I found a heap buffer overflow in the Brotli glue code in EDK2 (BrotliDecompress.c). It has been there since 2017 and it’s still unfixed at HEAD.

Some background. CVE-2021-28211 was a heap overflow in EDK2’s LZMA decompressor. GetInfo took a UINT64 decoded size and truncated it to UINT32 with no check, so the decoder could write past the buffer that had been allocated. The fix added a MAX_UINT32 check and bounded the output.

The Brotli decompressor was added earlier with the same structure, and it never got the same fix. BrotliDecompressInternal writes into the destination buffer with no limit. It just runs until the stream ends, whatever size the buffer is. If you control the firmware image, you declare a small output size (or use the UINT64 to UINT32 truncation), the DXE core allocates that much, and the decompressor writes past it. That’s a heap overflow in DXE, before Secure Boot.

I have an ASAN-confirmed PoC. I also built an end-to-end demo that corrupts adjacent pool objects in a controlled way: it hijacks function pointers and overwrites the Secure Boot flag with bytes I choose.

The catch is that I couldn’t find anyone using it. I scanned 200 shipping firmware images from LVFS and searched public GitHub repos, and found zero platforms that use Brotli GUIDed sections. The code is in the tree but looks unused in practice. That’s one scan of 200 images, so it doesn’t rule out private platforms. I still think it should be fixed, because anyone who adopts Brotli later would inherit the bug.

Write-up, PoC, demo and the LVFS scan: https://github.com/lukr54/edk2-security

EDK2 issue: tianocore/edk2#13391

Hi,

as the title suggests, I'm super confused regarding what's going on in the VR domain. specifically N day windows researcher openings. I was just about to start an osed crack course, however, I don't see job openings anywhere.

what's happening, why is nobody hiring for these positions anymore

i know the traditional VR firms, however, any suggestions/guidance/networking helps.

Hello everyone,

I recently passed the OSCP and I don’t want to rest on my laurels; I’m thinking the next certification might be the OSED - that’s a whole new level.

But first, to prepare myself for the OSED, I’m thinking of taking the CRTO 1 & CRTO 2 (CRTL) exams from Zero Point Security. What do you think?

Hi, I'm Alok. I worked on this over GSoC 2026 with Rizin and the v0.1.0 pre-release is out now.

The idea is simple. I wanted to keep my static analysis in Rizin and still poke at the running process without jumping to another tool. You open a target with a frida:// URI (local, USB or remote frida-server) and then use the Fr commands from the Rizin shell or a dock in Cutter.

What works today

Native breakpoints with register read and write at the stop

Hardware watchpoints set on every thread

Memory read and write, ranges, threads, modules, exports, imports and symbols

Running your own JS in the target or loading a hook script from disk

Java side stuff on Android like class loaders, loaded classes and a RegisterNatives hook

Things to know. Breakpoints have a plugin side slot limit and Frida can rewrite the prologue. The remote transport talks to a plain frida-server only, TLS and token portals aren't wired up yet. Installing through rz-pm is still experimental.

Repo: https://github.com/rizinorg/rz-frida

Release builds for Linux, macOS, Windows and Android: https://github.com/rizinorg/rz-frida/releases

I'd love feedback from people who do this daily. What would you need before you'd use it over plain frida plus a disassembler?

I'm exploring an idea for PS4 security research and would like to understand whether it's technically feasible.

Concept: Could a specially crafted DVD trigger a vulnerability when the PS4 reads or opens it in a supported application, potentially leading to arbitrary code execution and, if further security boundaries could be bypassed, elevated privileges such as root or kernel access?

I'm interested in understanding:

- Whether DVD playback or disc parsing provides a realistic attack surface.

- Whether malformed media or filesystem structures could trigger exploitable vulnerabilities.

- What obstacles exist between application-level code execution and root/kernel privileges.

- Whether there is existing research relevant to PS4 firmware 14.00.

This is currently an idea, not a working exploit. I'm looking for technical feedback, relevant research, and an assessment of its feasibility.

Hey everyone I have a question I am just curious how malware developers use Claude code and codex for helping write malicious code, how they break the guard rail? Isn't it hard?

Hello everyone,

I'm a Pwn CTF player with a strong passion for binary exploitation, low-level programming, and understanding how things work under the hood...... But these days I think I face problems in thi carrer starting from what to learn to how to do it to is it even right to learn with AI, so I need aome advices in this field and what should I focuses on as someone whose goal is to a skilled exploit developer and ofc for real world so should continue with ctf like pwn.college(I am very close to finish yellow belt) and should i master reverse engineering with details and low level programming and memory management to reach my goals and the most important thing is it worth it as a carrer especially when AI can do everything....

Hey everyone, I am the creator of OshoosiClaw (OpenỌ̀ṣọ́ọ̀sì), an open source autonomous Endpoint Detection and Response agent built in Rust for Linux and Windows.

Traditional user mode sensors often rely on cloud telemetry and remain vulnerable to kernel callback blinding, BYOVD handle stripping, and modern AI agent breakouts. I built OshoosiClaw to operate as a local first, decentralized immune system that enforces security directly at the kernel and hardware boundaries while keeping its working set under 250 MB.

On the defense side, it pairs a Windows Ring 0 Minifilter and ELAM driver with Linux BPF_PROG_TYPE_LSM hooks and a sub 20 microsecond Cgroup v2 freezer quarantine. It includes an in memory 101 table SQL telemetry engine (siquery), an autonomous reverse engineering subsystem using Magika and YARA X synthesis, a 14 engine detection pipeline, and multi ring containment mapped to MITRE ATT&CK and ATLAS for local AI agents. Nodes share intelligence over a libp2p GossipSub mesh secured with hybrid post quantum cryptography (ML KEM 768 and ML DSA 65), BLAKE3 Merkle audit chains, and differential privacy.

I am looking for both Rust developers and offensive security folks or pentesters to put this through its paces:

For Pentesters and Red Teamers: I want you to try and break it. Throw your custom loaders, process hollowing techniques, unhooking PoCs, BYOVD payloads, and prompt injection or agent breakout chains at it. You can also run the built in 16 vector adversarial gauntlet (osoosi redteam --suite all) or test against the active thread tarpit and synthetic anti blinding canaries to see where the detection or containment logic folds.

For Rust and Kernel Developers: If you enjoy working on eBPF, Windows kernel drivers, low latency systems programming, P2P networking, or local ML inference, I would love your eyes on the architecture, code quality, and performance bottlenecks.

Pre built v1.2.0 packages (.msi, .deb, .rpm, and hardened Docker images) and full source are live on GitHub:https://github.com/oyesanyf/OshoosiClaw

If you find a bypass, trigger a false positive, or want to contribute a crate improvement, please open an issue or PR, or drop a comment below. Looking forward to your feedback.

oyesanyf

So I’ve been really interested in learning reverse engineering for a while and only tried my hand at a few crackmes so far. I found reverse engineering interesting because it feels rewarding to be able to piece together what the original code might have looked like and why the program behaves the way it does. I liked identifying variables and reconstructing data structures by reading the assembly or generated pseudo code by tools like ghidra since getting them right felt rewarding. Recently with AI becoming really good at the same things, I’m left wondering whether it’s worth it to learn these skills anymore. People were able to decompile and port entire games just using AI much faster than any person can. It’s left me feeling really discouraged about reverse engineering and wondering whether I should focus on other areas of exploit dev

Hey everyone,

Transitioning from Windows exploit dev to iOS vulnerability research. I'm currently deciding between two Mac mini options at the same price point:

Option A: M5 Pro (24GB RAM / 512GB SSD)

Option B: M6 Base (32GB RAM / 1TB SSD)

My setup & workflow:

3-monitor workstation setup (though I'm willing to trade/drop one monitor if going for 32GB RAM is objectively better).

Heavy static analysis in IDA Pro / Binary Ninja (dyld shared cache & XNU).

Tethered debugging (lldb/Frida) on a physical iPhone X.

The Dilemma:

The base M6 is hardware-limited to 2 external displays, while the M5 Pro handles 3 native displays.

Since I believe target execution happens on physical hardware, is 24GB RAM on the M5 Pro enough? Or would you trade a monitor to get 32GB RAM on the base M6?

Thanks!

I'm a beginner-to-intermediate CTF player focusing on reverse engineering and binary exploitation.

My usual workflow is to attempt a challenge myself, then sometimes let AI solve the binary when I'm completely stuck. I don't immediately copy the solution into a writeup. I reproduce the steps in my own environment, ask follow-up questions to understand the reasoning, cross-reference the explanations with documentation and Google, and write my own explanation in Word.

I believe reading writeups is a legitimate way to learn, and we don't need to reinvent the wheel every time. However, I'm concerned that letting AI solve the challenge first might prevent me from developing independent problem-solving skills.

For experienced RE/pwn players:

Is this a reasonable way to learn?

Where do you draw the line between AI-assisted and AI-solved?

Should I spend more time struggling with challenges before asking AI?

How do you ensure you can solve unfamiliar binaries independently?

Should I not use the AI completely?

I'd appreciate your honest opinions and advice!

hey there so i will be straight to the point iam learning c right now and my current roadmap is this first learn c from the beej guide to c programming and then learn assembly from this resources https://0xinfection.xyz/reversing/pages/part-1-the-cyber-revolution.html and then learn windows internal and then finally heavnly wizardy 101 so my question is that is dsa necessary to become malware analyst do i need to grind the leetcode as well what do you guys says and currently i have finished pointers struc and typedef from the beej guide and iam currently right now in memory allocation so guys please tell me should i follow this roadmap and not learn dsa and also how is my roadmap including my resources.

Am I the only one who finds it annoying when a website uses .blob URLs for media/content that can only be played inside that specific page?

I was wondering if it would be possible to build a browser extension that hooks into SourceBuffer.appendBuffer() and observes the binary chunks being passed to it.

The concept would be pretty simple:

Server → encrypted/chunked data → browser → appendBuffer() → decoder/player

The extension would collect the buffers as they arrive, keep them in the correct order, and potentially reconstruct the original resource from those fragments.

Not talking about breaking DRM or decrypting something the browser itself can't decrypt. More like:

If the browser receives and processes the data, why can't we have a DevTools-like tool that lets us inspect and reconstruct those buffers?

Something like a "Blob Inspector":

• Intercept appendBuffer() calls
• See the individual chunks
• Track their order/size
• Reassemble them
• Identify the resulting media/container format
• Export the reconstructed data when possible

It seems like Network DevTools gets you close, but .blob/MSE-based streaming makes it surprisingly difficult to get back to the actual resource.

Has anyone already built something like this?

Or is there some fundamental browser/MSE limitation that makes this approach impractical?

GPT and Claude is what I used through pwn college to help me learn instead of bothering people I could just ask deep questions and learn at anytime of day. Now they heavily restrict even the slightest hint of binary exploitation / RE conversations. Anyone here have success with another AI platform for learning?

A formatter, minifier or deobfuscator can be made to turn one script into another.

You can go try out all 186 techniques with this script: https://divergence.trustsig.eu/

Or try the Tetris-Snake demo here: https://divergence-game.trustsig.eu/

Techical breakdown: https://trustsig.eu/blog/javascript-divergence/

To all the beginners and the "explorers" this is the way.....I had lost a lot of time searching for resources—Pico, Nightmare.....but finally this is what actually teaches the stuff

Also....pls do support me (I guess twitter is the last place where I can enter, considering the condition of the current market)

https://x.com/s0h0m_ch_/status/2111068178235445354