@corkami profile picture
Corkami @corkami

reverse engineering & visual documentations

Joined May 2011
  • Tweets 598
  • Following 12
  • Followers 9,329
102 Photos and videos
Corkami retweeted
Ange@angealbertini
14 Nov 2025
Hi newcomers! I've been contributing to Magika since 2023 (it became public in 2024). Magika is not AI slop: it's useful in its own way, and used in production. The recent Rust release doesn't change how Magika is fundamentally working.
1
2
18
1,701
Corkami retweeted
Smukx.E
@5mukx
24 Oct 2025
This repository offering in depth dissections of binary file formats, including PE, ELF, Mach-O, and more. An essential resource for reverse engineers and developers to uncover the structure of executables and libraries. github.com/corkami/pics
PE file format

ALT PE file format

Zip file formats

ALT Zip file formats

4
76
468
18,156
Corkami@corkami
25 Apr 2025
😊
This tweet is unavailable
1
4
1,212
Corkami retweeted
Ange@angealbertini
29 Mar 2025
In PagedOut 6, I showed many PDF tricks by dissecting a crazy yet fully working handmade “Hello World” PDF file.
A handmade PDF with no valid signature, dummy stream object, weird object ordering, no XREF…

ALT A handmade PDF with no valid signature, dummy stream object, weird object ordering, no XREF…
27
144
9,543
Corkami retweeted
Ange@angealbertini
29 Mar 2025
I made in PagedOut 6 an illustration on the basics of the PDF format.
A dissection of a “Hello World” PDF that shows the relation between the PDF objects.

ALT A dissection of a “Hello World” PDF that shows the relation between the PDF objects.

2
15
117
6,855
Corkami retweeted
Ange@angealbertini
10 Jan 2025
New year resolution #2: ✅ try streaming. Week #1: From PDF basics to PoC||GTFO polyglots. Thanks to everyone for the support!
A screenshot of the Youtube @corkami-albertini channel, showing 7 live streams: 1-PDF basics, 2-PDF leaks, 3-PDF tricks, 4-PNG basics & tricks, 5-ZIP basics and tricks, 6-Polyglots - PNG x PDF x ZIP, 7- PoC||GTFO polyglots.

ALT A screenshot of the Youtube @corkami-albertini channel, showing 7 live streams: 1-PDF basics, 2-PDF leaks, 3-PDF tricks, 4-PNG basics & tricks, 5-ZIP basics and tricks, 6-Polyglots - PNG x PDF x ZIP, 7- PoC||GTFO polyglots.

7
18
140
11,150
Corkami retweeted
Ange@angealbertini
10 Jan 2025
After the next stream, I'll start redoing my first streams in french! You'll have time to catch up in the meantime. I'll resume english streams afterwards. Après le prochain direct, je referais mes 7 premiers directs, mais en français cette fois! Partagez SVP!
7 miniatures de directs Ă  venir: PDF:Bases, PDF:Fuites, PDF:Astuces, PNG:Bases & astuces, ZIP:Bases, Polyglottes:PNG PDF ZIP, Polyglottes:PoC||GTFO.

ALT 7 miniatures de directs Ă  venir: PDF:Bases, PDF:Fuites, PDF:Astuces, PNG:Bases & astuces, ZIP:Bases, Polyglottes:PNG PDF ZIP, Polyglottes:PoC||GTFO.

1
3
11
1,548
Corkami retweeted
Ange@angealbertini
9 Jan 2025
Today, I crafted manually tiny polyglot files as easy examples. In my next stream (tomorrow @ 9PM CET), I'll walk through some real polyglots: the releases of PoC||GTFO. youtube.com/live/POg2Qpxbplk…

7 PoC||GTFO polyglots

Let's hexplore PoC||GTFO polyglots!The releases of "Proof of conc...

youtube.com
1
17
1,428
Corkami retweeted
Suraj@PwnFunction
8 Jan 2025
lately @corkami has been dropping some fire content
4
15
86
5,482
Corkami retweeted
Ange@angealbertini
4 Jan 2025
My stream about crafting a PDF file from scratch is over. youtube.com/live/q6KgFezu8tw… It was pretty chill to take the time to answer questions, thanks again for joining!

1 PDF basics

Let's write a simple 'hello world!' PDF from scratch!This stream ...

youtube.com
1
16
93
6,986
Corkami retweeted
Ange@angealbertini
2 Jan 2025
Let’s try something new in 2025… This saturday at 8pm CET, I'll stream about crafting a valid PDF file from scratch. We’ll see how it goes!
2
11
75
11,077
Corkami retweeted
Ange@angealbertini
28 Dec 2024
I presented about file formats at #38C3. Thanks for the feedback everyone! speakerdeck.com/ange/fearsom…

Fearsome File Formats

Presented at 38C3 in Hamburg on the 28th December 2024. Video recording: https://media.ccc.de/v/38c3-fearsome-file-formats With so many open-sou…

speakerdeck.com
3
16
74
5,397
Corkami retweeted
Ange@angealbertini
29 Jan 2024
The Woff v2 format pushes things further: standard tags are now implicit via an enum, tables-specific transformations are applied to improve compression, and Brotli compression (2013-) is used.
A Woff2 file. The table directory is mostly using implicit tags (0:Cmap 1:head 2:hhead...) except for arbitrary tag (63), then explicit 'FFTM' bytes. There's no offsets in the table directory, only lengths. The whole font data is compressed together.

ALT A Woff2 file. The table directory is mostly using implicit tags (0:Cmap 1:head 2:hhead...) except for arbitrary tag (63), then explicit 'FFTM' bytes. There's no offsets in the table directory, only lengths. The whole font data is compressed together.
2
8
2,438
Corkami retweeted
Ange@angealbertini
27 Jan 2024
The Woff (Web Open Font Format) is an alternate form of TTF/OTF, in which tables are typically compressed individually w/ Zlib. Besides, the content remains similar and Woff files can be turned back to TTF/OTF.
A Woff header starts with the 'wOFF' specific magic, then the OTF/CFF "OTTO" magic. The Table directories and their tags are similar to TTF/OTF files (CFF, FFTM, GDEF...)

ALT A Woff header starts with the 'wOFF' specific magic, then the OTF/CFF "OTTO" magic. The Table directories and their tags are similar to TTF/OTF files (CFF, FFTM, GDEF...)

In a Woff file, most tables are zlib-compressed, starting with Zlib's trademark 78 9C (for normal compression). The MaxP table is 6 bytes long, so it's stored raw, without zlib.

ALT In a Woff file, most tables are zlib-compressed, starting with Zlib's trademark 78 9C (for normal compression). The MaxP table is 6 bytes long, so it's stored raw, without zlib.

1
5
25
6,385
Corkami retweeted
Ange@angealbertini
26 Jan 2024
OTF (OpenType) fonts files are similar to TTF: The version looks like a magic, similar directory / table structure, some tables are shared w/ TTF (OS/2, maxp, cmap...), some are exclusive (CFF ^ glyf, loca).
An OTF header starting with an 'OTTO' version, then a number of tables. Then there's a record of0[ tag, checksum, offset, length] for each table. The visible tables' tags are "CFF ", FFTM, GDEF, OS/2.

ALT An OTF header starting with an 'OTTO' version, then a number of tables. Then there's a record of0[ tag, checksum, offset, length] for each table. The visible tables' tags are "CFF ", FFTM, GDEF, OS/2.

1
5
22
3,350
Corkami retweeted
Ange@angealbertini
25 Jan 2024
TTF fonts spaghetti: - the number of elements in the glyf table is set in the maxp table. - the relative offsets of the elements in the glyf table are given by the loca table. - the format of the loca table is specified in the head table.
a Loca table where offsets are stored on 16 bits, with an IndexToLocFormat set in the head table as 0.

ALT a Loca table where offsets are stored on 16 bits, with an IndexToLocFormat set in the head table as 0.

a Loca table where offsets are stored on 32 bits, with an IndexToLocFormat set in the head table as 1.

ALT a Loca table where offsets are stored on 32 bits, with an IndexToLocFormat set in the head table as 1.
2
11
1,990
Corkami retweeted
Ange@angealbertini
24 Jan 2024
TTF (and vector fonts in general) are very complex. A tiny font with a single defined glyph made of a single rectangle... 0x590 (1424) bytes! They even contain some bytecode!
A *Simple* Glyph Description structure, with 0x2E (46) bytes of bytecode.

ALT A *Simple* Glyph Description structure, with 0x2E (46) bytes of bytecode.

1
7
37
4,610
Corkami retweeted
Ange@angealbertini
23 Jan 2024
TTF (TrueType fonts) have no magic, start directly with a directory table pointing to each tagged-tables. The format is uncompressed, many tables start with a version number. Standard software can add their own custom tables (ex: FontForge).
a TrueType file, starting with a version number (no magic), then defining a number of tables. The directory tables follows, defining a tag, offset and length for each tagged-table of the font.

ALT a TrueType file, starting with a version number (no magic), then defining a number of tables. The directory tables follows, defining a tag, offset and length for each tagged-table of the font.
4
13
2,295
Corkami retweeted
Ange@angealbertini
22 Jan 2024
BPG - Better Portable Graphics - was created by Fabrice Bellard (LzExe / FFMpeg / QEmu...) and has a very compact header with variable integers, yet it has a proper magic.
Dissection of a BPG image, showing its BPG \xFB magic, then mostly unused Flags (making the header very compact), then VarInt Width and Height, then compressed image data (using intra-frame encoding of High Efficiency Video Coding).

ALT Dissection of a BPG image, showing its BPG \xFB magic, then mostly unused Flags (making the header very compact), then VarInt Width and Height, then compressed image data (using intra-frame encoding of High Efficiency Video Coding).
5
20
5,755
Corkami retweeted
Ange@angealbertini
20 Jan 2024
Binary properties list is a serialization format with a PDF-like structure: a magic, a trailer, an xref table, and objects referencing each others. Which makes it easy to move objects around or overlap them.
A bplist file dissection, with a 'bplist' magic, then a trailer pointing to the offset table, its size, and defining the root object, and an offset table pointing to each objects.

ALT A bplist file dissection, with a 'bplist' magic, then a trailer pointing to the offset table, its size, and defining the root object, and an offset table pointing to each objects.

1
8
21
3,737
Load more