Start a project

EFLAGS.TF = 1 · single-step mode · #DB armed

Systems software, built from the reset vector up.

We write the code that runs before everything else: bootloaders, kernels, firmware, drivers and the toolchains that build them. Then we step through it, one instruction at a time, on emulators and on real iron.

Start a project
See the lab work

0x10Every ring, top to bottom

We work wherever the abstraction ends. Capabilities, sorted by privilege level, most privileged first.

Ring −2

Firmware & boot

UEFI applications in PE32+, BIOS MBR loaders, GRUB/Multiboot hand-off, Secure Boot signing, and GPT/ESP layouts that survive real vendor firmware.

  • UEFI
  • Multiboot2
  • Secure Boot

Ring −1

Virtualisation & test rigs

QEMU, OVMF and Firecracker harnesses that boot your image in BIOS and UEFI modes, inject packets and scancodes, and fail loudly instead of passing quietly.

  • QEMU
  • OVMF
  • Firecracker

Ring 0

Kernels & bring-up

Long-mode entry, paging and higher-half VMM, physical allocators, APIC SMP with INIT/SIPI trampolines, interrupt routing and scheduling.

  • x86-64
  • SMP
  • VMM

Ring 0

Drivers & devices

PCI/PCIe enumeration, MSI-X and DMA descriptor rings. Storage over AHCI and NVMe, networking over E1000 and VirtIO, input over PS/2 and xHCI.

  • NVMe
  • xHCI
  • VirtIO

Ring 0/3

Security research

Reverse engineering of binaries, firmware and Windows drivers. Privilege-boundary review and SMEP/SMAP and W^X hardening.

  • RE
  • Drivers
  • Hardening

Ring 3

Languages & toolchains

Assemblers, metacompilers, JITs and FFIs. Self-hosting bootstraps that rebuild themselves from a handful of primitives.

  • Forth
  • Rust
  • ELF
fig. 1 — probe on header, LED on POST code. Where most of the work actually happens.

0x20Single-step method

01 · TRAP

Observe first

Before touching code we instrument it: serial telemetry, POST codes, exception dumps. You cannot fix a boot path you cannot see.

02 · STEP

Isolate the instruction

Reproduce in emulation, then bisect down to the register, the descriptor or the byte offset that is wrong. One cause, named precisely.

03 · VERIFY

Emulator, then iron

Harnesses boot BIOS and UEFI paths in QEMU and OVMF, then we confirm on physical hardware. A pass in QEMU is a hypothesis, not a result.

04 · SHIP

Qualify the artifact

Signed images verified with the public key, checksums recorded, every skipped test reported as skipped.

A green build is not a qualified artifact.

— house rule #1

dmesg | tail

Write-ups from the bench. Each one is a bug that cost an evening and taught something worth keeping.

  • Hello world!

    Welcome to WordPress. This is your first post. Edit or delete it, then start writing!

0x28Raise an interrupt

Bringing up a board, stuck at a black screen, or need someone to read a driver nobody else will? Tell us where it hangs.

info@trapflaglabs.io

Based in Northern Ireland. Working with teams anywhere a JTAG cable can reach.

INT 0x01

Bring-up sprint

A fixed-scope push to get your image from reset to a working console on target hardware.

INT 0x03

Breakpoint review

An audit of a boot chain, driver or privileged component, with a written findings report.

INT 0x80

Embedded engineer

A senior systems engineer inside your team for kernels, firmware or toolchain work.