exploit development | reverse engineering
Joined February 2024
- Tweets273
- Following228
- Followers62
- Likes554
Carolina Trigo retweeted
Proper old-school hacker energy.
If you're into Windows internals, exploit development, malware memory or reverse engineering, Forrest Orr's (@_ForrestOrr) work is absolutely worth bookmarking.
The FREE archive covers:
- Windows memory corruption
- Stack overflows + ROP
- DEP, ASLR + CFG
- Shellcode development
- Windows internals
- Malware memory artifacts
- Phantom DLL Hollowing
- Process injection + hollowing
- Memory scanner evasion
- Moneta memory analysis
- PE internals
- Browser exploitation
- Chrome UAF exploitation
- Firefox / IE exploit chains
- Sandbox escapes
- Defensive memory analysis
And unlike a lot of modern security content, there are actual tools, PoCs, shellcode and exploit-development experiments to go with the research.
Blog:
forrest-orr.net/
ExploitDev repo:
github.com/forrest-orr/Explo…
Some of this is older material, but that's part of what makes it good. Proper fundamentals and low-level research that still teaches you how the machinery actually works.
Huge credit to Forrest Orr (@_ForrestOrr) for keeping it publicly available.
#ExploitDevelopment #WindowsInternals #ReverseEngineering
Carolina Trigo retweeted
‼️ A newly disclosed critical Linux kernel flaw, PwnEscape (CVE-2026-99999), lets code inside guest VMs read host memory and enabled VM escape with root access in lab tests.
Read - thehackernews.com/2026/10/cr…
Vercel confirmed the memory leak in its live production sandboxes during its $1 million security challenge.
The flaw lies in Linux networking, not the hypervisor, with implications beyond Vercel.
Carolina Trigo retweeted
We finally got this series out. We tried to simplify Linux kernel exploitation for those interested in getting started. There are plenty of resources out there, but my impression is that they are written for experienced people, not for beginners in this complex field.
In this series, we tried to do something close to real-world kernel exploitation, but much simpler, so people can use it as a first contact with Linux kernel exploitation. I hope people like it, and we will be available to help anyone who wants to reproduce all the content.
Have you ever wanted to get started with Linux kernel exploitation? We wrote a 4-part blog series aimed at newcomers, going from setting up the environment to bypassing SMEP and KASLR. We exploit a real Linux kernel vulnerability step by step, debugging every crash along the way.
Introduction to Linux Kernel Exploitation: Vulnerability and Environment – Part 1
allelesecurity.com/intro-lin…
Introduction to Linux Kernel Exploitation: Triggering the Vulnerability – Part 2
allelesecurity.com/intro-lin…
Introduction to Linux Kernel Exploitation: Exploitation – Part 3
allelesecurity.com/intro-lin…
Introduction to Linux Kernel Exploitation: Mitigation Bypass (KASLR and SMEP) – Part 4
allelesecurity.com/intro-lin…
Carolina Trigo retweeted
26 LLM routers are secretly injecting malicious tool calls and stealing creds. One drained our client $500k wallet.
We also managed to poison routers to forward traffic to us. Within several hours, we can directly take over ~400 hosts.
Check our paper: arxiv.org/abs/2604.08407
Carolina Trigo retweeted
New linux-insides chapter is out!
Continue to investigate different data structures and how they are implemented in the Linux kernel.
This time: Bitmaps in the Linux kernel 0xax.dev/books/linux-inside/…
Carolina Trigo retweeted
Assembly language is NOT machine language.
When I was a kid, we wrote our own assemblers, so we all learned what the difference was between machine code and assembly language.
The game below was written in assembly language, and then assembled into machine language (ie: binary), and that is how it is shipped. It can still be reversed back to something like its source language.
Consider the assembly language instructions:
MOV R0, 0
JMP LABEL
You can't know what "LABEL" is on the first pass, so the assembler builds the entire image, determines how far away LABEL is, where it lives and at what address, and replaces LABEL with that value on the second pass.
In other words, translating from assembly language to machine code requires real work; it is NOT a simple translation.
SOME things are deterministic, like your "MOV R0, 0" is immediate mode, so you know the opcode. But anything that touches a memory address has to be computed during the assembly passes.
Carolina Trigo retweeted
If you're into Windows internals, kernel development or reverse engineering, bookmark this.
@codemachineinc has an incredible FREE archive of low-level Windows research covering:
• WinDbg + kernel debugging
• Windows kernel data structures
• Kernel callbacks
• NTOSKRNL internals
• EX_FAST_REF pointers
• TEB internals
• Prototype PTEs
• x64 kernel virtual address space
• System call internals
• Windows on ARM
• Interrupt dispatching
• KMDF internals
• WFP + WSK + AFD
• Kernel threads
• Physical memory analysis
• Driver development + debugging
There are also some absolute gems like using WinDbg to analyze/remove Poison Ivy RAT and a full catalog of key Windows kernel structures.
A lot of the material is older, but the fundamentals are still extremely valuable for understanding Windows under the hood.
Full FREE article archive:
codemachine.com/articles.htm…
Huge credit to @codemachineinc for keeping this material publicly available.
#WindowsInternals #ReverseEngineering #KernelDevelopment
Carolina Trigo retweeted
a lot of people dont appreciate the difference in required effort for a 1% reliable mem corruption exploit vs 10% vs 99% . this post projectzero.google/2026/01/p… by @natashenka expresses this well. the truth is that often a 10% reliability exploit is *no progress to full reliability*
Carolina Trigo retweeted
The boom in Linux CVEs lately should get you thinking.
Surely, given a finite codebase, there are also a finite number of bugs / unintended behavior, thus, a finite amount of vulnerabilities. Theoretically, a “solvable” problem. Right?
Well…not at all actually.
It gets a bit philosophical, but there’s the concept of “weird machines”.
A weird machine is an accidental computer located inside of another computer program. Quite a few exploits (e.g. anything ROP) falls into this category, where the attacker’s instruction set consists of fragments of the original software.
Finite code can *easily* have infinite Unintended Behavior (not undefined behavior btw…that’s a very different thing). Weird machines don’t even have to be Turing complete to be, really, really powerful!
Even if you have a million superhuman AI coders and fuzzers thrown at the Linux kernel, you quickly hit halting-problem-esque uncomputable states. The concept of patching every possible bug until none remain isn’t possible, because we can’t often correctly define what a “bug” even is.
Now, can you make a kernel that truly has zero weird machines relative to a formal specification? ….yes, but it wouldn’t look like Linux. It’d look more like sel4, VxWorks, or (shudder) INTEGRITY-178.
Carolina Trigo retweeted
A Google researcher says the Windows NT kernel still “puts Linux to shame” in many ways.
Laurie Kirk, a former Microsoft reverse engineer, argues that NT was built with a cleaner and more consistent security model.
Linux took a different path, adding capabilities, namespaces, cgroups and SELinux over time.
But her most controversial point is about AI agents.
Kirk argues that Linux permissions are spread across too many mechanisms, while NT handles resources, permissions and auditing more consistently.
She even says that if we designed an OS kernel from scratch in 2026, it probably wouldn’t look like Linux.
Linux engineers are already pushing back, defending the modular approach that helped Linux dominate servers, cloud and containers.
Windows vs Linux just got interesting again.
Full story: windowslatest.com/2026/09/26…
Carolina Trigo retweeted
Flare-on 13 starts in 1 day and you can already sign up for it: flare-on13.ctfd.io/. Apparently they forgot to add a link to it so finding the URL become the 0th challenge. Also I hope they get the time zone correct this time
Carolina Trigo retweeted
Dificilmente faço posts com opiniões ou experiências pessoais por aqui, porque toda vez levo hate pesado, e isso é chato.
Mas acredito que essa experiência não seja só minha, então decidi compartilhar:
Desde que comecei a estudar e a trabalhar com TI, minha vida social diminuiu drasticamente.
Quando eu trabalhava e fazia faculdade presencialmente (na área de administração), tinha muito mais energia para socializar. Mesmo com uma rotina mais puxada, eu realmente interagia mais. Antes que me julguem: defendo com todas as minhas forças o home office e acredito que todo mundo deveria ter a opção de trabalhar de casa.
Por mais que eu faça faculdade, natação, pilates, teatro e outras atividades presencialmente, a interação social mudou. Fora que 1 saída no final de semana, significa acumular matéria pela semana inteira.
O grande problema, ao meu ver, é que quem trabalha com TI está sempre estudando ou trabalhando. Eu sempre falo para os meus amigos: TI parece ser a única área em que as pessoas abrem mão de momentos de lazer — e não, ter canal no YouTube sobre tech, participar de clube do livro técnico ou ir a eventos da área não contam como lazer aqui — para acompanhar lançamento de produto ou passar o fim de semana estudando como resolver os problemas da empresa.
Esses dias perguntei para uma prima se ela fazia cursos ou projetos fora do expediente, e ela disse que não e que tava tudo bem, ninguém a cobrava por cursos ou certificações. Enquanto isso, nós de TI temos uma necessidade absurda de produzir, estudar e falar de tecnologia 24 horas por dia (isso em todas as áreas tech, do júnior ao tech lead).
Com o avanço das IAs, sinto que a cobrança ficou ainda maior, porque o receio e medo do novo mercado é visível.
Enfim, eu amo estudar e não me arrependo de ter entrado na área; escolheria TI de novo sem pensar duas vezes. Mas gostaria que as coisas fossem mais leves.
Carolina Trigo retweeted
Systems programming is easier to understand when you build the things yourself.
LowLevelCraft has 479 hands on tasks covering C, assembly, compilers, CPUs, operating systems, networking, virtual machines, graphics, and storage.
Write code in the browser and test it against hidden cases.
lowlevelcraft.com
Carolina Trigo retweeted
Breaking Windows: Exploring Security Through Kernel Drivers xitter.cf/i/broadcasts/1oKMvNMny…
Carolina Trigo retweeted
On July 25, we hacked OpenAI.
Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc.
We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵
Carolina Trigo retweeted
Today, Project Zero is releasing MAccConc, a tool by @tehjh that enables deterministic testing of race conditions on Linux. It can be used for fuzzing, ad-hoc exploration, regression tests and more!
projectzero.google/2026/09/m…
So this is how modern scamming looks like, huh
We’re sharing a solution to the Navier-Stokes Millennium Prize Problem, one of the deepest problems at the frontier of mathematics.
The proof was produced by a group of agents, using an OpenAI next-generation model significantly more capable than GPT-6 Astra.
The problem concerns whether the description of smooth three-dimensional fluid motion modeled by the Navier-Stokes equations can break down. It has remained unresolved for roughly 90 years.
