karollol

CS Student/Reverse Engineering/Open for employment and collaboration

[karollol @karollooool]

@Cluely's Vibdecoded premium tiers are unlocked by a simple script.

I withheld the technical PoC deliberately after being burned by amateur VDPs in the past and shared only an impact video to start a secure dialogue first. Silence.

If no response soon, I post the redacted demo

[karollol @karollooool]

Submitted a Windows kernel info disclosure to MSRC

A zero capability LPAC process can read the user mapped win32k desktop heap and recover kernel pointer material from the heap metadata

The useful part is turning that into exact win32k object address recovery

[karollol @karollooool]

if Cluely won’t engage, maybe their users should know how thin that overpriced "premium" veil really is.

[karollol @karollooool]

@Cluely's Vibdecoded premium tiers are unlocked by a simple script.

I withheld the technical PoC deliberately after being burned by amateur VDPs in the past and shared only an impact video to start a secure dialogue first. Silence.

If no response soon, I post the redacted demo

[karollol @karollooool]

@tulachsam Are you hiring ex cheat devs/sellers too?

[karollol @karollooool]

@SecurityMB I am still working on my bachelors but I am open to dropping it for such a job. You can check my profile for practical real world experience!

[karollol @karollooool]

@cluely You maybe should look into your BB submissions after vibecoding the whole infrastructure... I am asking once again for an answer so that we can do responsible disclosure.

[karollol @karollooool]

Trying to coordinate a security report with @cluely for over a week via their disclosure channels. Would appreciate a response. I only submitted a showcase video, not PoC details, due to past poor VDP experiences of companies scamming researchers...

[karollol @karollooool]

@h4x0r_dz Used it on my professors backend right after it got released

[karollol @karollooool]

CVE-2026-31431 - ported to a sandboxed Java runner. no memfd, no process_vm_readv, no native binaries.

- Python ELF builder
- Java 21 FFM syscall layer
- javac annotation processor for privesc

credit: Xint Code

https://t.co/cUjmerDbBw

[karollol @karollooool]

CVE-2026-31431 - ported to a sandboxed Java runner. no memfd, no process_vm_readv, no native binaries.

- Python ELF builder
- Java 21 FFM syscall layer
- javac annotation processor for privesc

credit: Xint Code

https://t.co/cUjmerDbBw

[karollol @karollooool]

Second writeup is up on GitHub: VVM (HTB RE). Tiny custom VM, XOR decoded handlers, bytecode turned into a clean constraint system, then solved in script.

https://t.co/FpP45su8d3

[karollol @karollooool]

today I decided that I will post writeups on github. first one is Callfuscated, an Insane RE challenge on HackTheBox. callfuscation + custom VM hiding 4 obfuscated functions. GDB did what static analysis could not. https://t.co/ER2sMG0Cj0

[karollol @karollooool]

@akramcodez PostgreSQL and MongoDB

[karollol @karollooool]

@dev_maims Definitely C because most of the modern infrastructure runs only because of C

[karollol @karollooool]

@BendikMatej @dev_maims The only right answer

[karollol @karollooool]

@psomkar1 Vim on Linux and Visual Studio on Windows and not NOT Vscode the glorified text editor.

[karollol @karollooool]

@kaif9999 Hi 👋🏻

[karollol @karollooool]

@dipalitwt None. Visual studio.

[karollol @karollooool]

@JobFound5 Interested, check out my website at https://t.co/7MU7IwPMg9

[karollol @karollooool]

@dopabees Check out my portfolio at https://t.co/7MU7IwPMg9

[email protected]

[karollol @karollooool]

@CodeByNZ Vscode is just a glorified text editor with features and Visual studio is a proper IDE