
+fi
+
+
+ +
+ [#firmware] [#hardware] [#security] [#bus-pirate] + READ WRITEUP [8 MIN] → +
+
+
+ + +
+
+
+ // FEATURED WRITE-UP 02 +
+ 2026-07-15 • 12 MIN READ +
+ +
+
+ [INFRASTRUCTURE SPEC] + ~/notes/ha-traefik-docker.md +
+ +

+ > Building a High-Availability Traefik Router with Docker Compose +

+ +

+ Architecting automated TLS wildcard certificate propagation, Docker provider label routing, zero-downtime container updates, and backend health-check failover routes on bare-metal infrastructure. +

+ +
+
+ traefik-compose.yml + YAML +
+
+ 
services:
+  traefik:
+    image: traefik:v3.1
+    command:
+      - "--providers.docker=true"
+      - "--entrypoints.websecure.address=:443"
+      - "--certificatesresolvers.cf.acme.dnschallenge=true"
+
+
+ +
+ [#homelab] [#docker-traefik] [#networking] + READ WRITEUP [12 MIN] → +
+
+
+ + +
+
+
+ // SYSTEMS & SCRIPTING DISPATCH +
+ 2026-07-10 • 6 MIN READ +
+ +
+
+ [STANDARDS & COMPLIANCE] + ~/notes/posix-sh-vs-bash.md +
+ +

+ > POSIX sh vs. Bash: Portability in Modern Scripts +

+ +

+ Analyzing edge-case incompatibilities, syntax overhead, eliminating bashisms, and writing fast, bulletproof bootstrapping scripts for Alpine and embedded targets conforming to IEEE Std 1003.1. +

+ +
+ [#posix-sh] [#shell] [#unix] + READ WRITEUP [6 MIN] → +
+
+
+ +
+ + +
+ + +
+
+
+ // CURATED TRACKS +
+ SPECIALIZATIONS +
+ + +
+ + +
+
+
+ // CTF & SECURITY WIRE +
+ REPORTS +
+ +
+ + +
+ 2026-06-28 • 15 min read + > CTF Write-up: Heap Exploitation in glibc 2.35 +

+ Deconstructing tcache safe-linking pointer mangling, bypass primitives, and House of Apple file structure hijacking. +

+
+ [#ctf] [#binary-exploitation] +
+
+ + +
+ 2026-06-14 • 10 min read + > Zero-Trust Network Isolation with WireGuard & OPNsense VLANs +

+ Designing strict zone-based firewall rules across isolated VLANs with point-to-point WireGuard cryptographic routing. +

+
+ [#networking] [#wireguard] +
+
+ +
+
+ +
+ +
+ + + + +
+ + + + + diff --git a/samples/canonical-sample-content.md b/samples/canonical-sample-content.md index 8451d21..8fb3bb0 100644 --- a/samples/canonical-sample-content.md +++ b/samples/canonical-sample-content.md @@ -271,3 +271,18 @@ This matrix specifies which components and data entries from this canonical docu | [`samples/sample-dashboard.html`](file:///home/venus/code/blog/samples/sample-dashboard.html) | Sample 8: 3-Tile Workspace | Center tile bio | Left tile services | Right tile archive | Center tile projects | Status bar | Vim command bar | | [`samples/sample-command-center.html`](file:///home/venus/code/blog/samples/sample-command-center.html) | Sample 9: Tabbed Command Center | Tab 3 (Resume) | Tab 1 (Services) | Tab 2 (Blog Notes) | Tab 3 (Projects) | Tab 1 (Nodes) | Status dots | | [`samples/sample-dual-pane-explorer.html`](file:///home/venus/code/blog/samples/sample-dual-pane-explorer.html) | Sample 10: Helix Tree Explorer | Sidebar links | Services subtree | Notes subtree | Modules subtree | Status bar | Sidebar companion | +| [`samples/blog-lander-stream.html`](file:///home/venus/code/blog/samples/blog-lander-stream.html) | Blog Lander 1: Minimalist Stream | Header & Bio | — | Posts 1–5 (Linear Feed & Topic Filter) | — | — | — | +| [`samples/blog-lander-terminal.html`](file:///home/venus/code/blog/samples/blog-lander-terminal.html) | Blog Lander 2: Terminal Directory Index | Header & Subtitle | — | Posts 1–5 (Dense Tabular Index & Code Inspection) | — | Terminal Status Bar | — | +| [`samples/blog-lander-cards.html`](file:///home/venus/code/blog/samples/blog-lander-cards.html) | Blog Lander 3: Curated Dispatch & Cards | Profile & Bio | — | Post 1 (Pinned Lead Card) + Posts 2–5 (Cards Grid) | — | — | — | +| [`samples/service-gateway-manifesto.html`](file:///home/venus/code/blog/samples/service-gateway-manifesto.html) | Gateway Lander 1: Manifesto & System Hub | Hero Manifesto & Bio | 6 Core/Public Services | Posts 1–3 Excerpts | — | Status banner | — | +| [`samples/service-gateway-terminal.html`](file:///home/venus/code/blog/samples/service-gateway-terminal.html) | Gateway Lander 2: Host Console & MOTD Router | MOTD Narrative & Specs | 6 Tabular Services | Posts 1–5 Log Lines | — | Hardware summary | — | +| [`samples/service-gateway-tiling.html`](file:///home/venus/code/blog/samples/service-gateway-tiling.html) | Gateway Lander 3: Tiling Workspace Hub | Hero Landing Tile | 5 Grid Services (Blog Core Tile) | Posts 1–4 Sublinks | — | Nodes 1–3 Live Telemetry | — | +| [`samples/blog-tiling-lead.html`](file:///home/venus/code/blog/samples/blog-tiling-lead.html) | Tiling Blog 1: Hero Dispatch & Dual Stream | Hero Tile & Topic Filter | — | Post 1 (Lead with Code) + Posts 2–5 (Feed) | — | Archive Telemetry | — | +| [`samples/blog-tiling-split.html`](file:///home/venus/code/blog/samples/blog-tiling-split.html) | Tiling Blog 2: Asymmetric 3-Tile Workspace | Hero Tile & Grep Bar | — | Posts 1–3 (Featured) + Posts 4–5 (Wire) | — | Curated Tracks | — | +| [`samples/blog-tiling-catalog.html`](file:///home/venus/code/blog/samples/blog-tiling-catalog.html) | Tiling Blog 3: Dual-Lead Grid & Inspection Feed | Hero Tile & Badges | — | Posts 1–2 (Dual Leads) + Posts 3–5 (Table) | — | Inline Note Inspector | — | +| [`samples/article-tiling-firmware.html`](file:///home/venus/code/blog/samples/article-tiling-firmware.html) | Article 1: IoT Firmware Extraction | Header & Meta | — | Post 1 (Full Markdown, Code, Tables, Alerts) | — | Winbond 25Q64 specs | — | +| [`samples/article-tiling-traefik.html`](file:///home/venus/code/blog/samples/article-tiling-traefik.html) | Article 2: HA Traefik Router | Header & Meta | — | Post 2 (Full Markdown, Compose YAML, ASCII Diagram) | — | pve-node02.lan specs | — | +| [`samples/article-tiling-heap.html`](file:///home/venus/code/blog/samples/article-tiling-heap.html) | Article 3: CTF Heap Exploitation | Header & Meta | — | Post 4 (Full Markdown, GDB session, C payload, Formula) | — | glibc 2.35 runtime | — | + + + diff --git a/samples/index.html b/samples/index.html index ff0f06d..3ddabe3 100644 --- a/samples/index.html +++ b/samples/index.html @@ -432,6 +432,42 @@ + + + + + + + + + + + + @@ -489,7 +525,7 @@

Design Spec Samples Catalog

- 15 Artifacts Registered + 27 Artifacts Registered
@@ -572,6 +608,90 @@ type: 'html', desc: 'Split-screen file-tree explorer with interactive document viewer and sys-daemon mascot reacting to folder item selection.' }, + { + key: 'l1', + file: 'blog-lander-stream.html', + title: 'Blog Lander 1: Minimalist Stream', + type: 'html', + desc: 'Single-column 65ch linear reading stream with topic filter pills, canonical article abstracts, tag clusters, and PGP/RSS links.' + }, + { + key: 'l2', + file: 'blog-lander-terminal.html', + title: 'Blog Lander 2: Terminal Directory Index', + type: 'html', + desc: 'High-density POSIX tabular directory index mimicking ls -la with real-time grep filter and inline code inspection drawer.' + }, + { + key: 'l3', + file: 'blog-lander-cards.html', + title: 'Blog Lander 3: Curated Dispatch & Cards', + type: 'html', + desc: 'Structured blog lander with a pinned lead article card featuring code snippet preview, and a 2-column grid of recent technical dispatches.' + }, + { + key: 'g1', + file: 'service-gateway-manifesto.html', + title: 'Gateway Lander 1: Manifesto & System Hub', + type: 'html', + desc: 'Gateway portal where the homepage manifesto is the central focus, routing visitors to homelab services (with the blog highlighted) and recent dispatches.' + }, + { + key: 'g2', + file: 'service-gateway-terminal.html', + title: 'Gateway Lander 2: Host Console & MOTD Router', + type: 'html', + desc: 'Terminal-style MOTD gateway centering on system landing prose, an interactive service routing table featuring the blog, and live dispatches log.' + }, + { + key: 'g3', + file: 'service-gateway-tiling.html', + title: 'Gateway Lander 3: Tiling Workspace Hub', + type: 'html', + desc: 'Tiling window manager aesthetic with a prominent hero landing tile, a dedicated core blog feature tile, homelab services grid, and node telemetry.' + }, + { + key: 'tb1', + file: 'blog-tiling-lead.html', + title: 'Tiling Blog 1: Hero Dispatch & Dual Stream', + type: 'html', + desc: 'Gateway 3 tiling aesthetic applied to the blog, featuring a pinned lead write-up with code preview, research tracks, and full-width chronological feed.' + }, + { + key: 'tb2', + file: 'blog-tiling-split.html', + title: 'Tiling Blog 2: Asymmetric 3-Tile Workspace', + type: 'html', + desc: 'Asymmetric 3-tile blog workspace with interactive live grep filter, embedded code blocks, curated tracks, and security wire.' + }, + { + key: 'tb3', + file: 'blog-tiling-catalog.html', + title: 'Tiling Blog 3: Dual-Lead Grid & Inspection Feed', + type: 'html', + desc: 'Dual-lead side-by-side featured article tiles with code snippets, plus an archive feed table with an interactive inline note inspector.' + }, + { + key: 'a1', + file: 'article-tiling-firmware.html', + title: 'Article 1: IoT Firmware Reverse Engineering', + type: 'html', + desc: 'Article reading template featuring left sidebar TOC, collapsible related dispatches drawer, SOP8 pinout matrix, flashrom code blocks with copy utility, alerts, and task lists.' + }, + { + key: 'a2', + file: 'article-tiling-traefik.html', + title: 'Article 2: High-Availability Traefik Router', + type: 'html', + desc: 'Article reading template featuring right sidebar TOC, collapsible homelab series drawer, ASCII network routing diagram, YAML compose code blocks, and configuration matrix.' + }, + { + key: 'a3', + file: 'article-tiling-heap.html', + title: 'Article 3: CTF Heap Exploitation in glibc 2.35', + type: 'html', + desc: 'Article reading template featuring left sidebar TOC, collapsible security drawer, safe-linking formula box, GDB stdout terminal blocks, C structs, and mitigation history table.' + }, { key: 'd', file: 'canonical-sample-content.md', @@ -757,7 +877,10 @@ '7': 'public-services.html', '8': 'sample-dashboard.html', '9': 'sample-command-center.html', - '0': 'sample-dual-pane-explorer.html' + '0': 'sample-dual-pane-explorer.html', + 'b': 'blog-lander-stream.html', + 't': 'blog-lander-terminal.html', + 'c': 'blog-lander-cards.html' }; if (keyMap[e.key]) { diff --git a/samples/service-gateway-manifesto.html b/samples/service-gateway-manifesto.html new file mode 100644 index 0000000..eccc0dc --- /dev/null +++ b/samples/service-gateway-manifesto.html @@ -0,0 +1,587 @@ + + + + + + River Rooks | Node Gateway & System Hub + + + + +
+ + +
+
+ + node: gw-node01.lan [RACK-01 / ALABAMA] +
+
[SYSTEMS OPERATIONAL • 10GbE]
+
+ + +
+

River Rooks

+
SYSTEMS ARCHITECTURE • CYBERSECURITY • SELF-HOSTED CLUSTER
+ +
+

+ Welcome to my personal computing node and technical gateway. I am an engineering student at the University of Alabama specializing in network forensics, bare-metal hypervisors, and security systems. +

+

+ This server is not a commercial landing page or marketing platform. It is a sovereign, self-hosted operational command hub operating from a dedicated 10GbE home rack. All services below run on hardened local hypervisors (Proxmox VE, OPNsense, TrueNAS) routed through an automated Traefik reverse proxy with WireGuard zero-trust mesh peering. +

+

+ Use this landing portal to navigate the ecosystem. The Technical Blog contains deep-dive research notes and CTF post-mortems. The Public Services are live, free-to-use developer and cryptographic utilities available to the public, while the Internal Infrastructure links route directly to cluster monitoring and orchestration consoles. +

+
+ +
+ ROUTING NOTICE: External ingress is authenticated and monitored via OPNsense Suricata IDS/IPS. Public utilities are open for interactive use without registration. +
+
+ +
+ + +
+
+

Directory of Hosted Services & Tools

+ Select a destination → +
+ +
+ + + +
+
+ > Technical Notes & Engineering Blog + [BLOG / DISPATCHES] +
+ ~/blog/notes/ • rooks.dev/notes +
+

+ The core writing repository. Reverse-chronological feed of technical articles covering IoT SPI flash extraction, glibc 2.35 heap exploitation, high-availability Traefik routing, and POSIX shell engineering. +

+
+ [#ctf-writeups] + [#firmware-reversing] + [#traefik-docker] + [#posix-sh] + [OPEN BLOG FEED →] +
+ + + + +
+
+ Forgejo Git Server + [PUBLIC FORGE] +
+ https://git.rooks.dev • :2222/ssh +
+

+ Lightweight, independent Git forge hosting infrastructure-as-code playbooks, dotfiles, POSIX shell parser modules, and bare-metal kernel bootstrap code. +

+
+ [#iac] + [#ansible] + [#cortex-m] + [#git] +
+ + + + +
+
+ CyberChef Security Workbench + [PUBLIC TOOL] +
+ https://chef.rooks.dev • :443 +
+

+ Client-side cryptographic Swiss Army knife for hex decoding, Base64 operations, XOR decryption, hashing algorithms, and CTF payload deconstruction. +

+
+ [#cryptography] + [#forensics] + [#ctf-toolkit] +
+ + + + +
+
+ Stirling PDF Studio + [PUBLIC TOOL] +
+ https://pdf.rooks.dev • :443 +
+

+ Locally hosted private document toolkit for OCR text extraction, PDF merging, splitting, sanitization, and password encryption without external cloud telemetry. +

+
+ [#pdf-tools] + [#ocr] + [#privacy-first] +
+ + + + +
+
+ Homelab Cluster & Storage + [INTERNAL / HYPERVISOR] +
+ https://pve.rooks.dev • 48TB ZFS +
+

+ Hypervisor cluster with AMD Ryzen 9 5900X (12C/24T), 128GB ECC RAM, and TrueNAS SCALE RaidZ2 storage pool. View node topology and live resource utilization telemetry. +

+
+ [#proxmox-ve] + [#truenas] + [#10gbe-mesh] +
+ + + + +
+
+ Uptime Kuma Health Monitor + [STATUS / TELEMETRY] +
+ https://status.rooks.dev • :3001 +
+

+ Continuous synthetic HTTP, TCP, and ICMP health checks broadcasting real-time cluster uptime, DNS resolution latencies, and service availability. +

+
+ [#uptime-100%] + [#telemetry] + [#prometheus] +
+ + +
+
+ +
+ + +
+
+

Latest Technical Dispatches From the Blog

+ View all 5 entries → +
+ +
+ + + + + +
+
+ + [#posix-sh] [#unix] +
+ > POSIX sh vs. Bash: Portability in Modern Scripts +

+ Eliminating bashisms and writing bulletproof, zero-allocation bootstrapping scripts for minimal Alpine and embedded Linux environments. +

+
+ +
+
+ + + + +
+ + + diff --git a/samples/service-gateway-terminal.html b/samples/service-gateway-terminal.html new file mode 100644 index 0000000..2795919 --- /dev/null +++ b/samples/service-gateway-terminal.html @@ -0,0 +1,609 @@ + + + + + + River Rooks | Homelab Host Console & Service Router + + + + +
+ +
+ + +
+
+ + + + dev-blog@system: ~/gateway +
+
SESSION: TTY1 • 10GbE TRUNK • UPTIME: 99.98%
+
+ +
+ + +
+
+ /etc/motd • BROADCAST MESSAGE + NODE: gw-node01.lan [RACK-01] +
+ +

River Rooks // Homelab Gateway & Service Router

+
Systems Architecture • Network Forensics • Bare-Metal Infrastructure
+ +
+

+ Welcome to the entrypoint for my self-hosted environment. I am a cybersecurity and systems student at the University of Alabama College of Engineering. This portal acts as the root router for both my external public services and internal virtualization infrastructure. +

+

+ Rather than relying on commercial cloud silos, every application listed below runs directly on physical hardware housed in my home lab. Network traffic is segmented across dedicated VLANs (Management, Server DMZ, IoT) and shielded behind an OPNsense firewall with Suricata intrusion prevention and an automated Traefik reverse proxy handling Let's Encrypt TLS wildcard certificates. +

+

+ Looking for technical writing? The Technical Notes & Blog service is where I document firmware reverse engineering, CTF binary exploitation, and zero-trust routing architectures. All public utilities (CyberChef, Stirling PDF, Git Forge) are open and ready for immediate use. +

+
+ +
+
GATEWAY: OPNsense 24.7 (Intel N100)
+
COMPUTE: Proxmox VE 8.2 (AMD 5900X)
+
STORAGE: TrueNAS SCALE (48TB ZFS)
+
SECURITY: WireGuard Full-Mesh
+
+
+ + +
+ dev-blog@system:~$ + route-service --list-all --highlight=blog +
+ + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
SERVICE IDENTIFIERROUTING DOMAIN / PATHACCESS LEVELDESCRIPTIONDISPATCH
+ + > Technical Notes & Blog + + ~/notes/ • rooks.dev/notes[FEATURED BLOG] + Technical writing on firmware reversing, heap exploitation, and networking. + [OPEN BLOG →]
+ + Forgejo Git Forge + + git.rooks.dev:2222[PUBLIC OPEN] + Self-hosted repositories: Ansible IaC, dotfiles, and POSIX parser modules. + [VISIT FORGE]
+ + CyberChef Suite + + chef.rooks.dev:443[PUBLIC TOOL] + Client-side decoding, hex analysis, hashing, and CTF payload processing. + [OPEN CHEF]
+ + Stirling PDF Studio + + pdf.rooks.dev:443[PUBLIC TOOL] + Local document manipulation: OCR, PDF merge, split, and sanitize. + [LAUNCH PDF]
+ + Uptime Kuma Telemetry + + status.rooks.dev:3001[PUBLIC METRICS] + Live latency metrics, cluster ping monitors, and real-time SLA status. + [VIEW STATS]
+ + Proxmox Hypervisor + + pve.rooks.dev:8006[INTERNAL AUTH] + KVM VMs and LXC container cluster on AMD Ryzen 9 5900X (12C/24T). + [CLUSTER VIEW]
+
+ + +
+ dev-blog@system:~$ + tail -n 5 ~/notes/dispatches.log +
+ + +
+
+
~/notes/dispatches.log • RECENT TECHNICAL WRITING
+ Full Archive → +
+ +
+ +
+
+ 2026-07-20 + Reverse Engineering IoT Firmware: SPI Flash Extraction +
+ [#firmware] [#hardware] • 8m +
+ +
+
+ 2026-07-15 + Building a High-Availability Traefik Router with Docker Compose +
+ [#homelab] [#docker-traefik] • 12m +
+ +
+
+ 2026-07-10 + POSIX sh vs. Bash: Portability in Modern Scripts +
+ [#posix-sh] [#unix] • 6m +
+ +
+
+ 2026-06-28 + CTF Write-up: Heap Exploitation in glibc 2.35 +
+ [#ctf] [#binary-exploitation] • 15m +
+ +
+
+ 2026-06-14 + Zero-Trust Network Isolation with WireGuard & OPNsense VLANs +
+ [#networking] [#wireguard] • 10m +
+ +
+
+ +
+ + + + +
+ +
+ + + diff --git a/samples/service-gateway-tiling.html b/samples/service-gateway-tiling.html new file mode 100644 index 0000000..3a856c2 --- /dev/null +++ b/samples/service-gateway-tiling.html @@ -0,0 +1,592 @@ + + + + + + River Rooks | Homelab Gateway (Tiling Workspace) + + + + +
+ + +
+
+ + RIVER ROOKS // NODE GATEWAY +
+ +
+ + +
+
SYSTEM DECLARATION • RACK-01 NODE GATEWAY
+

Engineering Sovereign Infrastructure & Technical Notes

+ +
+

+ I am River Rooks, a cybersecurity engineering student at the University of Alabama. My work centers on network forensics, self-hosted system architecture, low-level firmware exploitation, and zero-allocation Unix utilities. +

+

+ This website functions as the unified frontend for my physical homelab cluster. Rather than hosting projects on opaque third-party clouds, everything here runs on bare metal in my personal server rack—orchestrated through Proxmox VE, partitioned across isolated VLANs via OPNsense, and protected by point-to-point WireGuard cryptographic meshes. +

+

+ Navigation Guide: If you are here to read technical research, the Engineering Blog is linked below with deep write-ups on firmware dumping, heap exploitation, and container routing. If you are here to use tools, the Public Services provide locally hosted instances of CyberChef, Stirling PDF, and Git. +

+
+ +
+ PRIMARY DESTINATIONS: + [1] Technical Blog (5 Articles) • + [2] Forgejo Git Repos • + [3] Public Cryptographic & PDF Tools • + [4] Cluster Telemetry +
+
+ + +
+ + +
+ + +
+
+
+ // PRIMARY SERVICE: THE TECHNICAL BLOG +
+ ~/notes/ • 5 ARTICLES +
+ +
+
+ [CORE PUBLICATION SERVICE] + 2026-07-20 LAST SYNC +
+ + > River Rooks Technical Notes & Research +

+ In-depth security post-mortems, CTF write-ups, shell portability benchmarks, and bare-metal homelab architecture guides. +

+ +
+ + 1. Reverse Engineering IoT Firmware (SPI Flash) + [8 min] → + + + 2. High-Availability Traefik with Docker Compose + [12 min] → + + + 3. POSIX sh vs. Bash: Portability in Modern Scripts + [6 min] → + + + 4. CTF Write-up: Heap Exploitation in glibc 2.35 + [15 min] → + +
+
+
+ +
+ + +
+ + +
+
+
+ // HOMELAB SERVICES ROUTER +
+ 4 PUBLIC TOOLS +
+ +
+ + +
+
Forgejo Git
+
git.rooks.dev:2222
+
+

Self-hosted code repositories & dotfiles.

+ + + +
+
CyberChef
+
chef.rooks.dev:443
+
+

Hex decoding, cryptography & forensics.

+ + + +
+
Stirling PDF
+
pdf.rooks.dev:443
+
+

Private document OCR and manipulation.

+ + + +
+
Uptime Kuma
+
status.rooks.dev:3001
+
+

Live synthetic latency & uptime telemetry.

+ + +
+
+ + +
+
+
+ // HARDWARE NODES (RACK-01) +
+ 10GbE SFP+ +
+ +
+
+
+ gw-node01.lan + OPNsense 24.7 +
+ CPU: 18% | RAM: 32% +
+ +
+
+ pve-node02.lan + Proxmox VE (AMD 5900X) +
+ CPU: 42% | RAM: 68% +
+ +
+
+ nas-node03.lan + TrueNAS (48TB RaidZ2) +
+ CPU: 14% | RAM: 82% +
+
+
+ +
+ +
+ + + + +
+ + +