伍默 retweeted
Someone dropped this Windows LPE writeup online yesterday along with a PoC.
But the mentioned CVE-2026-62737 is not released yet, maybe it will be in the Patch Tuesday tomorrow.
And the PoC still work in the lastest version of Windows 😂
xz.aliyun.com/news/92658
伍默 retweeted
My #BHUSA 2026 slides are online!
It was an honor to share our AFD research and how a different perspective led to 30+ Windows kernel vulnerabilities.
Blog post coming soon — check out the slides here:
i.blackhat.com/BH-USA-26/Pre…
伍默 retweeted
Finally got around to getting a working PoC of my native object file to LLVM IR lifter.
Started this small side-project to see how far can I push my own VM tech and perhaps transpiling existing tradecrafts, executables and post-ex toolings by simply lifting them up to LLVM IR via remill (by @trailofbits) and have them being recompiled into a format of my choosing such as my bytecode or even perform other passes on the IR and back to it's original format.
Still WIP but as least the lifting and recompilation works flawlessly. FYI the original obj file does not have the LLVM bitcode embedded, I want it to work on any native formats but for now object files should be sufficient 🙃
伍默 retweeted
Static Devirtualization of Tencent VM. There are many others with similar results to ours, we have had the VM devirtualized for several months now. Others are posting full devirt bins, so we feel it is ok to release our research now.
back.engineering/blog/31/07/…
伍默 retweeted
Our VR team's new research is out! There is an exploitation chain called OnlyShells of 3 vulnerabilities that grants NT AUTHORITY\SYSTEM privileges by just opening a specially created document in ONLYOFFICE Desktop Editors.
You can read full report here: bi.zone/eng/expertise/blog/l…
伍默 retweeted
A bunch of my bugs are patched today. One fun bug is CVE-2026-58536, UAF in the cldflt.sys . It is a patch bypass of CVE-2025-62221, caught exploited ITW by Microsoft Threat Intel.
I bypassed the patch and exploited it as part of the Microsoft Exploit Research Challenge.
伍默 retweeted
I am making the materials for my undergrad Compiler course freely available: LigerLabs.org/compilers.html. There are currently 26 lecture modules, each consisting of a ~20 minute video, slides, in-class exercises, and take-home assignments. Support: NSF/SATC/EDU.
伍默 retweeted
Following the idea of @eversinc33 and thanks to Claude I was able to lift the VM bytecode to LLVM IR, but due to the stack model, and the calling convention inside of the bytecode, the lifted code doesn't look so fancy 😂😂😂. Link next
Recently @quarkslab published a solution of a CTF using TritonDSE and QBDI where they analyzed a VM protected binary, and I thought "Shit, I want to analyze something too...". And this weekend I did an analysis of another crackme with a custom VM but this time using Triton! 🧵
伍默 retweeted
Very cool research done by my mate Marcos 🙌
nccgroup.com/research/async-…
伍默 retweeted
Spent the last 2 weeks working on a devirtualizer for VMProtect 3.5 and learning Remill. Idk yet if I will blog about it, but I at least wanted to publish the code:
github.com/eversinc33/MogVMP
The approach is different from my last blog, as it lifts the whole x86 code of the VM
伍默 retweeted
Last time I dealt with MSRC
I found a command injection vulnerability present for a decade in context menus, not highly critical but still exploitable. (see my talk Shift Happens)
MSRC did not reward a bounty nor did they attribute a CVE to this finding because this ”doesn’t meet [their] criteria as a vulnerability that requires an immediate security update”
However, this was fixed a month later in Windows 11 Canary (10.0.27902.1000).
Case closed.
microsoft.com/en-us/msrc/blo…
伍默 retweeted
Spent some time battle-testing my LLVM Python bindings by building a basic lifter for x86: secret.club/2026/05/21/strig…
伍默 retweeted
After my last post I aimed at devirtualizing VMProtect 3.5 next. First milestone is reached and my lifter can lift single virtualized functions with static CFGs to LLVM and the VMP layer folds away. Next up are some more elaborate functions, but this made me very happy :3
伍默 retweeted
Wrote up some notes on the Windows Kernel Segment Heap — how allocations are routed across kLFH, VS, Segment, and Large paths, how headers are encoded, and what that means for exploitation post-19H1.
kernullist.github.io/kernull…
伍默 retweeted
As promised - full blog post is live for CVE-2026-40369
Covers everything: initial research, methodology, the exploitation path, caveats, cleanups, etc. The whole journey from finding it to production-grade exploit:
pwn2nimron.com/blog
4/4:
Last but not least CVE-2026-40369 - Windows Kernel Arbitrary Increment primitive reachable from any browser sandbox renderer process
This one was rejected from Pwn2Own and closed anyway yesterday :(
My exploit is here - blogpost will be soon:
github.com/orinimron123/CVE-…
伍默 retweeted
PlatinumLab at #Pwn2Own Berlin 2026.
Kaijie Xu @kaijieguigui / Chengbin Wang @cbwang505 / Qiqi Chen @carmen_cqq
Windows 11 SYSTEM in <10s.
Respect to @thezdi team for making our special contribution possible.
Hacker spirit, no borders.
@TheZDIBugs #P2OBerlin #0day
伍默 retweeted
N-day exploits from Patch Tuesday used to require dedicated VR teams. @tyholms built the same workflow from off-the-shelf parts for ~$300 per CVE. The skill and resources gating this work are now within reach of any threat actor with a credit card.
originhq.com/blog/patch-diff…
