Corkami (@corkami) header
Corkami (@corkami) profile picture

Corkami

@corkami

reverse engineering & visual documentations

 by @angealbertini
corkami.com
Joined May 2011
  • Tweets599
  • Following12
  • Followers9.3K
102Media
Photo by Corkami (@corkami)Photo by Corkami (@corkami)Photo by Corkami (@corkami)Photo by Corkami (@corkami)Photo by Corkami (@corkami)Photo by Corkami (@corkami)Photo by Corkami (@corkami)Photo by Corkami (@corkami)Photo by Corkami (@corkami)Photo by Corkami (@corkami)
Corkami retweeted
Ange (@angealbertini) profile picture
Ange@angealbertiniSep 29
I wrote the FlareOn13.doc file of the Flare-On 2026 challenge, so take a look if you like unusual file formats ! I heard it breaks parsers… flare-on13.ctfd.io
2
14
78
6,381
Hi newcomers! I've been contributing to Magika since 2023 (it became public in 2024). Magika is not AI slop: it's useful in its own way, and used in production. The recent Rust release doesn't change how Magika is fundamentally working.
1
2
17
1,809
Corkami retweeted
Smukx.E (@5mukx) profile picture
Smukx.E
@5mukx24 Oct 2025
This repository offering in depth dissections of binary file formats, including PE, ELF, Mach-O, and more. An essential resource for reverse engineers and developers to uncover the structure of executables and libraries. github.com/corkami/pics
PE file format

ALT PE file format

Zip file formats

ALT Zip file formats

4
75
450
18,232
😊
This quoted post is unavailable.
Try viewing anyway · View on X
1
4
1,278
In PagedOut 6, I showed many PDF tricks by dissecting a crazy yet fully working handmade “Hello World” PDF file.
A handmade PDF with no valid signature, dummy stream object, weird object ordering, no XREF…

ALT A handmade PDF with no valid signature, dummy stream object, weird object ordering, no XREF…

27
144
9,574
I made in PagedOut 6 an illustration on the basics of the PDF format.
A dissection of a “Hello World” PDF that shows the relation between the PDF objects.

ALT A dissection of a “Hello World” PDF that shows the relation between the PDF objects.

2
15
115
6,883
New year resolution #2: ✅ try streaming. Week #1: From PDF basics to PoC||GTFO polyglots. Thanks to everyone for the support!
A screenshot of the Youtube @corkami-albertini channel, showing 7 live streams: 1-PDF basics, 2-PDF leaks, 3-PDF tricks, 4-PNG basics & tricks, 5-ZIP basics and tricks, 6-Polyglots - PNG x PDF x ZIP, 7- PoC||GTFO polyglots.

ALT A screenshot of the Youtube @corkami-albertini channel, showing 7 live streams: 1-PDF basics, 2-PDF leaks, 3-PDF tricks, 4-PNG basics & tricks, 5-ZIP basics and tricks, 6-Polyglots - PNG x PDF x ZIP, 7- PoC||GTFO polyglots.

7
17
137
11,161
After the next stream, I'll start redoing my first streams in french! You'll have time to catch up in the meantime. I'll resume english streams afterwards. Après le prochain direct, je referais mes 7 premiers directs, mais en français cette fois! Partagez SVP!
7 miniatures de directs à venir: PDF:Bases, PDF:Fuites, PDF:Astuces, PNG:Bases & astuces, ZIP:Bases, Polyglottes:PNG+PDF+ZIP, Polyglottes:PoC||GTFO.

ALT 7 miniatures de directs à venir: PDF:Bases, PDF:Fuites, PDF:Astuces, PNG:Bases & astuces, ZIP:Bases, Polyglottes:PNG+PDF+ZIP, Polyglottes:PoC||GTFO.

1
3
11
1,556
Today, I crafted manually tiny polyglot files as easy examples. In my next stream (tomorrow @ 9PM CET), I'll walk through some real polyglots: the releases of PoC||GTFO. youtube.com/live/POg2Qpxbplk…
7 PoC||GTFO polyglots

7 PoC||GTFO polyglots

Let's hexplore PoC||GTFO polyglots!The releases of "Proof of conc...

youtube.com
1
17
1,430
Corkami retweeted
Pwn (@PwnFunction) profile picture
Pwn
@PwnFunction8 Jan 2025
lately @corkami has been dropping some fire content
Image from Pwn (@PwnFunction)
4
15
86
5,487
My stream about crafting a PDF file from scratch is over. youtube.com/live/q6KgFezu8tw… It was pretty chill to take the time to answer questions, thanks again for joining!
1 PDF basics

1 PDF basics

Let's write a simple 'hello world!' PDF from scratch!This stream ...

youtube.com
1
16
1
91
7,000
Let’s try something new in 2025… This saturday at 8pm CET, I'll stream about crafting a valid PDF file from scratch. We’ll see how it goes!
2
11
74
11,082
I presented about file formats at #38C3. Thanks for the feedback everyone! speakerdeck.com/ange/fearsom…
Fearsome File Formats

Fearsome File Formats

Presented at 38C3 in Hamburg on the 28th December 2024. Video recording: https://media.ccc.de/v/38c3-fearsome-file-formats With so many open-sou…

speakerdeck.com
3
15
73
5,402
The Woff v2 format pushes things further: standard tags are now implicit via an enum, tables-specific transformations are applied to improve compression, and Brotli compression (2013-) is used.
A Woff2 file. The table directory is mostly using implicit tags (0:Cmap 1:head 2:hhead...) except for arbitrary tag (63), then explicit 'FFTM' bytes. There's no offsets in the table directory, only lengths. The whole font data is compressed together.

ALT A Woff2 file. The table directory is mostly using implicit tags (0:Cmap 1:head 2:hhead...) except for arbitrary tag (63), then explicit 'FFTM' bytes. There's no offsets in the table directory, only lengths. The whole font data is compressed together.

2
8
2,443
The Woff (Web Open Font Format) is an alternate form of TTF/OTF, in which tables are typically compressed individually w/ Zlib. Besides, the content remains similar and Woff files can be turned back to TTF/OTF.
A Woff header starts with the 'wOFF' specific magic, then the OTF/CFF "OTTO" magic. The Table directories and their tags are similar to TTF/OTF files (CFF, FFTM, GDEF...)

ALT A Woff header starts with the 'wOFF' specific magic, then the OTF/CFF "OTTO" magic. The Table directories and their tags are similar to TTF/OTF files (CFF, FFTM, GDEF...)

In a Woff file, most tables are zlib-compressed, starting with Zlib's trademark 78 9C (for normal compression). The MaxP table is 6 bytes long, so it's stored raw, without zlib.

ALT In a Woff file, most tables are zlib-compressed, starting with Zlib's trademark 78 9C (for normal compression). The MaxP table is 6 bytes long, so it's stored raw, without zlib.

Image from Ange (@angealbertini)
Image from Ange (@angealbertini)
1
5
25
6,396
OTF (OpenType) fonts files are similar to TTF: The version looks like a magic, similar directory / table structure, some tables are shared w/ TTF (OS/2, maxp, cmap...), some are exclusive (CFF ^ glyf, loca).
An OTF header starting with an 'OTTO' version, then a number of tables. Then there's a record of0[ tag, checksum, offset, length] for each table. The visible tables' tags are "CFF ", FFTM, GDEF, OS/2.

ALT An OTF header starting with an 'OTTO' version, then a number of tables. Then there's a record of0[ tag, checksum, offset, length] for each table. The visible tables' tags are "CFF ", FFTM, GDEF, OS/2.

1
5
21
3,356
TTF fonts spaghetti: - the number of elements in the glyf table is set in the maxp table. - the relative offsets of the elements in the glyf table are given by the loca table. - the format of the loca table is specified in the head table.
a Loca table where offsets are stored on 16 bits, with an IndexToLocFormat set in the head table as 0.

ALT a Loca table where offsets are stored on 16 bits, with an IndexToLocFormat set in the head table as 0.

a Loca table where offsets are stored on 32 bits, with an IndexToLocFormat set in the head table as 1.

ALT a Loca table where offsets are stored on 32 bits, with an IndexToLocFormat set in the head table as 1.

2
11
1,994
TTF (and vector fonts in general) are very complex. A tiny font with a single defined glyph made of a single rectangle... 0x590 (1424) bytes! They even contain some bytecode!
A *Simple* Glyph Description structure, with 0x2E (46) bytes of bytecode.

ALT A *Simple* Glyph Description structure, with 0x2E (46) bytes of bytecode.

1
6
1
37
4,614
TTF (TrueType fonts) have no magic, start directly with a directory table pointing to each tagged-tables. The format is uncompressed, many tables start with a version number. Standard software can add their own custom tables (ex: FontForge).
a TrueType file, starting with a version number (no magic), then defining a number of tables. The directory tables follows, defining a tag, offset and length for each tagged-table of the font.

ALT a TrueType file, starting with a version number (no magic), then defining a number of tables. The directory tables follows, defining a tag, offset and length for each tagged-table of the font.

4
13
2,300
BPG - Better Portable Graphics - was created by Fabrice Bellard (LzExe / FFMpeg / QEmu...) and has a very compact header with variable integers, yet it has a proper magic.
Dissection of a BPG image, showing its BPG \xFB magic, then mostly unused Flags (making the header very compact), then VarInt Width and Height, then compressed image data (using intra-frame encoding of High Efficiency Video Coding).

ALT Dissection of a BPG image, showing its BPG \xFB magic, then mostly unused Flags (making the header very compact), then VarInt Width and Height, then compressed image data (using intra-frame encoding of High Efficiency Video Coding).

5
20
5,777
Load more