hexamine

ctfs with @ARESxCTF, @ProjectSEKAIctf, @malta_ctf

[hexamine @hexamine22]

a bit late, but I finished 11th this year in flareon :p #flareon12

[Zhuo Zhang @i2huer]

Something to share: we built a benchmark for evaluating agentic reverse engineering.

- instead of grading intermediate outputs, e.g., recovered types/names

- we evaluate agents e2e on deterministic goals, e.g., JTAG a firmware to enable its debug mode.

https://t.co/wD3INXYaaQ

[Can Bölük @_can1357]

well this was a waste of tokens.
presented without commentary:

[Back Engineering Labs @BackEngineerLab]

Static Devirtualization of Tencent VM. There are many others with similar results to ours, we have had the VM devirtualized for several months now. Others are posting full devirt bins, so we feel it is ok to release our research now.
https://t.co/0Aog04fEvv

[V12 @v12sec]

https://t.co/fB0ZzGD6re

[hexamine @hexamine22]

@willington1337 goat!

[Robert Chen @NotDeGhost]

We're launching a $100,000 fund to save CTFs.

[hexens @hexens]

1/
we found a bug in the Aptos Move VM that put up to $70B at systemic risk. type confusion at the execution layer. a ~90% success rate across hundreds of simulated runs on a 30+ validator cluster. cost to build the attack infrastructure: $3,000.

Conducted by @kemmio , to our knowledge this is the first public research that showcases how to land a sophisticated multi-block attack in real-world environments. It includes mempool feng shui, block production specifics and about a dozen of other primitives and tricks chained to get to near-perfect exploitation results.

Nonetheless, Aptos called it "extremely low exploitability."

[https://t.co/vjeLaENYn0]

[hexamine @hexamine22]

@es3n1n goat!

[V12 @v12sec]

AnyPwn: AnyDesk preauth 0click RCE (heap buffer overflow)

we will release PoC post disclosure and patch

[V12 @v12sec]

we have server RCE now too. with client + server, this is now wormable 😄

we have some other wormables too :D stay tuned

[Sinaei @Intel80x86]

I'm pleased to announce @HyperDbg v0.19.

This release introduces a new module, HyperTrace, which brings hypervisor-level integration w/ tracing technologies such as Last Branch Record (LBR) & Processor Trace (PT).

LBR is now available, with more coming.

https://t.co/fW77MvILax

[Renwa @RenwaX23]

"Dad, what was it like playing CTFs before AI?"

[TrustSec @TrustSecAudits]

Imagine CEO of a security firm showcasing 6 of his "best" auditors running an 11-week audit and missing 11 highs, 17 meds, then running it as a success story for their automated scanning tool.

All these finds are superhuman? Prove it.
Humans didn't have time to find them? Then you heavily underscoped required effort.

Doesn't strike as a confidence booster to clients paying deep 6-figures for an audit and expecting reasonable coverage.

At TrustSec we'd rather lose the deal than ship a report we can't defend, but maybe that's just us.

[hexamine @hexamine22]

@fl0ct0 happy birthday!!

[slonser @slonser_]

And this makes sense given how many CTFs are held per year.
However, the ideal CTF challenge, in my opinion, should follow this formula:
"The author conducted a mini-research project and instead of publishing it, turned it into a challenge."

[hexamine @hexamine22]

@f0ur0four my goat

[Buzzer @buzz3r_]

I decided to try out agentic coding/reversing, so I’m releasing a project that assists with reverse engineering in both Binja and IDA Pro. It’s an agent, not an MCP, that support multiple providers, it has some interesting features such as code exploration
https://t.co/VCY5et5LYq

[hexamine @hexamine22]

@dudcom3 It depends on the obfuscation, but in general, if it’s some random ollvm fork, then yeah, you’re pretty much cooked. LLMs can handle those without much issue.

[hexamine @hexamine22]

@dudcom3 Hmm, true. I think LLMs can handle most obfuscation found in in the wild malware. Also true that LLMs will definitely lower the barrier to entry for deobfuscation, but I’m not sure they’ll affect commercial obfuscators (which I was talking about in my point) as much though.