Embedded426 STM32F401 Xbox One controller from “we have SWD” to a live CoreSight instruction trace. ETM and TPIU are programmed from OpenOCD, SWO…
Embedded460 Ryan Miceli (grimdoomer) dumps WD and Samsung drive firmware, debugs a live HDD over JTAG, hot-patches overlay RAM to stall DMA READ…
Exploit Development370 Joe Grand (Kingpin) reverse-engineered a real Ledger Nano X hardware implant for HARDWEAR.IO 2026 in Santa Clara. The add-on board does not…
Cisco498 Aaron Thacker jailbroke a Cisco C195 ESA by splicing a newer BIOS so CIMC came online, exploiting command injection in expRemoteFwUpdate (CVE-2024-20356)…
Exploit Development750 Every hardware security boundary on a modern x86 platform — SMRAM, the AMD PSP's private DRAM, the C6 save area, the live…
buffer overflow801 A complete hardware-to-firmware walkthrough of the Mercusys MB115-4G, the best-selling router on Amazon Spain: pre-purchase firmware recon, PCB teardown, UART pinout discovery…
Hardware632 Runic Labs dissects a QNAP QTS disclosure cycle — four bugs across three plugins (Notes Station 3, QmailAgent, QVPN) — and shows…
Android628 A complete walkthrough of attaching GDB to a running Android kernel on a physical Pixel 8 via KGDB: USB-Cereal UART wiring, custom…
Android634 Raelize B.V. researchers demonstrated a practical electromagnetic fault injection (EMFI) attack on Google's TV Streamer 4K, corrupting the MT8696 SoC's execution of…
Debug607 A first-principles deep-dive into dumping, analyzing, and patching hard drive firmware: Western Digital custom LZHUF decompression, Samsung SSD deobfuscation, JTAG debugging of…
Apple Silicon663 Apple Silicon's chain of trust hands the XNU kernel an SMMU/IOMMU configuration that iBoot builds once and the OS never re-verifies. An…
Hardware524 Quarkslab's black-box teardown of Xiaomi's undocumented MJA1 secure chip: I2C sniffing, SPI NAND flash dumping, MIPS firmware reverse engineering, full command protocol…
