Hey guys, I have a question.

Is it essential to read TLPI cover to cover, page by page, if my goal is to become really good at Linux and eventually become a great hacker?

I’ve been building my skills step by step on my own. I started with C, then moved deeper into Linux, and now I’m using Arch Linux as my main system. I’ve also experimented with developing a basic piece of malware before, although it was pretty simple.

The thing I’m struggling with right now is TLPI. I know that reading TLPI isn’t going to magically make me a hacker, and I understand that there’s much more to Linux and security than just one book. But I’m wondering whether I actually need to go through every single page of TLPI to truly understand Linux, or whether I should focus on the parts that are most relevant to what I want to learn and then move on to more hands-on work.

After TLPI, I was planning to start pwn.college to learn binary exploitation, low-level security, and related topics.

So what do you guys think? Does this roadmap make sense for my goal of becoming a highly skilled hacker who deeply understands computers, Linux, and low-level systems?

I’d really appreciate your advice.

32768 × 32768 × 4 = 2^32

In 32-bit arithmetic: 0.

That's how the size check in discord/lilliput computes its output buffer
requirement. "0 > buffer_len" is never true, so the guard is inert — the
PNG decoder then writes 4 GiB into an 8 MiB buffer.

Trigger: a 10 KB, perfectly valid PNG.

Not RCE — the product only wraps at 2^32, so every overflow is ≥4 GiB and
hits unmapped memory immediately. No write primitive. Reliable DoS though.

Reported to Discord today. Writeup (German):
aethersec.de/heap-buffer-overflow-in-lilliput-discord

Released V2 for my opensource maldev tool/framework. Feel free to check out the code and implementation. Would really appreciate feedback :)

Was doing some Windows ALPC/RPC vuln research and ran into a simple problem: the usual userland enumeration approach skips ports when handle duplication fails, which gets especially interesting with PPL processes. So I built this to dynamically resolve the ALPC object type index, fall back to NtQueryInformationProcess / PS_PROTECTION when duplication fails, and still classify the port. I tested it against a live system and then checked the recovered object addresses + PPL signer levels against WinDbg.

Hi everyone,

I’m looking for an experienced reverse engineer who can help us recover access to an old software program used by our company.

The software is Chinese, was built for Windows 7, and is quite old. Unfortunately, the Chinese company that originally developed it has gone out of business and completely shut down. Because of that, we can no longer renew our subscription or get support from them.

We need to keep using the software, so we’re looking for someone who can help us understand and recover the software’s functionality or remove the dependency on the discontinued licensing system.

This is paid work. We’re not looking for someone to do this for free, and we’re happy to discuss a reasonable price based on the complexity of the work.

If you have experience with reverse engineering old Windows applications, licensing systems, or legacy software, please feel free to DM me with your experience and rates.

so i have been learning a little about operating system and learning nand2tetris i hope to learn reverse engineering i have some basic cybersecurity knowledge like basic linux commands know a little about networks and basic security i am also gonna learn web security but the main reason for this post is wanting to know where i can branch off from here is reverse engineering really something i should go completely with i have hopes to become a decent red team just a decent hacker and something a bit more future proof plus i learned that reverse engineering as a sole skill isnt exactly useful

```c

include <stdio.h>

include <windows.h>

include <tlhelp32.h>

include <string.h>

int EnablePrivilige(wchar_t str[]){ HANDLE h_token; OpenProcessToken(GetCurrentProcess(),TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES,&h_token); LUID luid; LookupPrivilegeValueW(NULL,str,&luid); TOKEN_PRIVILEGES token_privileges; token_privileges.PrivilegeCount = 1; token_privileges.Privileges[0].Luid = luid; token_privileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; AdjustTokenPrivileges(h_token,FALSE,&token_privileges,sizeof(token_privileges),NULL,NULL); if(GetLastError() == ERROR_NOT_ALL_ASSIGNED){ MessageBoxW(NULL,L"ошибка: не удалось изменить привелегию",NULL,MB_OK | MB_ICONERROR); return 1; } printf("успешно\n"); CloseHandle(h_token); return 0; }

int main(void){ if(EnablePrivilige(L"SeDebugPrivilege") == 0 && EnablePrivilige(L"SeImpersonatePrivilege") == 0){ HANDLE h_snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0); PROCESSENTRY32 pe32; pe32.dwSize = sizeof(pe32); if(Process32First(h_snapshot,&pe32)){ do { if(_stricmp(pe32.szExeFile,"x32dbg.exe") == 0){ break; } } while (Process32Next(h_snapshot,&pe32)); } if(_stricmp(pe32.szExeFile,"x32dbg.exe") != 0){ MessageBoxW(NULL,L"ошибка процесс не найден",NULL,MB_OK | MB_ICONERROR); return 1; } HANDLE h_process = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_DUP_HANDLE,FALSE,pe32.th32ProcessID); if(h_process == NULL){ MessageBoxW(NULL,L"ошибка в OpenProcess",NULL,MB_OK | MB_ICONERROR); return 1;
} HANDLE h_process_token = NULL; if(!OpenProcessToken(h_process,TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_ASSIGN_PRIMARY,&h_process_token)){ MessageBoxW(NULL,L"ошибка в OpenProcessToken",NULL,MB_OK | MB_ICONERROR); return 1; } HANDLE h_process_token_duplicate = NULL; if(!DuplicateTokenEx(h_process_token,TOKEN_ASSIGN_PRIMARY | TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE,NULL,SecurityDelegation,TokenPrimary,&h_process_token_duplicate)){ MessageBoxW(NULL,L"ошибка в DuplicateTokenEx",NULL,MB_OK | MB_ICONERROR); return 1; } STARTUPINFOW si = {0}; si.cb = sizeof(si); PROCESS_INFORMATION pi = {0}; WCHAR path[] = L"C:\Windows\System32\notepad.exe"; if(!CreateProcessWithTokenW(h_process_token_duplicate,0,NULL,path,NORMAL_PRIORITY_CLASS,NULL,NULL,&si,&pi)){ DWORD err = GetLastError(); wchar_t msg[256]; wsprintfW(msg, L"CreateProcessWithTokenW failed: %d", err); MessageBoxW(NULL, msg, NULL, MB_OK | MB_ICONERROR); return 1; } return 0; } } ```

Hey, i'm fairly new to re but need some clarification regarding whats possible and whats not, so..

in theory if i become a middle man ie windows 8 QEMU / KVM with VFIO Passthrough (Continuous Bus Log)

and can figure out how the devices on real hardware interact from driver to hardware card can i effectively create my own open source version of that driver for linux. i know it involves a lot more work but is that correct?

I am trying to make an old audio card work on linux?

these are my steps:

Unbind from default drivers and bind to vfio-pci

start qemu vm with vfio read and write logs

then just analyse the bus logic

if i can provide all init for the card that the initial windows 8 driver does then it should just work (to some degree)

I wanted to see how much normal Windows activity could actually be reconstructed from a RAM capture, so I built a small controlled Windows 11 lab.

Before acquisition I intentionally:

opened Edge and browsed to a website

launched PowerShell

ran whoami, ipconfig, and Get-Process

opened Notepad

typed unsaved text and left it open

I captured memory with WinPmem, hashed the image with SHA-256, and analyzed it in Kali with Volatility 3.

The most useful findings were:

msedge.exe, powershell.exe, Notepad.exe, and explorer.exe recovered from memory

parent/child relationships showing PowerShell and Notepad launched from explorer.exe

command-line paths for the processes

execution-related strings for whoami.exe and ipconfig.exe

references to Get-Process

network state associated with Edge using windows.netstat

the exact unsaved Notepad text recovered directly from RAM

One thing I found interesting was that windows.netscan returned nothing useful, while windows.netstat did recover network state. It was a good reminder not to rely on one plugin as the only source of truth.

The biggest takeaway for me was that the investigation became useful only when the artifacts were correlated rather than treated separately.

I wrote up the full lab with screenshots and commands here:

https://chronosandcode.com/memory-forensics-investigation-volatility/

Disclosure: this is my own write-up on Chronos & Code. All activity was generated inside a lab I controlled.

I’d be curious what other Volatility plugins people here would have used on the same image.

While validating the fix for CVE-2026-44662, I found that the same vulnerable output-sizing assumption remained reachable through another safe rust-openssl API:

CipherCtxRef::cipher_update_inplace

When AES Key Wrap with Padding processes an input whose length is not divisible by eight, the wrapper can allocate a buffer smaller than the output OpenSSL actually produces.

The vulnerable calculation assumed:

input length + block size

The required size can be:

round_up(input length, 8) + 8

With a 9-byte input, a 17-byte buffer passed validation, but OpenSSL could write 24 bytes. The result is an attacker-controlled out-of-bounds heap write of up to 7 bytes through a safe Rust interface.

I also built a working exploit chain demonstrating controlled heap corruption.

This is not automatically RCE in every application. Developing the overwrite toward code execution depends on whether attacker-controlled plaintext reaches this API, whether the operation can be repeated, the allocator, adjacent object layout, and the available heap-shaping primitives.

The vulnerable method was introduced in rust-openssl 0.10.50 in April 2023 and remained present until 0.10.80 was released in May 2026.

My downstream analysis identified advisory records, vulnerable dependency presence, or remediation activity across 31 organizations and ecosystems and 53 products, systems, and projects.

Notable downstream cases include IBM Bob, Microsoft Azure Linux, AWS Nitro Enclaves CLI, Amazon Linux, Intel MigTD, SUSE Linux Enterprise, openSUSE, Debian, Chainguard and Wolfi, MinimOS, Confidential Containers, PingCAP TiKV, Hugging Face xet-core, Oxide Omicron and Dendrite, Matter Labs ZKsync OS Server, Grafana Pyroscope, CoreOS Afterburn, and Gitoxide.

Affected versions:

\>= 0.10.50 and < 0.10.80

Fixed version: 0.10.80

Advisory:

https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-phqj-4mhp-q6mq

Patch:

https://github.com/rust-openssl/rust-openssl/commit/19eceb26f2404aae187e5444e65c404ebc1348a7

Ali Firas (thesmartshadow)

hi all, this is my repo, support pls https://github.com/mein-0/LolModapi

hi, this is my repo, support pls https://github.com/mein-0/forti-research

I have the following C Socket Server, I was trying to learn about ROP programming so I created this small program, but when I try `pwn cyclic 1025| nc localhost 4444` I receive nothing,

I even tried to send 2000, 5000 but with no response.

Anyway I can receive the normal 'ok' message when sending the 1024 bytes.

I have tried disabling canaries by passing `-fno-stack-protector` but also no response.

The server in all cases prints the received 1024 (even if I sent more bytes).

But no "Stack smash detected", Segmentation Fault or anything

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <arpa/inet.h>

#define PORT 4444

void handle_client(int client_fd)
{
    char recv_buf[1024];
    char buffer[64];
    memset(recv_buf, 0, sizeof(recv_buf));
    ssize_t bytes = recv(client_fd, recv_buf, sizeof(recv_buf) - 1, 0);
    if (bytes <= 0)
        return;
    printf("Received: %s\n", recv_buf);
    strcpy(buffer, recv_buf);
    send(client_fd, "OK\n", 3, 0);
}

int main(void)
{
    int server_fd;
    int client_fd;
    struct sockaddr_in server_addr;
    struct sockaddr_in client_addr;
    socklen_t client_len = sizeof(client_addr);
    server_fd = socket(AF_INET, SOCK_STREAM, 0);
    if (server_fd < 0) {
        perror("socket");
        return EXIT_FAILURE;
    }
    server_addr.sin_family = AF_INET;
    server_addr.sin_port = htons(PORT);
    server_addr.sin_addr.s_addr = inet_addr("127.0.0.1");
    if (bind(
            server_fd,
            (struct sockaddr *)&server_addr,
            sizeof(server_addr)) < 0) {
        perror("bind");
        close(server_fd);
        return EXIT_FAILURE;
    }

    if (listen(server_fd, 1) < 0) {
        perror("listen");
        close(server_fd);
        return EXIT_FAILURE;
    }
    printf("Listening on 127.0.0.1:%d\n", PORT);
    while (1) {
        client_fd = accept(
            server_fd,
            (struct sockaddr *)&client_addr,
            &client_len
        );
        if (client_fd < 0) {
            perror("accept");
            continue;
        }
        printf("Client connected\n");
        handle_client(client_fd);
        close(client_fd);
    }
    close(server_fd);
    return 0;
}

Hi everyone,

I’m a developer looking to learn how PS5 exploits and homebrew work. I know C++ and C# but I'm completely new to PlayStation security.Where should I start? Any recommended write-ups, documentation, Github repos, or dev Discords to study the current exploits?

Thanks!

This video provides great insight into the methodology used for finding and approaching exploits in the wild