Shaechi Security Research

[flanker017 @flanker_hqd]

We're releasing CyvisGuard - an open-source security control plane for AI agents. Checking the identity, delegation chain and authorized scope behind every call and deciding on the tool's capability and data flow. https://t.co/IOBuJAhDqD

[Off-By-One Conference @offbyoneconf]

Catch @PicassoLay, @TheDog0402, @hzshang15, and @_3ndy1 from @dawnseclab as they dissect and demonstrate how their specialised three-stage LLM workflow uncovered 13 unknown V8 sandbox bypasses and semantic variants missed by modern fuzzers!

More info: https://t.co/ZHmIbQOZhv

[Shaechi Security Research @ShaechiSec]

Code Data Privacy, all in your control. Check out this newest project.

[flanker017 @flanker_hqd]

I built an open-source AI phone: OpenCyvis.
An AI that sees your screen and operates your apps is the most privileged software on your phone. You should choose what model runs it, see where your data goes, and audit every step.
🔗 https://t.co/CHhJSSQtSf | https://t.co/dzrD4xCuAl

[hzshang @hzshang15]

Here is a detailed bug analysis for MALI GPU CVE-2025-XXXX(6349|8045). We implements a stable privilege escalation on the latest version of the Pixel 9, and leverage a double-free primitive to arbitrary physical memory RW without any info leak. 👍https://t.co/hJqRwUhwfM

[Shaechi Security Research @ShaechiSec]

Checkout this open-sourced handy MCP server for JEB decompiler by us: https://t.co/LXSEFtSbFx . Contributions and use cases are always welcomed.

[flanker017 @flanker_hqd]

Years later it’s still thrilled to be on #DEFCON stage. The presentation has been released here: https://t.co/NYNGSYf0zk

[Shaechi Security Research @ShaechiSec]

New blog post: A journey in Android physical memory - writeup on exploiting recent GPU bug CVE-2025-21479 https://t.co/9aSzddEzK3

[Shaechi Security Research @ShaechiSec]

The open-sourced version is finally here! https://t.co/UKaScLodYm We're still adding support for some corner cases, so keep an eye for future updates.

[Shaechi Security Research @ShaechiSec]

Our presentation at this year's Black Hat Arsenal on Decompiler for HarmonyOS NEXT. Stay tuned for future open source release.

[flanker017 @flanker_hqd]

Our talk on #BadResolve series of CVEs in Android happening soon at 13:30 #defcon33 Main Stage: LVCC - L1 - Exhibit Hall West 3 - Track 4!

[Shaechi Security Research @ShaechiSec]

We will be talking about the #BadResolve series of vulnerabilities we found in Google Android at this year's #defcon33 Main Stage: LVCC - L1 - Exhibit Hall West 3 - Track 4. Hope to see you there!

[Shaechi Security Research @ShaechiSec]

Our presentation at this year's Black Hat Arsenal on Decompiler for HarmonyOS NEXT. Stay tuned for future open source release.

[Positive Technologies Global @PTsecurity_EN]

How do you pwn billions of devices with one shot? @cnwatcher reveals a stealthy Android exploit that hijacks keystore keys, bypasses perms, and opens the door to root. Get know more on #PHTalks Jakarta: https://t.co/mOSs5IS2af

[Shaechi Security Research @ShaechiSec]

New post: https://t.co/5hdBHqve8t writeup for CVE-2025-22056, which we also found but collide with other researchers. A nice bug that can be stably exploited to get kernel privilege on Ubuntu.

[Off-By-One Conference @offbyoneconf]

Punching 🥊 presentation from @hzshang15 , 𝐒𝐢𝐦𝐩𝐥𝐞 𝐢𝐬 𝐁𝐞𝐬𝐭: 𝐓𝐡𝐞 𝐣𝐨𝐮𝐫𝐧𝐞𝐲 𝐨𝐟 𝐭𝐚𝐤𝐢𝐧𝐠 𝐨𝐯𝐞𝐫 𝐦𝐨𝐛𝐢𝐥𝐞 𝐬𝐲𝐬𝐭𝐞𝐦 𝐮𝐬𝐢𝐧𝐠 𝐚 𝐆𝐏𝐔 𝐥𝐨𝐠𝐢𝐜𝐚𝐥 𝐛𝐮𝐠.
We 🩷 it at @offbyoneconf 2025!

[Off-By-One Conference @offbyoneconf]

Shang Hongze (@hzshang15) is a senior security researcher at @dawnseclab.

Hongze presents his research on Android GPU components over the past year, a vulnerability he has found, how he achieved local privilege escalation... and more!

More info: https://t.co/XIHUkbGj9A

[flanker017 @flanker_hqd]

Years later it's thrilled to back to Vancouver and speak again at CanSecWest. Brought to mind the good old days of playing Pwn2Own.

[Off-By-One Conference @offbyoneconf]

@hzshang15 𝐒𝐡𝐚𝐧𝐠 𝐇𝐨𝐧𝐠𝐳𝐞, will be presenting his paper "𝐒𝐢𝐦𝐩𝐥𝐞 𝐢𝐬 𝐁𝐞𝐬𝐭: 𝐓𝐡𝐞 𝐣𝐨𝐮𝐫𝐧𝐞𝐲 𝐨𝐟 𝐭𝐚𝐤𝐢𝐧𝐠 𝐨𝐯𝐞𝐫 𝐦𝐨𝐛𝐢𝐥𝐞 𝐬𝐲𝐬𝐭𝐞𝐦 𝐮𝐬𝐢𝐧𝐠 𝐚 𝐆𝐏𝐔 𝐥𝐨𝐠𝐢𝐜𝐚𝐥 𝐛𝐮𝐠 at #OBO2025! https://t.co/kqZdOX5SUT… https://t.co/CIUprT9zI6

[flanker017 @flanker_hqd]

Finished our talk at @BlackHatEvents with @Guluisacat. Will be hanging around today and tmw at @defcon and 0x0G. Chats and meetup are always welcomed.

[Zhongquan Li @Guluisacat]

#BHUSA @BlackHatEvents My Black Hat USA 2024 presentation is finished. Thank you all for coming.

In my presentation, I disclosed some methods to achieve SBX and LPE. Many of them require launching an app, so in an attack scenario, the user may notice an app icon briefly flashing in the Dock as it appears and disappears quickly, which might not be ideal for weaponization. Actually there are some tricks to hide the icon and exploit these vulnerabilities silently, without any notifications. Since many vulnerabilities are currently being patched, disclosing these tricks might cause harm to users, so I may disclose them next year. Or you can try them yourself : )

By the way, good luck with your bug hunting🍻🍻The SBX approach works across many macOS versions.

You can find the PPT here:
https://t.co/O50hsdVNwm

[Shaechi Security Research @ShaechiSec]

We will be at Las Vegas this year to deliver our talks by @Guluisacat @flanker_hqd @TheDog0402 at @BlackHatEvents, see ya