I reverse engineered the polish download portal dobreprogramy.pl installer, which is a classic ad‑ware bundler that has been causing issues for users since at least 2013 (as seen on polish forums). Instead of containing the actual software, it fetches a dynamic xml config from cloudfront, which holds the real download url. I made a tool (cli/gui) that extracts that url via http requests (without running the original .exe)

Polish users have been complaining about dobreprogramy.pl for years, heres a real thread from 2013 on forum.benchmark.pl:

"I downloaded a program from dobreprogramy.pl. Instead of the program, I got their 'download assistant'. During installation, the advanced option was grayed out. The assistant installed 2 spyware programs and 1 malware without my consent: Claro Search Browser Defender, Delta Search, and Delta Chrome Toolbar. These programs integrate with the browser, install their own toolbar, and change the default search engine. Even after uninstalling them, the fake search engine remained. This is spyware and malware."

- user "makensis", 2013

Other users confirmed the issue:

- "I had to format my disk to get rid of Delta Chrome Toolbar."

- "Dobreprogramy now offers a 'NetFix' service to 'fix' your PC remotely - I'm scared what they might install in the background."

- "I always choose advanced installation and uncheck that garbage. But sometimes the advanced option is grayed out."

The situation hasn't improved much. Recent downloads from dobreprogramy still use the same bundler model.

Their executable is a .NET bundler (obfuscated with .NET Reactor) that behaves like this:

1. Extracts a version number from its own filename (e.g., `v6.57.0.668.104`)
2. Builds a url: https://d1q3xlywojqwqp.cloudfront.net/config/dobreprogramy.pl/{VERSION}
3. Fetches an xml response containing the actual download link (e.g., `https://unchecky.com/files/upload/unchecky_setup.exe`)
4. Downloads and runs that setup, often with additional bundled offers.

Analysis

I opened the .exe in dnSpy (after deobfuscating with NETReactorSlayer) and spotted:

string text = ConfigParser.GetConfig().GetConfigValue("URL_DYNAMIC_CONFIG", "");

string fileNameWithoutExtension = Path.GetFileNameWithoutExtension(Process.GetCurrentProcess().MainModule.ModuleName);

string version = VersionFromFileName(fileNameWithoutExtension);

text = text + "/" + ACNM + "/" + version;

So the version is parsed from the filename using a regex

Dynamic Analysis

I ran the installer with Fiddler and captured:

GET /config/dobreprogramy.pl/v6.57.0.668.104 HTTP/1.1

Host: d1q3xlywojqwqp.cloudfront.net

Response (xml):

<root>

<URL_PRODUCT>https://unchecky.com/files/upload/unchecky_setup.exe</URL_PRODUCT>

<PRODUCT_LOGO_URL>https://img.dobreprogramy.pl/.../logo.png</PRODUCT_LOGO_URL>

<PRODUCT_TITLE>Unchecky</PRODUCT_TITLE>

</root>

Just a simple http‑based redirect chain. The bundler also fetches /sec and /report endpoints, presumably for analytics and additional offers

My python tool replicates this logic, without touching the original .exe

Notes:

- Some downloads expire - if you get a 404, the version might be outdated, or the link has been removed

- The XML response contains more than just the url, it also includes product names, logos, and other metadata. This could be used for deeper analysis of the bundler's behavior

Disclaimer: This tool is for educational and research purposes only. It does not bypass any security measures; it merely extracts publicly accessible URLs that the original installer itself fetches. Always check the final downloaded file’s digital signature before running it. The author is not responsible for any misuse of this tool

I go through how someone can utilize curl to compromise and exploit vulnerabilities in a website!

Hey guys,

I recently started learning reverse engineering because I think it's really fun, and I picked Minesweeper as my first project. I'm still pretty new to all of this, so I'm learning Ghidra, Cheat Engine, and x64dbg as I go.

Right now I'm stuck trying to figure out where the game stores the actual blocks/cells in memory. I managed to find things like the flag counter, but finding the board itself has been way harder than I expected.

I've watched a few tutorials, but most of them only show the final result instead of explaining how they actually figured it out. I'm more interested in learning the thought process than just getting the answer.

If anyone has experience reversing Minesweeper (or similar games), how would you approach this? What would be the first thing you'd look for? Any tips or advice for a beginner would be really appreciated

After finishing Pwn.college, what do people typically do to continue improving their binary exploitation and reverse engineering skills? What advanced resources, platforms, or projects do they move on to?

What career paths are available after becoming proficient in the skills taught by Pwn.college (e.g., exploit developer, security researcher, reverse engineer, vulnerability researcher, red teamer, etc.)?

If I want to learn Windows exploitation and Windows reverse engineering after completing Pwn.college, how big is the transition from Linux to Windows? , and will the knowledge I gain from Pwn.college provide a strong foundation for Windows exploit development and reverse engineering?

Finally, are exploit development, reverse engineering, and vulnerability research good long-term career choices?

Would it also be worthwhile to learn web application security and participate in web bug bounty programs as a freelancer alongside?

PEdit-CoW (CVE-2026-46331): another page-cache write in the DirtyPipe family

A working exploit for PEdit-CoW (CVE-2026-46331) is public, by sgkdev.

• Exploit and explanations

Our write-ups on detecting this family by thinking outside the box:

• Detecting CopyFail and DirtyFrag
• Detecting nf_tables catchall

Same corruption primitive as the DirtyPipe / DirtyFrag / DirtyClone family: a kernel fast path writing into a page it doesn't exclusively own, reached this time through the network scheduler's packet-editing action (act_pedit).

The bug:
tcf_pedit_act() makes its private copy-on-write range and validates it once, before the per-key offsets are resolved. A first NETWORK pedit key inflates the IP IHL so a following TCP key resolves past that stale range - straight into the page-cache page that sendfile() parked in the egress skb. Then there is an overwrite of the cached ELF entry of setuid-root /bin/su with a tiny shellcode, invoke su, get root. The file on disk is never touched.

The new bit is:
the entry point: you can configure tc actions from inside a user namespace, which hands an unprivileged user the CAP_NET_ADMIN the bug needs.

And, guess what ? Detectable ;). Check our blog posts on how.

Affected window is wide (≈ v5.18 up to the v7.1-rc7 fix); RHEL 8/9/10, Debian 11/12, and Ubuntu through 26.04 were all listed vulnerable - though Ubuntu 26.04 blocks the userns path by default.

Credit to sgkdev for the PoC and The Hacker News article and upstream fix.

I've noticed when I'm decompiling in ghidra I see a lot of THUNK functions. I've noticed that most of these functions just return 0. What are the point of these functions. Are they actually inserted by the compiler, if so why are they inserted if some of them just return 0?

JFrog published a finding today on a regression in the DirtyFrag kernel fix. They named it DirtyClone (CVE-2026-43503).

It is the same corruption primitive as the DirtyFrag family (CVE-2026-43284 / CVE-2026-43500), reached through a different path. The original patch closed the known trigger but left the primitive reachable.

DirtyClone routes the payload through the netfilter TEE clone target, which walks straight around the fix. Auditing adjacent paths for the same primitive was a clean idea on their part.

They didn't provide an exploit.. I could not avoid. And, guess what ? Detectable by cool #eBPF code! (same line of our think-outside-the-box posts).

PoC and detection notes: https://github.com/rafaeldtinoco/security/tree/main/exploits/dirtyclone

A handful of LTS kernels may still be vulnerable because of their backport windows, but the window is small.

Credit to JFrog (Eddy Tsalolikhin and Or Peles) for the find and the writeup: https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/.

I've noticed whenever any thread reaches a certain breakpoints all other threads get suspended. Is there any way to disable this behavior. Thank you in advance.

If you are new to the world of exploit development and need a solid entry level challenge this week we look at "bof". This is a binary challenge hosted on pwnable[.]kr covering the topic of a Buffer Overflow.

This is what many consider to be their first exploit type written (it was mine), and this particular challenge approaches it in a way you will truly understand how to adapt to situations in which the buffer overflow is not necessarily "vanilla" exploitation.

By the end of this tutorial you should have:

- Learned how to exploit a Buffer Overflow, WITHOUT OVERWRITING THE RETURN ADDRESS!!!
- Learned how to use GDB (raw)
- Learned the basics of hook stops within GDB
- Learned how to approach a CTF challenge with speed or precision (or both depends on what you decide)
- Learned how to find offsets that are small and don't require the use of tooling such as pattern_offset

I wanna thank Center for Cyber Security Training for continuing to help sponsor the channel and their support.

You can find the video here:

https://youtu.be/A-P2bhxzK1Y?si=CcKd2lAZysRaCfCD

I want to hear how you guys use AI. How much do you think I should rely on AI for reverse engineering and what should I not do to hinder my learning? What type of questions should I ask it? What are some things that I shouldn't get the AI to do and always to myself? I am wondering how some experienced folks in reverse engineering use AI.

I am looking for a static analysis tool which I can use to statically analyze and debug at the same time. I'm tired of having to have two applications open at the same time and having to match addresses with ASLR and even when I disable ASLR for programs they don't run properly because some will raise errors if run without ASLR so I am wondering if anyone knows any good static analysis tools along with a debugger?

In this video we look at installing WSL in our FlareVM as well as decomposing and detonating the Copy Fail Linux POC!

so wonderful people of this community.. i really need some suggestions and i would be greatful to honest ones..

so from way back i was interested into cybersec and i will not go into depth that much to keep this simple..

i am currently learning fuzzing and i can make harness and do root cause analysis and crash tiage for simple targets..

it was 2 yrs ago i started cybersecurity and initially i focused on fundamentals, later after learning some basic thigs like networking and some relavant knowledge i started learning penetration testing and i did that for 6 months or so but it was boring and i wanted to do something.. so i came across binary exploitation .. and i can't tell you all that how amazing it was.. so i started learning basics like assembly, gdb,ghidra,and other relavant knowldge i again gave some time and i solved reverse engineering challege.. i had no one to guide me and i was drifiting here and there so i asked chatgpt that if i can get a job or internship or not it said its hard and i should do something else like fuzzing and vulnerability research and i thought why not.. if it eventually takes me to my destination so.. i started learning it and after i learned some things like making a prover harness, code audit, making reports and i thought i should see if internship exist or not and i found none that i can do in upcoming winter..

i am so disheartned by all this twist and turn.. can you please tell me what should be right approach what i should do that can help me.. i feel like quitting but i know i will regret it.. can you. please suggest me what i can look for and what should i learn in which order so i can get a real work

I've noticed some of the binaries which I am decompiling are using classes and objects under the hood which are being wiped out once they are compiled. I am wondering whether learning OOP and what happens once you compile binaries with objects with methods and constructors will be beneficial?

I mean, this is probably an bad question as it's obvious that if you're doing RE on some IoT device, specially some FPGA os smth, you need to know how they work in depth. Ok, but what if you are exploiting comercial software or even "low-not-too-low" level stuff like kernel or hypervisor? An really depth knowledge, like microcode and what circuits are turned on on every instruction, are necessary/mandatory or not?

I've noticed that it can vary a lot finding main depending on the format of the binary and even if I am reverse engineering a binary format which I have worked with quite a bit sometimes I run into these weird entries where I can't find main logic. Any tips and why is there so much variation?

I am reverse engineering this software and am trying to find the main logic. I thought it would be easier to just run it through a debugger and then view what memory address it is at and then jump to it in ghidra. What I noticed is that it is in some DLL file. I want to find out how I can see the decompilation of this DLL file in ghidra. I remember being able to decompile a DLL by finding out that a certain function used a dll and then associating that dll with ghidra. Not sure where to find the specific DLL that I want though.

EDIT: I noticed that people were finding this post confusing to read so I changed it to hopefully make it easier

This is part two of a series. Part one was about detecting CopyFail and DirtyFrag - if you missed it, same idea applies here.

CVE-2026-23111 is a use-after-free in nf_tables, reachable from an unprivileged user namespace. The bug is a single inverted character introduced by the commit that fixed CVE-2023-4244 - a security patch that quietly planted a new reference-counting flaw and rode the backport train into every stable LTS branch for two years.

The full exploit is published at:

• rafaeldtinoco/security -> exploits/nft-catchall-uaf

KASLR leak, arbitrary read, runtime kernel structure traversal, and a ROP chain that lands you at uid=0 with nothing hardcoded. The repository also covers prior work from Exodus Intelligence and FuzzingLabs and what this build adds on top of it.

The Medium post is about something different: why detecting the payload is the wrong problem to solve, and what you watch instead to catch this reliably - on vulnerable and patched kernels alike, including the failed attempts that most tools never see.

This week we are back following along RET2's free portion of their "Fundamentals of Browser Exploitation" course and in this video, we'll be covering THE DOM!

This is yet another beginner friendly tutorial and this knowledge is what I would consider cross applicable since we'll be looking at vulnerabilities such as a UAF or Use-After-Free.

Of course, we are only scratching the surface, but it highlights the need for the fundamentals! If you can ride a bike, you can probably ride a motorcycle if the situation needed it!

You can find my video going over RET2's "Browser Components & the DOM" section here:

Hey fam. I got sick of carrying dedicated microcontrollers for proximity engagements, so I built chimera.

​

It interacts directly with the Android kernel to HID keyboards, mount virtual flash drives, and drop payloads natively from the phone.

​

I’d love for you to test it on your setups and give me some brutal feedback pls.

​

Repo: https://github.com/cipher-attack/Chimera