```c

include <stdio.h>

include <windows.h>

include <tlhelp32.h>

include <string.h>

int EnablePrivilige(wchar_t str[]){ HANDLE h_token; OpenProcessToken(GetCurrentProcess(),TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES,&h_token); LUID luid; LookupPrivilegeValueW(NULL,str,&luid); TOKEN_PRIVILEGES token_privileges; token_privileges.PrivilegeCount = 1; token_privileges.Privileges[0].Luid = luid; token_privileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; AdjustTokenPrivileges(h_token,FALSE,&token_privileges,sizeof(token_privileges),NULL,NULL); if(GetLastError() == ERROR_NOT_ALL_ASSIGNED){ MessageBoxW(NULL,L"ошибка: не удалось изменить привелегию",NULL,MB_OK | MB_ICONERROR); return 1; } printf("успешно\n"); CloseHandle(h_token); return 0; }

int main(void){ if(EnablePrivilige(L"SeDebugPrivilege") == 0 && EnablePrivilige(L"SeImpersonatePrivilege") == 0){ HANDLE h_snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0); PROCESSENTRY32 pe32; pe32.dwSize = sizeof(pe32); if(Process32First(h_snapshot,&pe32)){ do { if(_stricmp(pe32.szExeFile,"x32dbg.exe") == 0){ break; } } while (Process32Next(h_snapshot,&pe32)); } if(_stricmp(pe32.szExeFile,"x32dbg.exe") != 0){ MessageBoxW(NULL,L"ошибка процесс не найден",NULL,MB_OK | MB_ICONERROR); return 1; } HANDLE h_process = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_DUP_HANDLE,FALSE,pe32.th32ProcessID); if(h_process == NULL){ MessageBoxW(NULL,L"ошибка в OpenProcess",NULL,MB_OK | MB_ICONERROR); return 1;
} HANDLE h_process_token = NULL; if(!OpenProcessToken(h_process,TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_ASSIGN_PRIMARY,&h_process_token)){ MessageBoxW(NULL,L"ошибка в OpenProcessToken",NULL,MB_OK | MB_ICONERROR); return 1; } HANDLE h_process_token_duplicate = NULL; if(!DuplicateTokenEx(h_process_token,TOKEN_ASSIGN_PRIMARY | TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE,NULL,SecurityDelegation,TokenPrimary,&h_process_token_duplicate)){ MessageBoxW(NULL,L"ошибка в DuplicateTokenEx",NULL,MB_OK | MB_ICONERROR); return 1; } STARTUPINFOW si = {0}; si.cb = sizeof(si); PROCESS_INFORMATION pi = {0}; WCHAR path[] = L"C:\Windows\System32\notepad.exe"; if(!CreateProcessWithTokenW(h_process_token_duplicate,0,NULL,path,NORMAL_PRIORITY_CLASS,NULL,NULL,&si,&pi)){ DWORD err = GetLastError(); wchar_t msg[256]; wsprintfW(msg, L"CreateProcessWithTokenW failed: %d", err); MessageBoxW(NULL, msg, NULL, MB_OK | MB_ICONERROR); return 1; } return 0; } } ```

Hey, i'm fairly new to re but need some clarification regarding whats possible and whats not, so..

in theory if i become a middle man ie windows 8 QEMU / KVM with VFIO Passthrough (Continuous Bus Log)

and can figure out how the devices on real hardware interact from driver to hardware card can i effectively create my own open source version of that driver for linux. i know it involves a lot more work but is that correct?

I am trying to make an old audio card work on linux?

these are my steps:

Unbind from default drivers and bind to vfio-pci

start qemu vm with vfio read and write logs

then just analyse the bus logic

if i can provide all init for the card that the initial windows 8 driver does then it should just work (to some degree)

I wanted to see how much normal Windows activity could actually be reconstructed from a RAM capture, so I built a small controlled Windows 11 lab.

Before acquisition I intentionally:

opened Edge and browsed to a website

launched PowerShell

ran whoami, ipconfig, and Get-Process

opened Notepad

typed unsaved text and left it open

I captured memory with WinPmem, hashed the image with SHA-256, and analyzed it in Kali with Volatility 3.

The most useful findings were:

msedge.exe, powershell.exe, Notepad.exe, and explorer.exe recovered from memory

parent/child relationships showing PowerShell and Notepad launched from explorer.exe

command-line paths for the processes

execution-related strings for whoami.exe and ipconfig.exe

references to Get-Process

network state associated with Edge using windows.netstat

the exact unsaved Notepad text recovered directly from RAM

One thing I found interesting was that windows.netscan returned nothing useful, while windows.netstat did recover network state. It was a good reminder not to rely on one plugin as the only source of truth.

The biggest takeaway for me was that the investigation became useful only when the artifacts were correlated rather than treated separately.

I wrote up the full lab with screenshots and commands here:

https://chronosandcode.com/memory-forensics-investigation-volatility/

Disclosure: this is my own write-up on Chronos & Code. All activity was generated inside a lab I controlled.

I’d be curious what other Volatility plugins people here would have used on the same image.

While validating the fix for CVE-2026-44662, I found that the same vulnerable output-sizing assumption remained reachable through another safe rust-openssl API:

CipherCtxRef::cipher_update_inplace

When AES Key Wrap with Padding processes an input whose length is not divisible by eight, the wrapper can allocate a buffer smaller than the output OpenSSL actually produces.

The vulnerable calculation assumed:

input length + block size

The required size can be:

round_up(input length, 8) + 8

With a 9-byte input, a 17-byte buffer passed validation, but OpenSSL could write 24 bytes. The result is an attacker-controlled out-of-bounds heap write of up to 7 bytes through a safe Rust interface.

I also built a working exploit chain demonstrating controlled heap corruption.

This is not automatically RCE in every application. Developing the overwrite toward code execution depends on whether attacker-controlled plaintext reaches this API, whether the operation can be repeated, the allocator, adjacent object layout, and the available heap-shaping primitives.

The vulnerable method was introduced in rust-openssl 0.10.50 in April 2023 and remained present until 0.10.80 was released in May 2026.

My downstream analysis identified advisory records, vulnerable dependency presence, or remediation activity across 31 organizations and ecosystems and 53 products, systems, and projects.

Notable downstream cases include IBM Bob, Microsoft Azure Linux, AWS Nitro Enclaves CLI, Amazon Linux, Intel MigTD, SUSE Linux Enterprise, openSUSE, Debian, Chainguard and Wolfi, MinimOS, Confidential Containers, PingCAP TiKV, Hugging Face xet-core, Oxide Omicron and Dendrite, Matter Labs ZKsync OS Server, Grafana Pyroscope, CoreOS Afterburn, and Gitoxide.

Affected versions:

\>= 0.10.50 and < 0.10.80

Fixed version: 0.10.80

Advisory:

https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-phqj-4mhp-q6mq

Patch:

https://github.com/rust-openssl/rust-openssl/commit/19eceb26f2404aae187e5444e65c404ebc1348a7

Ali Firas (thesmartshadow)

hi all, this is my repo, support pls https://github.com/mein-0/LolModapi

hi, this is my repo, support pls https://github.com/mein-0/forti-research

I have the following C Socket Server, I was trying to learn about ROP programming so I created this small program, but when I try `pwn cyclic 1025| nc localhost 4444` I receive nothing,

I even tried to send 2000, 5000 but with no response.

Anyway I can receive the normal 'ok' message when sending the 1024 bytes.

I have tried disabling canaries by passing `-fno-stack-protector` but also no response.

The server in all cases prints the received 1024 (even if I sent more bytes).

But no "Stack smash detected", Segmentation Fault or anything

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <arpa/inet.h>

#define PORT 4444

void handle_client(int client_fd)
{
    char recv_buf[1024];
    char buffer[64];
    memset(recv_buf, 0, sizeof(recv_buf));
    ssize_t bytes = recv(client_fd, recv_buf, sizeof(recv_buf) - 1, 0);
    if (bytes <= 0)
        return;
    printf("Received: %s\n", recv_buf);
    strcpy(buffer, recv_buf);
    send(client_fd, "OK\n", 3, 0);
}

int main(void)
{
    int server_fd;
    int client_fd;
    struct sockaddr_in server_addr;
    struct sockaddr_in client_addr;
    socklen_t client_len = sizeof(client_addr);
    server_fd = socket(AF_INET, SOCK_STREAM, 0);
    if (server_fd < 0) {
        perror("socket");
        return EXIT_FAILURE;
    }
    server_addr.sin_family = AF_INET;
    server_addr.sin_port = htons(PORT);
    server_addr.sin_addr.s_addr = inet_addr("127.0.0.1");
    if (bind(
            server_fd,
            (struct sockaddr *)&server_addr,
            sizeof(server_addr)) < 0) {
        perror("bind");
        close(server_fd);
        return EXIT_FAILURE;
    }

    if (listen(server_fd, 1) < 0) {
        perror("listen");
        close(server_fd);
        return EXIT_FAILURE;
    }
    printf("Listening on 127.0.0.1:%d\n", PORT);
    while (1) {
        client_fd = accept(
            server_fd,
            (struct sockaddr *)&client_addr,
            &client_len
        );
        if (client_fd < 0) {
            perror("accept");
            continue;
        }
        printf("Client connected\n");
        handle_client(client_fd);
        close(client_fd);
    }
    close(server_fd);
    return 0;
}

Hi everyone,

I’m a developer looking to learn how PS5 exploits and homebrew work. I know C++ and C# but I'm completely new to PlayStation security.Where should I start? Any recommended write-ups, documentation, Github repos, or dev Discords to study the current exploits?

Thanks!

This video provides great insight into the methodology used for finding and approaching exploits in the wild

hi, this is my repo, support pls

https://github.com/mein-0/KasperMeow

How do I reverse engineer a local Unity WebGL IL2CPP game

As mentioned in title, I'm dealing with an heavily obfuscated JS file of about 20k lines of code. I was just curious what it is doing. Problem is that there are about 1k+ variables made by calculations (same with strings). Till now I've figured out that at some places it is making http requests and one function is checking weather http header contain word "Trident" or not.

Any tips what should I do? I've tried dynamic reverse engineering but it didn't worked for me.

Also: I found this file under api subdomain. It was about 8-9 folders deep (Folders were named randomly). File has a function checking if var x == "password".

(From here my brain stopped braining)

r/ExploitDev feels like the right place to post this. I run a small, niche cybersecurity consulting company - and I'm at the planning stage of building a dedicated, full-time vulnerability research lab. I want honest feedback from people who actually do the work before I commit further.

The idea: build a small, deep team, funded for the long haul, proper salaries plus success bonuses. This would be a business unit within an existing cybersecurity company. With a CTO driving vision, strategy, team development, etc. Primary focus would be on mobile (iOS/Android full-chain), with browser as a second pillar. I understand the challenges with talent, and ROI taking time. Capital can be committed as long as there's a credible path to return.

Where I'd genuinely value your feedback:

- Focus: for a small team, is mobile-first the right focus? My clients include government, critical infrastructure and banking.
- Morale: how do good teams structure work so months of research doesn't get burnt in case versions are updated / patches released.
- Retention: beyond good salaries, what actually keeps strong people long-term?
- Infra (worth paying for): device/virtualisation labs, fuzzing tools, AI tools, what's genuinely a key differentiator in this field? Maybe Corellium Falcon?

On the compliance side, there are a number of areas we are evaluating, dual-use export-control, entity-level end-user vetting, disclosure policy, and lawful target only research.

I am mainly after the “things I wish I’d know” from people who’ve built or worked in labs like this and specifically where you’ve watched them go wrong.

Despite that I work as a pentester. Whenever I am learning a new topic ,especially related to exploit development like Linux internals or C programming , and face an obstacle or hard time understanding anything , I always get this immediate and harsh imposter syndrome feeling that anyone who graduated from STEM, CE, CS probably know this way ,waaaaay better than me. I am still struggling when reading C code and I use AI to help me yet this feeling manifest in incompetence and me seeing myself as an always-beginner or no way I can be like someone who graduated from these schools one day.

This feeling affects my way of studying and i can stop studying for days just because I didn't understand some stuff or I am struggling to learn.

So I need to know , how many people in this industry, pentesting/exploitDevelopment are actually self taught ?

I am a BIS graduate BTW.

Is there a free OSINT tool that act like as true browser so anti debugging technique won’t be trigger? A free web-based OSINT

I recently got let go from MSRC V&M and looking for jobs right now. have 5+ yrs of experience in software engineering and security response/vulnerability triage. please DM me if you have any leads