A local experiment with vulnerability detection, fine-tuning, prompt/context design and ensemble methods.

A four-byte type, an eight-byte stride, one root shell.

Linux kernel page-cache poisoning via AES-256 chosen-plaintext on the RxGK RESPONSE path and why authenticated encryption did not stop it.

Do you know how a hard drive works? Come find out with me as I dump, reverse engineer, and modify the firmware on various HDDs and SSDs.

This article demonstrates devirtualization of CodeVirtualizer/Themida protected code, however the techniques described here apply to pretty much every virtual machine based obfuscator. Only requiring ...

Exploiting TP-Link Home Security Smart Cameras

Software-only KernelSnitch side channel plus cross-cache reuse leaks heap KASLR (msg_msg/pipe_buffer) across Linux environments and Android.

Claud Code is a force multiplier when performing secure code reviews during an assessment. In this post, we discuss how to leverage Claude Code to produce digestible output that helps up better unders...

Let’s explore ways to mod a Tapo C200 Rev.5 firmware in order to gain root access to a running device.

Awesome Large Language Models for Vulnerability Detection - huhusmang/Awesome-LLMs-for-Vulnerability-Detection

Resources to getting started vulnerability research on IoT/embedded devices. - IamAlch3mist/Awesome-Embedded-Systems-Vulnerability-Research

A step-by-step guide to exploiting a 20-year-old bug in the Linux kernel to achieve full privilege escalation and container escape, plus a cool bug-hunting heuristic.

One of the inspirations for my work on the System Register Hijacking paper was this blog post by Project Zero written by Andrey Konovalov. In the blog post he describes a method of bypassing SMEP/SMAP...

Exploiting and jailbreaking Xiaomi Home Security Smart Cameras

PageJack is a Linux kernel exploitation technique useful to generate a Use After Free (UAF) in the page allocator. In this article we provide a detailed example of how to use it to exploit a Linux ker...

Cybersecurity oriented awesome list. Contribute to 0xor0ne/awesome-list development by creating an account on GitHub.

Vulnerability detection framework by Binarly's REsearch team - vulhunt-re/vulhunt

A step-by-step guide to exploiting a 20-year-old bug in the Linux kernel to achieve full privilege escalation and container escape, plus a cool bug-hunting heuristic.

TL:DR; SCOM suffers from similar insecure default configurations as its SCCM counterpart, enabling attackers to escalate privileges, harvest credentials, and ultimately compromise the entire managemen...

Workshop on firmware reverse engineering. Contribute to emproof-com/workshop_firmware_reverse_engineering development by creating an account on GitHub.

In October 2025, we performed a security assessment of the ARM-based Moxa UC-1222A Secure Edition industrial computer.

Binary Ninja is a modern reverse engineering platform with a scriptable and extensible decompiler.

Trusted Execution Environments (TEEs) based on ARM TrustZone form the backbone of modern Android devices' security architecture. The wor...

Ten years ago, we published a Clang Hardening Cheat Sheet. Since then, both the threat landscape and the Clang toolchain have evolved significantly. This blog post presents the new mitigations availab...

Cybersecurity oriented awesome list. Contribute to 0xor0ne/awesome-list development by creating an account on GitHub.

The Target: Brother MFC-J1010DW Affected Models: Brother Printer MFC-J1010DW Vulnerable Firmware: Version <= 1.18 TL;DR: The Vulnerability Chain We discovered three vulnerabilities that when chained...