Pwn Live

Streaming en español, sobre reversing, exploiting, programación y hacking en general...

[Pwn Live @PwnLive_]

El día 16 estaremos con Pablo Aravena, donde nos contará sobre su investigación en un dron comercial que realizó. Nos vemos a las 21hs GMT-3 en: https://t.co/YZgVY4w4v0

[曾哥 @AabyssZG]

HashDump-BypassEDR：https://t.co/oa8qQcuUd1
通过系统白程序 Reg.exe 的拓展应用，巧妙绕过EDR的拦截点，实现绕过EDR从而DumpHash😈
该方法针对Windows系列均有效，操作难度不大，具有实战价值🥳
本项目实战文章：https://t.co/IcjVWYtjBY
源代码和Release已发布，师傅们麻烦点个Star，万分感谢！😍

[Chaofan Shou @Fried_rice]

Chinese LLMs can hack better than state-sponsored hackers with properly evolved harness -

Kimi K2.5 managed to find and exploit 6 vulnerabilities in browsers: a single page view or an extension install by victims equal full system hijack.

Check https://t.co/d0SZSf1KqF

[ae^((-(x-b)^2)/(2c^2)) @JohnGalt_is_www]

Que hermosa y util es el algebra lineal y los subespacios vectoriales tan injustamente odiados por los estudiantes

Explicado simple, uno de los cuellos de botella de los LLMs es la memoria necesaria para almacenar en cache el resultado de varios productos de matrices, por eso no podemos correr grandes LLMs en un solo GPU casero, no le alcanza la vRAM

Hay metodos de "quantizado" que comprimen (redondean) los pesos originales del LLM, justamente para que ocupen menos vRAM o memoria, pero terminan reduciendo la calidad del output

TutboQuant plantea un esquema en 4 pasos sin tocar los pesos originales del LLM, o sea sin perder precision

Paso 1, luego de calcular los K.V que es la primera multiplicaicon de matrices q hacen los LLMs, hacen una rotacion ortogonal (cambio de base), manteniendo el producto interno

Paso 2, ahi si comprimen reduciendo de 16bit hasta 2 o 3bit

Paso 3, durante la atencion Q.K, que es el segundo paso de multiplicacion de matrices que hacen los LLMs, se usan estas versiones comprimidas ahorrando muchisima vRAM

Paso 4, reconstruyen el sesgo del resultado del paso 3, usando un corrector que solo ocupa 1bit

Reduce mucho necesidad de vRAM, no reduce cómputo base, incluso agrega un peuqeño overhead, pero puede mejorar mucho la velocidad si estabas limitado por la RAM porq permite compresiones mucho mas agresivas (2bit) sin perder precision

O sea, podrian correrse los modelos chinos top TIER en "solo" 128 gb de RAM al tope de su calidad

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Reverse-engineering AI agent for IDA Pro and Binary Ninja. 🥷

70+ specialized Reverse-engineering tools for Agents.
Parallel sub-agents for heavy obfuscation.

rename,patch in natural language & explanation
persistence session.

3× faster reverse engineering obfuscated malware💤

[ryaagard @ryaagard]

Someone reported this bug while we were writing the exploit so a little bit of an unlucky timing there.

Anyway, there is new tcache behavior in the latest glibc that allowed us to exploit this uncontrolled heap overflow which we will explain in the writeup 🙂

[Dan Guido @dguido]

New: I'm sharing the @trailofbits Claude Code defaults. This is how we setup, configure, and use claude code:
https://t.co/aEIXdpCztt

[Taeyang Lee @5unkn0wn]

This is my first Linux kernel exploit for Google kCTF, and the patch commit is now public: https://t.co/PAtEnUXjpF

Actually, this bug was found by AI while analyzing 1-day variants, I'd like to share my approach for these AI things to find bug, and exploitation write-up later.

[pontifex @pontifex73]

I’ve open-sourced a smart contract audit playbook I’ve been using in real audits.

Not an auto-auditor.
A cognitive framework for structuring audit thinking with LLMs.

GitHub: https://t.co/uniSsCMXKo

[Kekius Maximus @Kekius_Sage]

I’m 54, a physicist, have spent decades using mathematics to study the universe, solve problems, and build things.

If your work touches numbers, now or in the future, and you want to learn math properly, this thread shows a from-the-ground-up math you’ll actually need:

[Bernardo Quintero @bquintero]

AI + Binary Ninja + Ghidra + IDA + radare2 + ...

[Dan Guido @dguido]

.@trailofbits released our first batch of Claude Skills. Official announcement coming later.
https://t.co/vI4amorZrc

[Het Mehta @hetmehtaa]

Android Reverse Engineering Notes

https://t.co/PISBfNlzPa

[Boris Cherny @bcherny]

I'm Boris and I created Claude Code. Lots of people have asked how I use Claude Code, so I wanted to show off my setup a bit.

My setup might be surprisingly vanilla! Claude Code works great out of the box, so I personally don't customize it much. There is no one correct way to use Claude Code: we intentionally build it in a way that you can use it, customize it, and hack it however you like. Each person on the Claude Code team uses it very differently.

So, here goes.

[Milánkovo @Milankovo001]

Check out my new IDA Pro plugin: Decode Instruction

🎨 Rainbow-colored flags dissection
🔸 Instructions and operands analysis
⚡ Real-time updates
💡 Interactive hints

https://t.co/Gh8NddovCm

Built to help with projects like
https://t.co/DhFkfqd57h by @allthingsida

[nedwill @NedWilliamson]

Last month @ASU I presented my work on formalizing automated bug discovery, developing a framework to characterize the full spectrum of approaches - from fuzzing to human analysis. I'm sharing my evolving perspective on the fundamental nature of the bug finding problem. Full deck: https://t.co/Tnlr5BTW11

[doom @doomscripts]

i wanted to learn how CPU's work so i started to emulate a MOS 6502 (the same CPU in a NES) in ROBLOX to learn how they function. this is Fibonacci in ROBLOX.
the output from the hex debug is 1, 2, 3, 5, 8, 13, 21, 34, 55, 89.
#ROBLOX #RobloxDev

[hzshang @hzshang15]

Here is a detailed bug analysis for MALI GPU CVE-2025-XXXX(6349|8045). We implements a stable privilege escalation on the latest version of the Pixel 9, and leverage a double-free primitive to arbitrary physical memory RW without any info leak. 👍https://t.co/hJqRwUhwfM

[0xor0ne @0xor0ne]

Interesting deep-dive into reverse-engineering an Unreal Engine 2 file format (.lin) for game assets

https://t.co/x2Sp98c0Kd

Credits @landaire

#infosec

[Smukx.E @5mukx]

EDR Analysis: Leveraging Fake DLLs, Guard Pages, and VEH for Enhanced Detection

https://t.co/ZzjOqqeNhf