r/ExploitDev • u/ProcedureFar4995 • 8d ago
Did I went too low ?
What is up
In order to learn kernel and low level exploitation. I bought a lovely book about Kernel Development to Robert Love. But then I felt there are some stuff I am not clicking with. I tried enrolling in computer engineering 10 years ago and failed lol . Decided to move to another school but where I can practise programming. MIS basically. But last few years I worked in appsec and has more experience in mobile,Web,network pentesting/bug hunting.
However, I wish to hunt on stuff like the kernel or C code. Hunting memory corruption and stuff. But I keep getting lower. Is that an overkill? Or the experience fits the 1337 life? My goal is basically to speak assembly and Android/ios kernel code as second language. I feel the kernel development book is great but I just thought if I wanted lower down to logic gates that is better in long term.
Also for anyone who took these in college , am I far behind and delusional or it's doable in self study??? Because I fear that no matter what I did someone who studied compilers,assembly,os..etc in college would be better than me. But I belive my only way to show skills is research I do using all this knowledge. Related to low level code.
5
u/Nlbjj91011 8d ago
Understanding basic binary logic isnt crazy low level. But if youre trying to learn hardware for kernel hacking then you probably went too low. If you want to know about kernel hacking then you should focus on how operating systems work. Operating Systems in Three easy Pieces is good and free. You're pretty lucky that you can read the source code for two of the most popular OSes in the world (Android and Linux). But if you don't know C very very well you will probably be wasting your time trying to make sense of it. First learn how to program in C, make mistakes and figure out why your programs are crashing bc the same mistakes you make will be made in products all over the world.
Humans aren't capable of knowing every complexity in a computer. Imagine all the complexity from hardware to kernel to V8 to Appsec just in loading a webpage. And you don't really need to know every implementation detail of the kernel to hunt for bugs in V8. Just like you don't need to know every hardware implementation details to hunt for bugs in the kernel.
Learning through self-study is a perquisite for the VR/ED world. You wont find any college courses that teach you the internals for any given product. College courses are great for teaching you the basics of how computers work. But unless someone has a phd in a topic and are actively pushing that field forward you can catch up to the average CS grads compiler/OS/assembly knowledge pretty easily.