Adrian Herrera

Exploiting the Synology TC500 at Pwn2Own Ireland 2024 Introduction In October 2024, InfoSect participated in Pwn2Own – a bug bounty competition against embedded devices such as cameras, NAS’, and smart speakers. In this blog, I’ll di…

New blog post: Exploiting the Synology TC500 at Pwn2Own Ireland 2024
We built a format string exploit for the TC500 smart cam. It didn’t get used, but it made for a fun case study.
blog.infosectcbr.com.au/2025/08/01/e...

Add V8SandboxFuzzer · googleprojectzero/fuzzilli@675eccd This is a basic fuzzer for the V8 Sandbox. It uses the memory corruption API to implement a random-but-deterministic (given a seed) traversal through the V8 heap object graph and corrupts some obje...

We released our Fuzzilli-based V8 Sandbox fuzzer: github.com/googleprojec...
It explores the heap to find interesting objects and corrupts them in a deterministic way using V8's memory corruption API. Happy fuzzing!

Good luck, and exciting times for XBOW!

Linux Kernel Hardening: Ten Years Deep

Talk by Kees Cook about the relevance of various Linux kernel vulnerability classes and the mitigations that address them.

Video: www.youtube.com/watch?v=c_Nx...
Slides: static.sched.com/hosted_files...

CVE-2023-52927: Turning a Forgotten #Syzkaller Report into #kCTF #Exploit

https://qriousec.github.io/post/cve-2023-52927/

Oh cool! I’m probably more interested in different frontends; I’ll leave accelerating to the professionals 😄

GitHub - sandialabs/ctadl: CTADL is a static taint analysis tool CTADL is a static taint analysis tool. Contribute to sandialabs/ctadl development by creating an account on GitHub.

CTADL - a Datalog-based interprocedural static taint analysis engine for Java/Android bytecode (via JADX) and Pcode (via Ghidra)

Code: github.com/sandialabs/c...

Talk (via @krismicinski.bsky.social): youtu.be/3ec9VfMUVa8?...

Woah totally missed that CTDL is open source 🥳

A side by side comparison of the original output by Ghidra, and the LLM enriched output.

Ghidra, scripting, LLM, automagic automation. That should grab the attention for this thread. If you want to read the complete blog, you can do so here: www.trellix.com/blogs/resear...
1/n

Estimating Correctness Without Oracles in LLM-Based Code Generation Generating code from natural language specifications is one of the most successful applications of Large Language Models (LLMs). Yet, they hallucinate: LLMs produce outputs that may be grammatically c...

Can we statistically estimate how likely an LLM-generated program is correct w/o knowing what is a correct program for that task?

Sounds impossible-but it's actually really simple. In fact, our measure of "correctness" called incoherence can be estimated (PAC guarantees).

arxiv.org/abs/2507.00057

Firmwire 🤝 LibAFL

Solo: A Pixel 6 Pro Story (When one bug is all you need) During my internship I was tasked to analyze a Mali GPU exploit on Pixel 7/8 devices and adapt it to make it work on another device: the Pixel 6 Pro. While the exploit process itself is relatively straightforward to reproduce (in theory we just need to find the correct symbol offsets and signatures for our target device), what’s interesting about Pixel 6 Pro is that it uses a different Mali GPU from the Pixel 7/8, which lacked support for a feature that one of the two vulnerabilities within the exploit relied on:

Solo: A Pixel 6 Pro Story (When one #bug is all you need)

https://starlabs.sg/blog/2025/06-solo-a-pixel-6-pro-story-when-one-bug-is-all-you-need/

Just Accepted to ACM TOSEM!

The "Havoc Paradox" is about the relationship between byte-level fuzzer mutations and their effect on the inputs produced by generators for structured strings (e.g. XML/SQL). Can disruptive mutations be controlled? Should they be? Find out.

📄 dl.acm.org/doi/pdf/10.1...

DWARF as a Shared Reverse Engineering Format This blog post introduces a new API in LIEF to create DWARF files

[Blog Post] New high-level API in LIEF that allows the
creation of DWARF files. Additionally, I present two plugins designed to export
program information from Ghidra and BinaryNinja into a DWARF file.

lief.re/blog/2025-05...

(Bonus: DWARF file detailing my reverse engineering work on DroidGuard)

Bypassing MTE with CVE-2025-0072 See how a vulnerability in the Arm Mali GPU can be exploited to gain kernel code execution even when Memory Tagging Extension (MTE) is enabled.

Our team member Man Yue Mo is back, showing a new way to bypass MTE protection on Android phones with CVE-2025-0072. github.blog/security/vul...

Happy to share my upcoming #ATC25 paper w/ @snagycs.bsky.social: "BIN2WRONG: a Unified Fuzzing Framework for Uncovering Semantic Errors in Binary-to-C Decompilers"!

Bin2Wrong creates binaries by mutating source, compiler, optimizations, and format—revealing 48 new bugs in 7 decompilers! 💪

GitHub - binarly-io/idalib: Idiomatic Rust bindings for the IDA SDK, enabling the development of standalone analysis tools using IDA v9.x’s idalib Idiomatic Rust bindings for the IDA SDK, enabling the development of standalone analysis tools using IDA v9.x’s idalib - binarly-io/idalib

We're are happy to announce a new release of our #Rust bindings for idalib.

What's new:
- New APIs for working with IDBs, segments, and more
- Rust 2024 support
- New homepage: idalib.rs

H/T to our contributors @yeggor.bsky.social & @raptor.infosec.exchange.ap.brid.gy

github.com/binarly-io/i...

👀

Kernel Exploitation Techniques: Turning The (Page) Tables This post explores attacking page tables as a Linux kernel exploitation technique for gaining powerful read/write primitives.

with offensivecon around the corner, i figured id write another post on linux kernel exploitation techniques - this time i cover the world of page table exploitation! enjoy 🤓

sam4k.com/page-table-k...

Gave a talk on external fuzzing of Linux kernel USB drivers with syzkaller at SAFACon.

Includes a demonstration of how to rediscover CVE-2024-53104, an out-of-bounds bug in the USB Video Class driver.

Slides: docs.google.com/presentation...

Wrote a lil' guide to help get people started with the 🆕 `ipsw` AI decompiler 📖

blacktop.github.io/ipsw/docs/gu...

Can confirm the hardware lab is pretty cool 😎

In today's #AST2025 keynote on our new #Fandango fuzzer, I presented ongoing extensions for protocol fuzzing, oracle checking, coverage guidance, much more. Slides now available: conf.researchr.org/details/ast-...

Fuzzing Windows ARM64 binaries with a DBI and LLVM?
Here we go: www.romainthomas.fr/post/25-04-w...

I'm proud to announce that myself and @AtipriyaBajaj have created the Workshop on Software Understanding and Reverse Engineering (SURE), which will be co-located at CCS 2025. sure-workshop.org/

Please follow our workshop account @sureworkshop and RT it for visibility :).

Linux Hardening - State Of Linux Snapshot Fuzzing​ Explore the current state of Linux snapshot fuzzing, its challenges, tools, and impact on kernel security.

Just skimmed over or it so far but looks like a nice overview on snapshot fuzzing by @theoabel.com

fuzzinglabs.com/state-of-lin...

the guy who reversed the denuvo drm
@momo5502.bsky.social works on a high-perf windows emulator for security research.

I noticed that it supports icicle as a backend, a fuzzing-specific emulator. awesome to see academic work being continuously developed and making it into the real world

Woah this is really cool! Agreed, good to see academic work like icicle being picked up and built upon.

happy easter

About to celebrate Easter with your family but don't know what to talk about at the table?
Then don't lose time and read our new article about RPAC!
Written by @zadig.trollab.org !

blog.epsilon-sec.com/cve-2025-312...

“15,000 lines of verified cryptography now in Python”

Nice write up on integrating the hash and HMAC routines from the HACL* verified crypto library into Python 🎉

jonathan.protzenko.fr/2025/04/18/p...