EDR484 SyscallRevenant: Clean Indirect Syscalls with Trap-Flag Tracing
Clean indirect syscalls on Windows x64. It single-steps a hooked ntdll stub with the CPU trap flag to learn the live System…
oxfemale·
Oct 19·
31 min
·484
// Reverse Engineering
76 postsEDR484 
Exploit Development534 CVE-2026-23866: Finding a Whatsapp NDay
CVE-2026-23866 described incomplete validation of WhatsApp AI-rich Instagram Reel messages that could make another device fetch an arbitrary URL. numb3rs used only…
oxfemale·
Oct 16·
21 min
·534
Embedded425 Following the Instructions: Live ARM Tracing with the ETM, ITM, and TPIU
STM32F401 Xbox One controller from “we have SWD” to a live CoreSight instruction trace. ETM and TPIU are programmed from OpenOCD, SWO…
oxfemale·
Oct 16·
30 min
·425
Cisco667 Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504)
Cisco published CVE-2026-76504, a critical authentication bypass in Catalyst SD-WAN Manager. Landon Rice at VulnCheck showed that a single percent-encoded POST to…
oxfemale·
Oct 14·
25 min
·667
Embedded459 HDD Firmware Hacking Part 1
Ryan Miceli (grimdoomer) dumps WD and Samsung drive firmware, debugs a live HDD over JTAG, hot-patches overlay RAM to stall DMA READ…
oxfemale·
Oct 14·
36 min
·459
Exploit Development370 Reverse Engineering a Ledger Nano X Hardware Implant
Joe Grand (Kingpin) reverse-engineered a real Ledger Nano X hardware implant for HARDWEAR.IO 2026 in Santa Clara. The add-on board does not…
oxfemale·
Oct 13·
27 min
·370
Command Injection1.2k Telegram Desktop: one-click account takeover via IPC injection
BeakSec's CVE-2026-107181: Telegram Desktop through 7.2.8 handed clicked links to the running instance over a local socket and never escaped the semicolon…
oxfemale·
Oct 9·
43 min
·1.2k
AnyDesk405 AnyPwn: AnyDesk Linux 8.0.2 Pre-auth Heap Overflow RCE
AnyPwn is a pre-approval remote code execution bug in AnyDesk Linux 8.0.2. The session protocol's mode-5 handler trusts a remote payload length,…
oxfemale·
Oct 9·
30 min
·405
kernel1.2k Static Devirtualization of Tencent VM: ACE Kernel Drivers, CET, SEH, and Guided Symbolic Execution
Aftermath Labs statically recover 815 of 865 Tencent-VM virtualized functions across four ACE kernel drivers (94.2 percent). Architecture, CET RDSSPQ/INCSSPQ, phantom SEH…
oxfemale·
Oct 2·
41 min
·1.2k
Machine Learning473 From P-Code to GNN: Extracting Binary Code Semantics
Quarkslab’s pcode_graph lifts functions to Ghidra P-Code CDGs and a GINE embedding that matches GMN (AUC 0.87 XM) on Cisco-Talos, across ISA,…
oxfemale·
Sep 14·
15 min
·473
iOS Security508 How Can You Not Be Romantic About UNIX Domain Sockets: A 40-Year Kernel Bug From the DEF CON Stage
Yuval Hanoch Hirschenbein Sadde traced a DEF CON 34 demo crash to one character in XNU: unp_ino++ assigns inode 0 to the…
oxfemale·
Sep 9·
18 min
·508
Malware798 SLEEPWALKER: A Passive Backdoor With Its Own Command Language
SLEEPWALKER is a passive Windows backdoor that never beacons, opens no listening port and carries no payload. It side-loads into ESET Management…
oxfemale·
Aug 27·
64 min
·798