• Home
  • Blog
  • Resume
  • GitHub

Maisie is a researcher, this is her website

1 USDSGD Curncy  DLIB  ·  Volatility Surface —□✕
Actions ▾Products ▾Data & Settings ▾Portal ▾Derivatives Library
SaveLoad DealSendBook ▾Trade ▾
FX Vanilla Options Cpty  ShareUser ▾ SPDL 
DealLifeCyclePricingMarket DataCalibrationScenarioBacktestingPRIIP(s)
AssetUSDSGD Curncy ▾ ModelLVLC - Local Volatility Local Correlation
1) Calibration Analytics
LegendTrackViewRotatePanZoomFlatCopy Image

Analytics Display

CalculateVolatility  Price UsingSynthetic surface Data setSynthetic ▾ ViewChart  Table Maximum  Minimum  ATM (1Y)  25Δ RR (1Y)  25Δ BF (1Y)  RV 1M / 3M  Avg (absolute) 
Only Calibration Instruments

Calibration Parameters

Calibrate UntilMaturity of Deal ▾ Time Steps/Year200 Strike Steps400

Valuation Results

Valuation Date  Market Data  1) CalculatePrice (%) ▾ Funding Spread0.00 bp ModelLVLC - Local Vol Price (%)  Paths20000 PriceUSD ▾  
USDSGD Curncy   Loading market data…  

Fig 1.1 — During Maisie's tenure at Credit Suisse, her work was to diagnose issues with high-frequency trading systems to ensure accurate quotation of various equity and commodity positions. The window demonstrates a Bloomberg Terminal's DLIB<GO> function, displaying a local-volatility (LVLC) implied-vol surface for USD/SGD whose ATM term structure is bootstrapped from the annualized standard deviation of ECB daily log-returns, while the strike-axis smile and risk-reversal skew are synthesized and animated in real time.

Maisie is a researcher, this is her website

root@kali: ~/tools
FileEditViewSearchTerminalHelp
root@kali:~/tools# radare2 -s 0x32C24 -w apc_hw05_aos_640.bin
WARNING: bin_strings buffer is too big (0x002d6300)
[0x00032c24]> pd 16
0x00032c24bfefb90a00mov edi, 0xab9ef
.-> 0x00032c298bc1mov eax, ecx
| 0x00032c2b49dec ecx
| 0x00032c2c0bc0or eax, eax
`=< 0x00032c2e75f9jne 0x32c29
0x00032c30f6460640test byte [esi + 6], 0x40 ; [0x40:1]=5 ; '@'
,==<0x00032c347409je 0x32c3f
| 0x00032c36ba7affed80mov edx, 0x80edff7a
| 0x00032c3bccint3
| 0x00032c3c80eb07sub bl, 7
`-->0x00032c3fba7affed80mov edx, 0x80edff7a
0x00032c44e47fin al, 0x7f
0x00032c46ba7affef90mov edx, 0x90efff7a
0x00032c4b90nop
0x00032c4c90nop
0x00032c4d90nop
[0x00032c24]> s 0x00032c34
[0x00032c34]> pd 1
0x00032c347409je 0x32c3f
[0x00032c34]> wx 75
[0x00032c34]> pd 1
0x00032c347509jne 0x32c3f
root@kali: ~/tools
FileEditViewSearchTerminalHelp
root@kali:~/tools# binwalk -y 'base64' -y 'filesystem' apc_hw05_aos_640.bin
 
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
2606480 0x27C590 Base64 standard index table
2662655 0x28A0FF YAFFS filesystem
2667376 0x28B370 Base64 standard index table
2827400 0x2B2488 Base64 standard index table
2931752 0x2CBC28 YAFFS filesystem
 
root@kali:~/tools# binwalk -A apc_hw05_aos_640.bin | more
 
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
207876 0x32C04 Intel x86 instructions, nops
207946 0x32C4A Intel x86 instructions, nops
 

Fig 2.1 — During Maisie's tenure at Grab, verifying the binaries which will be deployed at scale both internally and externally became an integral part of her job. The first window displays a binary patch of a firmware signature check in radare2: seeking to 0x32c34 and writing opcode 0x75 over 0x74 rewrites JE to JNE, inverting the conditional so the validation branch is always taken. The second window displays signature-based firmware identification with binwalk, locating embedded YAFFS root filesystems and Base64 index tables by magic bytes and flagging Intel x86 NOP sleds through opcode-frequency heuristics.

tip: click a window and type — try help, ls, pd 8, binwalk -A apc_hw05_aos_640.bin

Maisie is a researcher, this is her website

IDA - CSAgent.sys.i64  (070242d1703d89b10ce3cc53e6e295cf07dbc2c1e4b3481156fb2530251444c8)
A▲● ▶❚❚■ ▾
Library function Regular function Instruction Data Unexplored External symbol Lumina function
▤ IDA View-A≡ Strings◉ Hex View-1◆ Local Types☰ Imports☰ Exports
Functions
Graph overview
cmp ecx, 6 jnz loc_1400E17DA
loc_1400E14C9: mov rdx, [r13+0] mov r9d, r10d cmp dword ptr [rdx], 4 mov rax, [rdx+8] mov r8, [rax+r11*8] ; R11: 0x14 ; RAX: buffer w/ pointers (0x14 is foo'barred) ; R8: unmapped invalid addr (e.g. 0xffff9c8e`0000008a) jnz short loc_1400E14E8 ; (likely) take
loc_1400E17DA: mov r9d, r10d mov rdx, [r13+0] cmp dword ptr [rdx], 4 mov rax, [rdx+8] jnz short loc_1400E1802
loc_1400E14E8: ; check R8 != NULL test r8, r8 jz short loc_1400E14F4 ; don't take
test r8, r8 jz short loc_1400E14F4
mov r9d, [r8] ; Faulting Instruction: 0xffff9c8e`0000008a is not paged in ✷✷✷✷✷
movzx r9d, word ptr [r8] jmp short loc_1400E14F0
loc_1400E14F4: mov [r13+8], r9d jmp loc_1400E1520
Output
100.00% (1694,3104) (867,7) 000E08D7 00000001400E14D7: sub_1400E11D0+307 (Synchronized with Hex View-1) AU: idle   Down   Disk: 148GB

Fig 3.1 — During Maisie's tenure at Traveloka, responding to incidents such as the CrowdStrike outage in 2024 became an integral part of her job. The window shows a disassembly of CrowdStrike's kernel-mode driver (CSAgent.sys) using IDA Pro, where the graph view demonstrates an out-of-bounds array index (R8 = [RAX + R11*8], R11 = 0x14) that resolves to an unmapped kernel address and faults on dereference, the page-fault pattern behind a ring-0 bugcheck.