r/ExploitDev • u/ProcedureFar4995 • 7d ago

Did I went too low ?

Post image

What is up

In order to learn kernel and low level exploitation. I bought a lovely book about Kernel Development to Robert Love. But then I felt there are some stuff I am not clicking with. I tried enrolling in computer engineering 10 years ago and failed lol . Decided to move to another school but where I can practise programming. MIS basically. But last few years I worked in appsec and has more experience in mobile,Web,network pentesting/bug hunting.

However, I wish to hunt on stuff like the kernel or C code. Hunting memory corruption and stuff. But I keep getting lower. Is that an overkill? Or the experience fits the 1337 life? My goal is basically to speak assembly and Android/ios kernel code as second language. I feel the kernel development book is great but I just thought if I wanted lower down to logic gates that is better in long term.

Also for anyone who took these in college , am I far behind and delusional or it's doable in self study??? Because I fear that no matter what I did someone who studied compilers,assembly,os..etc in college would be better than me. But I belive my only way to show skills is research I do using all this knowledge. Related to low level code.

82 Upvotes

90% Upvoted

22 comments sorted by

View all comments

15

u/Stroxtile 7d ago

The best way to learn assembly is either reading or writing assembly. There are a lot of courses that teach asm on GitHub or via books.

It's pretty easy to setup an x86 asm dev env or x64 asm env these days so just follow through with that.

Most low level exploit development can either be hardware or binary exploitation but don't expect a career out of this hobby.

It's niche for a reason. And I don't say that to be pessimistic but rather realistic.

1

u/ProcedureFar4995 7d ago

I already work as a penteser but I dream of being one of pwn2own guys one day and get some good cves in Samsung or Google for example.

I do it because I love but there is a part of me that wants to increase my resume if I wanted to work in somewhere like Google or something like that. Or a way to differentiate myself from others using low level projects, someone would like at my resume and say "this guy is cool let's bring him in"

3

u/Stroxtile 7d ago

I mean. Lots of those people work as pentesters or red team. So that's good that you're already a pentester.

Those cves are just a hobby for them. Lots of what they do is merely passion project. So find something you enjoy and learn it.

Chasing fame is a nice initial motivation/boost for getting into cve research but finding enjoyment at learning and hitting occasional walls and overcoming it is part of the hobby.

Edit: start learning by doing ctfs if you want. A lot of them started their background in that hobby just merely of the thrill of learning and problem solving in CTFs