lukas seidel

AI x Infosec Researcher @RevEng_AI • Binary Program Analysis • PhD Candidate @TUBerlin • prev. built @VulHuntRE at Binarly • Capturing Flags for @ENOFLAG

[lukas seidel @pr0me]

Our work on exploring new ways for efficient firmware fuzzing will be published at @USENIXSecurity 2023!

With SAFIREFUZZ, we introduce near-native rehosting, drastically improving the performance of fuzzing embedded targets.

Super happy about this work w @domenuk @nSinusR

[lukas seidel @pr0me]

@wasure_ro @tsaritsenko_yu congrats!

[lukas seidel @pr0me]

@wasure_ro how to become a shareholder?

[lukas seidel @pr0me]

the method seems interesting in that it really combines the best of both worlds: the scalability and automation of LLMs with the fidelity and precision of symbolic execution.

work by Shafiuzzaman, @WenboGuo4 et al.:
https://t.co/Bny1CktROG

[lukas seidel @pr0me]

the nice thing about symbolic execution is that every potential bug site comes with an input reaching it, but building harnesses is laborious.

with SAILOR, a new paper combines static analysis with LLMs to automate this process

[lukas seidel @pr0me]

finally, the identified inputs are replayed and validated against the unmodified source instrumented with ASAN.

with this approach, the authors claim to have identified over 300 new memory corruptions in open source projects with up to 1.8MM LoC.

[lukas seidel @pr0me]

@S1r1u5_ code review was always my biggest gripe with claude/codex and why I kept coming back to cursor, way more control over actual changes.

last week I found that warp terminal actually has pretty neat review functionality (after making changes with codex et al.) WITH LSPs

[lukas seidel @pr0me]

decompilers historically have poor support for language-specific constructs, beginning with C++ templates or classes, not even talking about Go or Rust.

this work is astonishingly high-quality, from my first little tests it makes Rust decompilations indeed way more approachable

[Zion Leonahenahe Basque @mahal0z]

For years, Rust binaries made reversing a nightmare. Modern decompilers only support C, lacking meaningful types, constructs, and language-specific functions. Led by @34r7hm4n, we're releasing our S&P work Oxidizer, the first deep Rust decompiler, built on angr!

Interested? 🧵👇

[lukas seidel @pr0me]

@zephyr_z9 I hope we don't have to wait too long to find out if 3.5 pro will be an actual improvement over gpt5.5

[lukas seidel @pr0me]

@rez0__ they're really hiring like crazy it seems

[lukas seidel @pr0me]

@cursor_ai codex is cool but you guys keep giving me reasons to come back again and again

[lukas seidel @pr0me]

@owl_posting @zetalyrae I like them. I think using personalized "art" can add to the content and give a blog post an aesthetic feel and direction, something I would not have had the means to do pre-AI.

[lukas seidel @pr0me]

damn that's cool. who is flying me out?

[offensivecon @offensive_con]

Offensivecon is coming to Tokyo! 🔗 https://t.co/VGZ1shw2b1

Ticket shop, sponsorships and CFP are already open...

[lukas seidel @pr0me]

@orange_8361 congrats!
really hoping there will be writeups, especially for the logic-only chain :)

[lukas seidel @pr0me]

@moyix yesss, hope it drops soon

[lukas seidel @pr0me]

@Teknium super nice!
also, can we get shift+enter line breaks for formatting prompts, makes things way more structurable

[lukas seidel @pr0me]

@h0mbre_ maybe pre-filtering? there seemingly were many people with valid exploits this year who didn't get in. maybe zdi was afraid of a potential drop in quality of submission and maximized for people with a track record

[lukas seidel @pr0me]

@orange_8361 crazy, congrats!

[lukas seidel @pr0me]

from what I've heard from people, mythos' strengths are that it
a) requires no handholding
b) has a low FP rate

but it makes sense that strong long-context reasoning and self-verification come at a cost

[lukas seidel @pr0me]

"Mythos Preview is powerful, but the real choice is to either pay for an agent to use Mythos Preview for a bit, or to use GPT-5.5 for as long as needed. The better option depends on the use case; often, it’s the latter." 🔥

[XBOW @Xbow]

For the past 2 months, XBOW has been testing Mythos Preview under embargo as part of a select early-access group.

Today, we can finally share what we found.

The headline: Mythos Preview is a major advance. It is substantially better than prior models at finding vulnerability candidates, especially when source code is available.

But it’s not perfect. We surfaced issues with exploit validation, judgment, and efficiency.

Our full write-up covers where Mythos Preview shines, where it still needs support, and what we think this means for the future of offensive security: https://t.co/wPIhNeztO9