About the logo

Download the animated GIF · View the static SVG

The YSoNet logo follows an object through serialization and deserialization: into the first portal as an object, across as data, and out of the second as a reconstructed object graph.

The different puzzle shapes highlight a possibility: reconstructed objects can have state that ordinary application construction would never produce. Depending on the serializer and types involved, deserialization may populate fields directly, bypass constructors and their validation, resolve types from metadata, or invoke callbacks and other code.

Gadget chains exploit existing code reachable through attacker-controlled types, state, or object relationships, during deserialization or later use. The danger lies in the behavior this enables, not simply in receiving a different object instance. An attacker may craft the data without ever creating an original object.

Reconstructing state can activate behavior.

Technical background

Microsoft documents constructor bypass and state assumptions, risks during callbacks and later use, and type-driven control flow in unsafe deserialization. See also YSoNet's security guidance.