Hey all — I’ve served the RE/VR community as an indie for 10+ years, primarily startups & FFRDCs (US only). After a tough 18-month stretch for everyone, I’m now recruiting for cleared positions (hybrid, FTE) involving reverse engineering and exploit R&D from New England to the Space Coast. I’ll elucidate as thoroughly & concisely as possible:

• Lead RE roles in Annapolis Junction, MD (TS + FSP) and Palm Bay (TS/SCI), CNO roles in Sterling, VA (Android/iOS, TS), and Staff Security Researchers & Exploit Devs in Lexington, MA (TS)

• These institutions fully pay for relocation; the MA roles allow WFH most Mondays & Fridays, the others have great flex hours

• Active or recent (within 2 years) gov’t security clearance required; great opportunities for reactivation or upgrades

• Base salaries range from $180-250K depending on level of experience, education and clearance, plus bonus considerations, excellent PTO/benefits, 401k match, and pension (MA only)

Drop me a line to inquire about any of the above at chad<at>roguetalent<dot>io. The mission needs its top talent now more than ever. I hope I’ve complied with this thread’s policy, as I am a longtime friend committed to the cyber community. Thanks!

If you analyze Android banking trojans, droppers, or spyware, you've probably run into samples where:

• classes*.dex declares native methods, but lib/*.so has 0 exported Java_* symbols and wiped ELF section headers.
• JNI_OnLoad constructs strings on the stack (MOVZ/MOVK), uses an OLLVM CSEL + BR X8 state machine, and registers JNI handlers dynamically.
• Attaching Frida immediately crashes the app due to /proc/self/maps or libc prologue checks.

I released JNISleuth-MCP (Apache 2.0) to automate this part of Android malware triage: https://github.com/nighthawkk/JNISleuth-MCP

• Recovers static JNINativeMethod triplets from .rodata / .data.rel.ro (with PT_LOAD fallback for section-stripped ELFs).
• Extracts MOVZ/MOVK stack strings and XOR-encoded C2 strings from JNI_OnLoad / .init_array.
• Resolves & patches ARM64 OLLVM CSEL + BR X8 indirect branches and .rodata jump tables.
• Includes a C++/NDK Dobby agent that hooks RegisterNatives mid-function (+0x10) and dumps in-memory DEX payloads from art::DexFileLoader::OpenCommon without triggering standard Frida detections.
• Syncs all 233 JNIEnv* vtable types and C signatures into Ghidra and IDA Pro 9.0, plus includes an MCP/LLM server.

Ships with a synthetic dropper APK (samples/banker_dropper.apk) so you can test all features offline.

Hey everyone! 👋

I've been working on a lightweight, modular CLI-based framework called **TànPhá Framework**, written in Python and optimized for Termux (as well as Linux/Windows).

My main goal is to create a tool that handles full-chain automation (from detection to interactive execution) directly from a mobile device without heavy external dependencies.

### ⚙️ Current Modules:

1. **Arbitrary File Upload Engine:** Auto parameter detection, extension/magic byte bypass, and target shell verification.

2. **Command Injection Engine:** Auto-separator variation, WAF bypass encoding, and quick system enumeration.

3. **SQL Injection Engine:** Multi-payload error/union scanner and column fuzzing.

4. **PHP2Shell Core:** Interactive HTTP POST-based command execution (RAT).

### 🔗 Repository:

https://github.com/exelumare/T-nPh--framework

Since this is still in active development, I'd love to get your feedback!

What auto-exploitation modules or features do you think would be a great addition to this framework? Any suggestions on code improvement or new attack chains are greatly appreciated!

*Disclaimer: Created strictly for educational purposes, security research, and authorized testing.*

I found a heap buffer overflow in the Brotli glue code in EDK2 (BrotliDecompress.c). It has been there since 2017 and it’s still unfixed at HEAD.

Some background. CVE-2021-28211 was a heap overflow in EDK2’s LZMA decompressor. GetInfo took a UINT64 decoded size and truncated it to UINT32 with no check, so the decoder could write past the buffer that had been allocated. The fix added a MAX_UINT32 check and bounded the output.

The Brotli decompressor was added earlier with the same structure, and it never got the same fix. BrotliDecompressInternal writes into the destination buffer with no limit. It just runs until the stream ends, whatever size the buffer is. If you control the firmware image, you declare a small output size (or use the UINT64 to UINT32 truncation), the DXE core allocates that much, and the decompressor writes past it. That’s a heap overflow in DXE, before Secure Boot.

I have an ASAN-confirmed PoC. I also built an end-to-end demo that corrupts adjacent pool objects in a controlled way: it hijacks function pointers and overwrites the Secure Boot flag with bytes I choose.

The catch is that I couldn’t find anyone using it. I scanned 200 shipping firmware images from LVFS and searched public GitHub repos, and found zero platforms that use Brotli GUIDed sections. The code is in the tree but looks unused in practice. That’s one scan of 200 images, so it doesn’t rule out private platforms. I still think it should be fixed, because anyone who adopts Brotli later would inherit the bug.

Write-up, PoC, demo and the LVFS scan: https://github.com/lukr54/edk2-security

EDK2 issue: tianocore/edk2#13391

Hi,

as the title suggests, I'm super confused regarding what's going on in the VR domain. specifically N day windows researcher openings. I was just about to start an osed crack course, however, I don't see job openings anywhere.

what's happening, why is nobody hiring for these positions anymore

i know the traditional VR firms, however, any suggestions/guidance/networking helps.

Hello everyone,

I recently passed the OSCP and I don’t want to rest on my laurels; I’m thinking the next certification might be the OSED - that’s a whole new level.

But first, to prepare myself for the OSED, I’m thinking of taking the CRTO 1 & CRTO 2 (CRTL) exams from Zero Point Security. What do you think?

I'm exploring an idea for PS4 security research and would like to understand whether it's technically feasible.

Concept: Could a specially crafted DVD trigger a vulnerability when the PS4 reads or opens it in a supported application, potentially leading to arbitrary code execution and, if further security boundaries could be bypassed, elevated privileges such as root or kernel access?

I'm interested in understanding:

- Whether DVD playback or disc parsing provides a realistic attack surface.

- Whether malformed media or filesystem structures could trigger exploitable vulnerabilities.

- What obstacles exist between application-level code execution and root/kernel privileges.

- Whether there is existing research relevant to PS4 firmware 14.00.

This is currently an idea, not a working exploit. I'm looking for technical feedback, relevant research, and an assessment of its feasibility.

Hey everyone I have a question I am just curious how malware developers use Claude code and codex for helping write malicious code, how they break the guard rail? Isn't it hard?

Hello everyone,

I'm a Pwn CTF player with a strong passion for binary exploitation, low-level programming, and understanding how things work under the hood...... But these days I think I face problems in thi carrer starting from what to learn to how to do it to is it even right to learn with AI, so I need aome advices in this field and what should I focuses on as someone whose goal is to a skilled exploit developer and ofc for real world so should continue with ctf like pwn.college(I am very close to finish yellow belt) and should i master reverse engineering with details and low level programming and memory management to reach my goals and the most important thing is it worth it as a carrer especially when AI can do everything....

Hey everyone, I am the creator of OshoosiClaw (OpenỌ̀ṣọ́ọ̀sì), an open source autonomous Endpoint Detection and Response agent built in Rust for Linux and Windows.

Traditional user mode sensors often rely on cloud telemetry and remain vulnerable to kernel callback blinding, BYOVD handle stripping, and modern AI agent breakouts. I built OshoosiClaw to operate as a local first, decentralized immune system that enforces security directly at the kernel and hardware boundaries while keeping its working set under 250 MB.

On the defense side, it pairs a Windows Ring 0 Minifilter and ELAM driver with Linux BPF_PROG_TYPE_LSM hooks and a sub 20 microsecond Cgroup v2 freezer quarantine. It includes an in memory 101 table SQL telemetry engine (siquery), an autonomous reverse engineering subsystem using Magika and YARA X synthesis, a 14 engine detection pipeline, and multi ring containment mapped to MITRE ATT&CK and ATLAS for local AI agents. Nodes share intelligence over a libp2p GossipSub mesh secured with hybrid post quantum cryptography (ML KEM 768 and ML DSA 65), BLAKE3 Merkle audit chains, and differential privacy.

I am looking for both Rust developers and offensive security folks or pentesters to put this through its paces:

For Pentesters and Red Teamers: I want you to try and break it. Throw your custom loaders, process hollowing techniques, unhooking PoCs, BYOVD payloads, and prompt injection or agent breakout chains at it. You can also run the built in 16 vector adversarial gauntlet (osoosi redteam --suite all) or test against the active thread tarpit and synthetic anti blinding canaries to see where the detection or containment logic folds.

For Rust and Kernel Developers: If you enjoy working on eBPF, Windows kernel drivers, low latency systems programming, P2P networking, or local ML inference, I would love your eyes on the architecture, code quality, and performance bottlenecks.

Pre built v1.2.0 packages (.msi, .deb, .rpm, and hardened Docker images) and full source are live on GitHub:https://github.com/oyesanyf/OshoosiClaw

If you find a bypass, trigger a false positive, or want to contribute a crate improvement, please open an issue or PR, or drop a comment below. Looking forward to your feedback.

oyesanyf

So I’ve been really interested in learning reverse engineering for a while and only tried my hand at a few crackmes so far. I found reverse engineering interesting because it feels rewarding to be able to piece together what the original code might have looked like and why the program behaves the way it does. I liked identifying variables and reconstructing data structures by reading the assembly or generated pseudo code by tools like ghidra since getting them right felt rewarding. Recently with AI becoming really good at the same things, I’m left wondering whether it’s worth it to learn these skills anymore. People were able to decompile and port entire games just using AI much faster than any person can. It’s left me feeling really discouraged about reverse engineering and wondering whether I should focus on other areas of exploit dev

Hey everyone,

Transitioning from Windows exploit dev to iOS vulnerability research. I'm currently deciding between two Mac mini options at the same price point:

Option A: M5 Pro (24GB RAM / 512GB SSD)

Option B: M6 Base (32GB RAM / 1TB SSD)

My setup & workflow:

3-monitor workstation setup (though I'm willing to trade/drop one monitor if going for 32GB RAM is objectively better).

Heavy static analysis in IDA Pro / Binary Ninja (dyld shared cache & XNU).

Tethered debugging (lldb/Frida) on a physical iPhone X.

The Dilemma:

The base M6 is hardware-limited to 2 external displays, while the M5 Pro handles 3 native displays.

Since I believe target execution happens on physical hardware, is 24GB RAM on the M5 Pro enough? Or would you trade a monitor to get 32GB RAM on the base M6?

Thanks!

I'm a beginner-to-intermediate CTF player focusing on reverse engineering and binary exploitation.

My usual workflow is to attempt a challenge myself, then sometimes let AI solve the binary when I'm completely stuck. I don't immediately copy the solution into a writeup. I reproduce the steps in my own environment, ask follow-up questions to understand the reasoning, cross-reference the explanations with documentation and Google, and write my own explanation in Word.

I believe reading writeups is a legitimate way to learn, and we don't need to reinvent the wheel every time. However, I'm concerned that letting AI solve the challenge first might prevent me from developing independent problem-solving skills.

For experienced RE/pwn players:

Is this a reasonable way to learn?

Where do you draw the line between AI-assisted and AI-solved?

Should I spend more time struggling with challenges before asking AI?

How do you ensure you can solve unfamiliar binaries independently?

Should I not use the AI completely?

I'd appreciate your honest opinions and advice!

hey there so i will be straight to the point iam learning c right now and my current roadmap is this first learn c from the beej guide to c programming and then learn assembly from this resources https://0xinfection.xyz/reversing/pages/part-1-the-cyber-revolution.html and then learn windows internal and then finally heavnly wizardy 101 so my question is that is dsa necessary to become malware analyst do i need to grind the leetcode as well what do you guys says and currently i have finished pointers struc and typedef from the beej guide and iam currently right now in memory allocation so guys please tell me should i follow this roadmap and not learn dsa and also how is my roadmap including my resources.

Am I the only one who finds it annoying when a website uses .blob URLs for media/content that can only be played inside that specific page?

I was wondering if it would be possible to build a browser extension that hooks into SourceBuffer.appendBuffer() and observes the binary chunks being passed to it.

The concept would be pretty simple:

Server → encrypted/chunked data → browser → appendBuffer() → decoder/player

The extension would collect the buffers as they arrive, keep them in the correct order, and potentially reconstruct the original resource from those fragments.

Not talking about breaking DRM or decrypting something the browser itself can't decrypt. More like:

If the browser receives and processes the data, why can't we have a DevTools-like tool that lets us inspect and reconstruct those buffers?

Something like a "Blob Inspector":

• Intercept appendBuffer() calls
• See the individual chunks
• Track their order/size
• Reassemble them
• Identify the resulting media/container format
• Export the reconstructed data when possible

It seems like Network DevTools gets you close, but .blob/MSE-based streaming makes it surprisingly difficult to get back to the actual resource.

Has anyone already built something like this?

Or is there some fundamental browser/MSE limitation that makes this approach impractical?