Join me in this presentation and stream where we'll take a look at some data around binary exploitation, offensive and adversarial AI, and vulnerability research utilizing Artificial Intelligence (AI) and Machine Learning (ML). We'll look at challenges around…

In this in-depth guide, uncover the technical strategies behind full spectrum ETW detection in Windows kernel. Discover how innovative methods in Sanctum EDR thwart rootkit evasion techniques.

Full Title: Buccaneers of the Binary: Plundering Compiler Optimizations for Decompilation Treasure
Slides: https://github.com/mahaloz/talks/blob/main/2025/REverse_SAILR/REverse_SAILR_talk.pptx

Zion's talk is both a challenge for decompilers to step up their…

REcon 2024 Repo, slides for talk "GOP Complex: Image parsing bugs, EBC polymorphic engines and the Deus ex machina of UEFI exploit dev"" - ic3qu33n/REcon2024-GOP-Complex

A few weeks ago, Copycat sent me an email asking if I knew anything about the TNT warez group macOS cracks. They were worried that the cracks could be used to leverage malware since TNT is (?) Russia based. Cyber war is real and this could be an interesting…

Automated AI Malware Reverse Engineering with MCPs for IDA and Ghidra

Full VIBE RE livestream 🏝️

Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.

cybersecurity blog about penetration testing, red teaming, blue teaming, and things.

Event Tracing for Windows (ETW) is a kernel mechanism designed to log certain activity happening in the system. Despite its seemingly innocuous description, ETW can be a valuable source of information and a very interesting hook point for both anti-cheats…

For the first time, JTAG debugging tools for x64 are available to the general public. Using EXDI to connect WinDbg with the SourcePoint debugger, and Intel Direct Connect Interface (DCI) on the AAEON UP Xtreme i11, Windows Hyper-V and Secure Kernel can be…

Write-up - Sec Mem This is the write-up for the challenge Sec Mem which is an AARCH64 pwn kernel challenge I created for midnight flag CTF 2025 quals. It involves bypassing PAC in the Linux kernel.
Description During your quest, you come across a machine…

This writeups discusses the implementation of a Proof of Concept exploit for a vulnerability discovered in Node.js by a team in Sonar.

Ever seen a binary that looks like a .NET binary based on its strings, but .NET decompilers are not able to open them?

Learn how broken access and Null Pointer Dereference were found in the macOS IOMobileFramebuffer (AppleCLCD2) driver.

In 2013 a catalogue of intelligence gathering capabilities from NSA's ANT (Advanced Network Technology) was leaked online, unrelated to the E. Snowden leaks. One of the hardware implants mentioned there was FIREWALK, which was designed to be able to infiltrate…

A powerful, modular, lightweight and efficient command & control framework written in Nim. - hdbreaker/Nimhawk

In this article we describe a basic deobfuscation technique by leveraging a code snippet substitution.

eBPF-based lightweight debugger for Android. Contribute to ShinoLeah/eDBG development by creating an account on GitHub.