Loading
  • Home
  • Blog
  • Resume
  • GitHub

Maisie is a researcher, this is her website

1 USDSGD Curncy  DLIB  ·  Volatility Surface —□✕
Actions ▾Products ▾Data & Settings ▾Portal ▾Derivatives Library
SaveLoad DealSendBook ▾Trade ▾
FX Vanilla Options Cpty  ShareUser ▾ SPDL 
DealLifeCyclePricingMarket DataCalibrationScenarioBacktestingPRIIP(s)
AssetUSDSGD Curncy ▾ ModelLVLC - Local Volatility Local Correlation
1) Calibration Analytics
LegendTrackViewRotatePanZoomFlatCopy Image

Analytics Display

CalculateVolatility  Price UsingSynthetic surface Data setSynthetic ▾ ViewChart  Table Maximum  Minimum  ATM (1Y)  25Δ RR (1Y)  25Δ BF (1Y)  RV 1M / 3M  Avg (absolute) 
Only Calibration Instruments

Calibration Parameters

Calibrate UntilMaturity of Deal ▾ Time Steps/Year200 Strike Steps400

Valuation Results

Valuation Date  Market Data  1) CalculatePrice (%) ▾ Funding Spread0.00 bp ModelLVLC - Local Vol Price (%)  Paths20000 PriceUSD ▾  
USDSGD Curncy   Loading market data…  
2 GMM <GO>  ·  Global Macro Movers —□✕
LLP <GO> to Open in Launchpad
Standard View ▾LegendSettings ▾ Page 1/5 ⧉ Global Macro Movers
Movers ▾1DMTD ▾Events ▾
   

Fig 1.1 — During Maisie's tenure at Credit Suisse, her work was to diagnose issues with high-frequency trading systems to ensure accurate quotation of various equity and commodity positions. The window demonstrates a Bloomberg Terminal's DLIB<GO> function, displaying a local-volatility (LVLC) implied-vol surface for USD/SGD whose ATM term structure is bootstrapped from the annualized standard deviation of ECB daily log-return. The strike-axis smile, risk-reversal skews, and equities/commodity data are simulated ticks.

Maisie is a researcher, this is her website

tools — radare2 — 96×26
maisie@mbp ~/tools % unzip -qoj gdsecurityprovider.aar '*arm64*.so'
maisie@mbp ~/tools % radare2 -A -w libgdsecurityprovider.so
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls (aac)
[0x00002c40]> s sym.gd_attest_verify
[0x00003a10]> pd 16
;-- sym.gd_attest_verify:
0x00003a10fd7bbea9stp x29, x30, [sp, -0x20]!
0x00003a14fd030091mov x29, sp
0x00003a18f35301a9stp x19, x20, [sp, 0x10]
0x00003a1cf30300aamov x19, x0 ; ctx
0x00003a20601a40b9ldr w0, [x19, 0x18] ; manifest_len
0x00003a2401ffff97bl sym.gd_verify_manifest
0x00003a281f000071cmp w0, 0
,==<0x00003a2cc0000054b.eq 0x3a44 ; invalid -> reject
| 0x00003a3020008052mov w0, 1 ; TRUST_OK
| 0x00003a34601e00b9str w0, [x19, 0x1c]
| 0x00003a38f35341a9ldp x19, x20, [sp, 0x10]
| 0x00003a3cfd7bc2a8ldp x29, x30, [sp], 0x20
| 0x00003a40c0035fd6ret
`-->0x00003a44e00313aamov x0, x19
0x00003a4855fdff97bl sym.gd_log_reject
0x00003a4c00008052mov w0, 0 ; TRUST_FAIL
[0x00003a10]> s 0x00003a2c
[0x00003a2c]> pd 1
0x00003a2cc0000054b.eq 0x3a44
[0x00003a2c]> wx c1
[0x00003a2c]> pd 1
0x00003a2cc1000054b.ne 0x3a44
tools — -zsh — 96×26
maisie@mbp ~/tools % binwalk gdsecurityprovider.aar
 
DECIMALHEXADECIMALDESCRIPTION
--------------------------------------------------------------------------------
00x0Zip archive data, at least v2.0 to extract, name: AndroidManifest.xml
11880x4A4Zip archive data, at least v2.0 to extract, name: classes.jar
1984640x30740Zip archive data, at least v2.0 to extract, name: jni/arm64-v8a/libgdsecurityprovider.so
3198760x4E184End of Zip archive, footer length: 22
 
maisie@mbp ~/tools % binwalk -A libgdsecurityprovider.so | more
 
DECIMALHEXADECIMALDESCRIPTION
--------------------------------------------------------------------------------
148640x3A10ARM64 instructions, function prologue
152200x3B74ARM64 instructions, function prologue
 

Fig 2.1 — During Maisie's tenure at Grab, vetting the third-party binaries that ship inside the company's mobile apps became an integral part of her job. The window demonstrates radare2 isolating parts of a notional anti-tamper solution, triggering the B.EQ at 0x3a2c to branch to the reject/log path at 0x3a44. Patching 0x540000c0 → 0x540000c1 flips the condition to B.NE, causing a failed verification (w0 == 0) to fall through to TRUST_OK and bypasses the anti-tamper check with a single-byte opcode mutation.

tip: click a window and type — try help, ls, pd 8, binwalk gdsecurityprovider.aar

Maisie is a researcher, this is her website

IDA - CSAgent.sys.i64  (070242d1703d89b10ce3cc53e6e295cf07dbc2c1e4b3481156fb2530251444c8)
A▲● ▶❚❚■ ▾
Library function Regular function Instruction Data Unexplored External symbol Lumina function
▤ IDA View-A≡ Strings◉ Hex View-1◆ Local Types☰ Imports☰ Exports
Functions
Graph overview
cmp ecx, 6 jnz loc_6A69776F6F0A
loc_6A756E65: mov rdx, [r13+0] mov r9d, r10d cmp dword ptr [rdx], 4 mov rax, [rdx+8] mov r8, [rax+r11*8] ; R11: 0x14 ; RAX: buffer w/ pointers (though at 0x14 addr is foo'barred) ; R8: unmapped invalid memory addr (e.g. 0xffff9c8e`0000008a) ; RAX: ptr buf, 0x14 bad ; R8: unmapped addr jnz short loc_1400E14E8 ; (likely) take; take
loc_6A69776F6F0A: mov r9d, r10d mov rdx, [r13+0] cmp dword ptr [rdx], 4 mov rax, [rdx+8] jnz short loc_1400E1802
loc_1400E14E8: ; check R8 != NULL; R8 == 0? test r8, r8 jz short loc_1400E14F4 ; don't take; skip
test r8, r8 jz short loc_1400E14F4
mov r9d, [r8] ; Faulting Instruction: 0xffff9c8e`0000008a is not paged in, so; not paged in ✷✷✷✷✷
movzx r9d, word ptr [r8] jmp short loc_1400E14F0
loc_1400E14F4: mov [r13+8], r9d jmp loc_1400E1520
Output
100.00% (1694,3104) (867,7) 000E08D7 00000001400E14D7: sub_1400E11D0+307 (Synchronized with Hex View-1) AU: idle   Down   Disk: 148GB

Fig 3.1 — During Maisie's tenure at Traveloka, responding to incidents such as the CrowdStrike outage in 2024 became an integral part of her job. The window shows a disassembly of CrowdStrike's kernel-mode driver (CSAgent.sys) using IDA Pro, where the graph view demonstrates an out-of-bounds array index (R8 = [RAX + R11*8], R11 = 0x14) that resolves to an unmapped kernel address and faults on dereference, the page-fault pattern behind a ring-0 bugcheck.

Maisie is a researcher, this is her website

Rear of a silver Leica M8
100-05943/3
F2.01/60ISO 640
DEBUG
USB Mode
  • PTP
  • Mass Storage
  • Leica Custom
USB Connection
PTP
tools — m8tool — 88×24

Fig 4.1 — Maisie's hobby with cameras, especially the Leica M8, led her to interesting places. Through reverse engineering the Fujitsu Softune REALOS-based firmware, she was able to uncover a secret 16-bit DNG mode that allowed for pictures with more dynamic range, colour accuracy, and low-light performance. The m8tool was never released publicly due to a significant risk of people permanently bricking their Leica M8 cameras.