伍默

灵活就业的理论派玩家

一言不合移除关注者

我主要会移除和拉黑：非技术从业者 三无号（没有喜欢 ， 没有原创推文 ，没有回复），不正常账号 ， 我不认可者。 

一般不会回关，如果你的内容我觉得认可，我会回关。

总之，非常主观，如果你想解释，可以直接私信。

发的内容包含技术和我的部分日常。

[伍默 @_wumo]

个人推文不定时删除。
基本上我的回复给我想要的人看到了，我就会删除。
我所有的推文都会在这条推文下发布。

[Farenain @Farenain]

Following the idea of @eversinc33 and thanks to Claude I was able to lift the VM bytecode to LLVM IR, but due to the stack model, and the calling convention inside of the bytecode, the lifted code doesn't look so fancy 😂😂😂. Link next

[ATTL4S @DaniLJ94]

Very cool research done by my mate Marcos 🙌

https://t.co/10pE6Lj6ki

[eversinc33 🤍🔪⋆｡˚ ⋆ @eversinc33]

Spent the last 2 weeks working on a devirtualizer for VMProtect 3.5 and learning Remill. Idk yet if I will blog about it, but I at least wanted to publish the code:

https://t.co/GLqKWpOOU7

The approach is different from my last blog, as it lifts the whole x86 code of the VM

[Rémi GASCOU (Podalirius) @podalirius_]

Last time I dealt with MSRC

I found a command injection vulnerability present for a decade in context menus, not highly critical but still exploitable. (see my talk Shift Happens)

MSRC did not reward a bounty nor did they attribute a CVE to this finding because this ”doesn’t meet [their] criteria as a vulnerability that requires an immediate security update”

However, this was fixed a month later in Windows 11 Canary (10.0.27902.1000).

Case closed.

https://t.co/8PFw4xs7Bx

[Duncan Ogilvie 🍍 @mrexodia]

Spent some time battle-testing my LLVM Python bindings by building a basic lifter for x86: https://t.co/Z1T1073RkU

[eversinc33 🤍🔪⋆｡˚ ⋆ @eversinc33]

After my last post I aimed at devirtualizing VMProtect 3.5 next. First milestone is reached and my lifter can lift single virtualized functions with static CFGs to LLVM and the VMP layer folds away. Next up are some more elaborate functions, but this made me very happy :3

[kernullist @kernullist]

Wrote up some notes on the Windows Kernel Segment Heap — how allocations are routed across kLFH, VS, Segment, and Large paths, how headers are encoded, and what that means for exploitation post-19H1.

https://t.co/yuZ0W2jb4G

[Ori Nimron @orinimron123]

As promised - full blog post is live for CVE-2026-40369
Covers everything: initial research, methodology, the exploitation path, caveats, cleanups, etc. The whole journey from finding it to production-grade exploit:

https://t.co/XhRTncgRfd

[kkkkk @carmen_cqq]

PlatinumLab at #Pwn2Own Berlin 2026.

Kaijie Xu @kaijieguigui / Chengbin Wang @cbwang505 / Qiqi Chen @carmen_cqq

Windows 11 SYSTEM in <10s.

Respect to @thezdi team for making our special contribution possible.

Hacker spirit, no borders.

@TheZDIBugs #P2OBerlin #0day

[Origin @originhq]

N-day exploits from Patch Tuesday used to require dedicated VR teams. @tyholms built the same workflow from off-the-shelf parts for ~$300 per CVE. The skill and resources gating this work are now within reach of any threat actor with a credit card.

https://t.co/EKEyJctrwd

[winterknife 🌻 @_winterknife_]

One cable to rule them all:
1) KDUSB debugging
2) USB EEM debugging
3) DCI debugging

[TrendAI Zero Day Initiative @thezdi]

DEVCORE is having a day! Confirmed: Angelboy (@scwuaptx) & TwinkleStar03 (@_twinklestar03) of DEVCORE Research Team used an Improper Access Control bug to escalate privileges on Microsoft Windows 11, earning $30,000 and 3 Master of Pwn points. Full win, let's go! 🔥 #Pwn2Own #P2OBerlin

[b0t 👽🏴‍☠️ @bot59751939]

I stole this and I don't know who originally made it but it's gold. Anyway I'm going to drop a simple 0day in a day or two. It's not perfect and there are conditions to it working (as with all bugs). I didn't disclose it, I don't know how original it is(it wasn't that hard to find) but it does give you rce on an apache product. See you soon friends.

[Het Mehta @hetmehtaa]

New Windows privilege-escalation primitive just dropped.

GreenPlasma is a minimal PoC that forces creation of an arbitrary section object inside any directory writable by SYSTEM via CTFMON’s named-object cache.

Let me break it down for you:

[Alex Matrosov @matrosov]

Lately I've been thinking about how AI is changing vulnerability research and reverse engineering. VR and RE are some of the hardest workflows to parallelize. Even with great knowledge transfer and team practices, you usually default to one person per vuln or RE task. The work is just too context-heavy to split.

AI breaks that ceiling. It's no longer "one researcher, one task", it's you working one angle while Claude annotates disassembly code, explores another path, or helps you piece together what the last result means.

Watching this land in domains we assumed were fundamentally serial is wild.

[starlabs @starlabs_sg]

We are back. 🥳💪🏼

[impulsive @weezerOSINT]

How it works:

1. Recovery tools look for a config file called RecoverySimulation.ini on the OS drive
2. If Active=Yes, it enables "test mode" for the recovery tools
3. Test mode unlocks your BitLocker drive but a flag called FailRelock tells it to skip relocking
4. cmd.exe spawns with full access to your "encrypted" drive

[b0t 👽🏴‍☠️ @bot59751939]

https://t.co/DmhtElzjJ4

[Nightmare Eclipse @ChaoticEclipse0]

Two more zerodays - https://t.co/kUgSQqq0s8

[vx-underground @vxunderground]

Yippie

Two new Microsoft Windows 0days. The exploits have cool and badass mysterious names to be extra spoopy

- GreenPlasma: Windows CTFMON Arbitrary Section Creation Elevation of Privileges Vulnerability
- YellowKey: Bitlocker Bypass Vulnerability

https://t.co/VaWFtW5lFi