Robert Chen

founder @osec_io | web/pwn with @redpwnctf + @dicegangctf | prev @dfsec_com

[Robert Chen @NotDeGhost]

new pfp

[Michael Debono @_mixy1]

I finally did the evidence equipment unboxing

at some point I'll edit the 30 minutes of footage cause there's a lot of things I need to blur 💀

[OtterSec @osec_io]

The writeup is here. We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise.

@ryaagard details a universal, Bedrock-specific technique for bypassing ASLR and achieving arbitrary read / write primitives.

[Robert Chen @NotDeGhost]

Some really cool bugs from @gosasu1!

[Zcash Foundation 🛡️ @ZcashFoundation]

🚨 Zebra 4.5.0 is out. This release fixes multiple security vulnerabilities across consensus and networking.

All node operators should upgrade immediately.
https://t.co/3Iane54YsM

[Robert Chen @NotDeGhost]

@zkDragon @ZcashFoundation @sangsoo_osec = @gosasu1

[Robert Chen @NotDeGhost]

shot, chaser

[Robert Chen @NotDeGhost]

@Tomas_Zubiri 🤨

[Robert Chen @NotDeGhost]

b6ce80774d53e78c304fd6b11fc6871ead24031aab2a82839367d70c78ce09d8 qemu.c

[Robert Chen @NotDeGhost]

@ryaagard

[Robert Chen @NotDeGhost]

h/t @enscrbe

[Robert Chen @NotDeGhost]

new Anchor docs coming soon

a quick peek:

[Robert Chen @NotDeGhost]

👀new CTF formats?

blog post coming soon

[Robert Chen @NotDeGhost]

@jimii_47 @_mixy1 for the current crate, we would use the `program_id` passed in by the entrypoint.

for dependencies (ie "cpi" feature), you would still need to have `declare_id`

[Robert Chen @NotDeGhost]

I'm debating @_mixy1 and need some help. Should we make declare_id! optional in Anchor v2?

This would:

[Robert Chen @NotDeGhost]

the real winners of DEFCON quals

[es3n1n @es3n1n]

@NotDeGhost claudio and gepetto

[Robert Chen @NotDeGhost]

see everyone in vegas!

thanks to Claudio for carrying me

[Robert Chen @NotDeGhost]

h/t @cavemanloverboy https://t.co/x8jhuDolsb

[dr cavey phd ∿ @cavemanloverboy]

first few invites for the delorean client went out today. dm with your use case and i may grant you with access

https://t.co/279XLRbdS3

[Robert Chen @NotDeGhost]

how to save 38.2% of Solana CUs:

[Robert Chen @NotDeGhost]

stop the count!

[dudcom @dudcom3]

ggs? couple more hours but : ) thats was fun

[Robert Chen @NotDeGhost]

defcon? what is that? i am at cambridge

[SuperFashi @SuperFashi1]

defcon? what is that? i am at bitsummit

[Robert Chen @NotDeGhost]

a wise man told me

[Harrison Green @hgarrereyn]

DEFCON 26 Quals: LLMs are allowed! (but like cmon guys, don’t just do the prompt, like at least pretend to be busy, like can’t we just go back to 2022 when LLMs still kind of sucked, I mean don’t just go and say solve this, like if it’s just helping that’s ok but like if it just