Apple Silicon74 usbliter8: A BootROM USB Heap Underflow on Apple A12/A13 SecureROM
usbliter8 is a new BootROM exploit chain against Apple A12, S4/S5 and A13 SoCs. It chains a 12-byte buffer-underflow primitive in the…
Apple Silicon74 usbliter8 is a new BootROM exploit chain against Apple A12, S4/S5 and A13 SoCs. It chains a 12-byte buffer-underflow primitive in the…
kernel92 A deep technical walkthrough of how Windows on ARM (WoA) discovers, initializes and dispatches interrupts through the Generic Interrupt Controller (GIC) —…
Exploit Development57 A full-pipeline walkthrough: build a vulnerable Windows console program, take RIP with a strcpy overflow, then use rop_scanner — an offline ROP…
Reverse Engineering24 mrexodia publishes Striga: a deliberately small Python lifter that translates x86_64 instructions to LLVM IR using Capstone and a new set of…
Exploit Development62 Calif’s AI-assisted security team published a write-up of their FreeBSD kernel engagement: "15 bugs total" — 3 RCEs, 5 LPEs, 1 bhyve…
Exploit Development45 CVE-2025-61622 is an unauthenticated remote code execution in PyFory (formerly PyFury) 0.12.0–0.12.2 reachable through the library’s fallback path for unregistered types: "handle_unsupported_read()"…
Reverse Engineering58 A step-by-step walkthrough of reverse-engineering a Windows x64 crackme that XORs its input against a hard-coded 10-byte key before comparing it to…
Malware81 A practical walkthrough of using Ghidra and x32dbg to disassemble a Cobalt Strike beacon shellcode, identify the PUSH/CALL EBP hash-then-dispatch pattern, resolve…
Exploit Development45 Deep-dive writeup on a Linux kernel use-after-free in "fs/eventpoll.c". A 2023 optimisation traded a global "epmutex" for per-instance reference counting in epoll’s…
Hardware61 Open-source FPGA recreation of Intel’s 80386 that runs the original recovered Intel microcode rather than re-implementing instruction behaviour from scratch. The result…
Escalation29 A full walkthrough of CVE-2024-27398, a race-induced use-after-free in the Linux 6.8 Bluetooth SCO subsystem. The exploit races two connect() threads on…
Bypassing50 A walkthrough of klezVirus' "Callback hell" — a technique that hides callback frames from stack inspectors by combining tail-calls, forward and backward…