I sent an e-mail to a professor that I did undergraduate research about 9-10 years ago wondering if he could write a letter of recommendation. He replied saying that he didn't think he would have anything meaningful to say, which is completely understandable. I didn't really do any publication with the undergraduate research, but I did something that he called a sanity-check, which was work on a coding assignment on developing a Distributed File System using FUSE. The idea was that if an undergrad can do it, then the grad students should be able to do it. 

He also asked if I submitted anything to him. I sent a reply on two e-books I published. One of the e-books was referenced in a Russian Defcon (I didn't write it in Russian). I also sent him a link to my blog. After that, I asked if he could be a Ph.D supervisor. 

I should have asked here before sending him the e-mail though. I'm not really sure if this is the appropriate way to go about finding a Ph.D supervisor.