Squeeeee 🥳 I'll be teaching my Advanced Linux Malware Reverse Engineering class at RE//verse conference in 2026!! MORE Linux APT insides and peculiarities😍🥰🤩Pls share if you can🙃 shop.binary.ninja/products/re-...

‘The finding suggests that at current scales, language models treat “2+2=4” more like a memorized fact than a logical operation.” Same, AI, same… I did really good in HS math, through calculus 2, because I’m really good at memorization. Linear algebra for EE in college proceeded to kick my ass…

Got the slides down from 350 to a lean 173! Finally going the right direction! I suspect I’ll land around 160+talking fast…

Real-talk: I’ve gone from updating every half-year to almost 1.5 years! I’ll need people to start submitting pull requests for changes to add or update new talks, or it’s very likely this timeline will come to an end. Anyone who’d like to join as a co-maintainer should LMK.

🧵⬇️Low level security timeline update!⬆️ 2025-11-09 Part 1 After over a year, I've finally updated the Low Level PC/Server Attack & Defense Timeline! darkmentor.com/timeline.html The 2025 talks are in this thread, and pre-2025 will be next time. 👇

The recording of my talk at OSFC 2025 earlier this year is now live at: www.osfc.io/2025/talks/t...

New life philosophy (x.com/xenokovah/st...) is helping me understand my general anti-CTF sentiment and why I feel like CTFs are a waste of peoples’ lives: “Solve *problems*, not puzzles”. If they’re the same, great. But I’ve seen lots of CTF *puzzles* which don’t teach problem solving.

It's awesome to see companies like @binarly.bsky.social helping support OST2 so it can keep bringing free training to the world! (This could/should be your company too! :))

We finally have a place to put all the firmware security & related classes, regardless of whether the firmware is server, desktop, embedded, or mobile!

@districtcon.bsky.social looks like it has a pretty great lineup of talks and speakers this year (districtcon.org). I’ll be there too, talking about my new Realtek Bluetooth chip RE work

You could use the OST1 Rootkits class (opensecuritytraining.info/Rootkits.html) as a starting template, since that's the whole point of making the materials under CC licenses. Xeno Kovah isn't planning on updating it as he's off in Bluetooth world now.

Periodic call for volunteers: We're looking for someone to teach classes on stealth malware, such as rootkits, bootkits, and other security-evading software.

🧵I created a complimentary repo to Antonio's, that's focused specifically on common security-relevant HCI Vendor-Specific Commands and getting them documented in a useful machine-readable way (Scapy definitions for now) github.com/darkmentorll...

Y'all fantastic news! Save the date, @blackhoodie.bsky.social will be at @districtcon.bsky.social this year 😱 the fantastic crew has offered to host us for a day of Malware Reverse Engineering! @synapticrewrite.bsky.social and myself will be hosting a training for women by women on January 23rd!!

🧵A new git repo by Antonio Vazquez Blanco is collecting info about Bluetooth USB dongles. If you have one laying around, please contribute information about it… github.com/antoniovazqu...

🧵For those who are curious about the completion time distribution during the beta of my #OST2 BT2222 class, here it is. The average completion time was 8h25m, the median was 8h10m, the min was 3h50m, and the max was 15h22m

Added 24 summary slides to see how much work I have left to do…current slide count is 266. Thoughts and prayers appreciated 💀 (but realistically this deck will form the basis for a future “RE like me: Realtek edition” class)

🧵Alright! I pulled off the hat trick 🎩 at hardwear.io this November! I've got a talk on 100% new firmware reverse engineering research (hardwear.io/netherlands-... tagline:SUFFERING BUILDS STRENGTH!)…

🧵And because apparently I can only thread to 10, the thread continues here!

🔵🦷🔒📈🆙‼️Bluetooth Security Timeline Update 2025-10-11!🧵 11 new talks from 2024-2025 added to the Bluetooth Security Timeline at darkmentor.com/bt.html

WiFi security researchers: I want to get a TX amp to let my BT research tools connect back to further-away advertisers. I’m considering www.digikey.com/en/products/... . Is there a better option that’s used in the WiFi space that I could be considering?(Needs to work with USB BT dongles)

🙌We're happy to announce OST2 now has over 31k students registered! 🥳 By the time we noticed we crossed the 30k mark, we were already at 30.5, so we figured we'd wait for 31k, which is now!🎉 👏Kudos to all the students taking and finishing classes!👏

We have made Francesco Pollicino's "Fuzzing 1001: Introductory Fuzzing" class playlist public here: www.youtube.com/playlist?lis... for those who'd like to download the videos for offline consumption.

If elected to the role of Global Supreme Documentation Overlord Czar, I promise a chicken in every pot, and a README.md in every subfolder!

The good news is also the bad news: 2 days of slide-making and I’m over 100 slides…to describe the first 5 days of the work 😬 There’s no way I’m going to be able to include everything in the talk. I’ll post a “Kovah Cut” on the DarkMentor website like in the past, but may have to break into 2 talks

🧵It took me 1.25h to update my script (which does in-memory modification to the Realtek patches to insert my code before sending it to the chip) to output a copy of the modified Realtek patch file. …

Once I looked at the likely prerequisites, I updated the Bluetooth Learning Path to add in the BT/RE3113 class shown on the map here, which is the placeholder for talking in depth about my Realtek RE work in the future

🧵I made a structural update to the Blue2thprinting #OST2 class today: The previous class was structured like "A:B:[C:D:E]:F:G" where F & G were collecting your own data, and [C-E] were understanding what Tell_Me_Everything.py was trying to tell you about the analyzed data…

The abuse of the term “ROM” continues unabated… I love how they even spell it out here and still don’t see the problem…

Random trivia: I hadn’t looked at the spec for this before, but apparently BT Classic masks the opposite side of the key relative to BT Low Energy when two parties negotiate a lower-strength encryption key ¯\_(ツ)_/¯

The "Trusted Computing 1102: Intermediate Trusted Platform Module (TPM) usage" ost2.fyi/TC2202 class release has updated 3 #OST2 learning paths Secure Software Design & Implementation - ost2.fyi/OST2_LP_SecD... System Security - ost2.fyi/OST2_LP_SysS... Windows Security - ost2.fyi/OST2_LP_Wind...

My new talk on reverse engineering the firmware of Realtek RTL8761B Bluetooth chips has been accepted to @hardwear-io.bsky.social in Amsterdam in November. Abstract in image due to size limits.

The SEC-T organizers posted the video from my talk "Crowdsourcing Bluetooth identity, to understand Bluetooth vulnerability" in what seems like record time. You can find the video & slides (and previous truncated-for-time version) here: darkmentor.com/publication/...

I’ve uploaded a good chunk of my Blue2thprinting data collected in Sweden at SEC-T to BTIDALPOOL. And in honor of the Meshtastic workshops, I also added some Meshtastic UUIDs to CLUES which takes one from image 1 -> 2/3 (if you pass —verbose-print)

Designed for developers, security engineers, and researchers, the course covers both foundational TPM 2.0 concepts and practical hands-on development techniques for interacting with TPM hardware and simulators. This class has a median completion time of 13 hours.

📣"Trusted Computing 2202: TPM 2.0 Programming using Python and the tpm2-pytss libraries" by Bill Roberts is now released!📣 ost2.fyi/TC2202 This course provides a comprehensive introduction to Trusted Platform Module (TPM) 2.0 programming using the Python-based tpm2-pytss library.

My SEC-T talk on Blue2thprinting v2 will be tomorrow at 3:30pm Stockholm time, and will also be streamed. Just go to sec-t.org and click the “stream” button at the top of the page.

Periodic call for volunteers: we've got a deep slate of Bluetooth classes on the horizon, but we need classes on other wireless protocols. If you'd be interested in teaching a class on satellite, cell, WiFi, Zigbee, LoRa, Thread, etc, let us know at teach🌀ost2.fyi

🧵I originally started working on Blue2thprinting to try and figure out where @veronicakovah.bsky.social's over-the-air exploits against Texas Instruments & Silicon Labs (darkmentor.com/publication/...) applied...

I’ll note that this applies not just to students who take OST2 classes, but instructors who create them too. I recently “got lucky” that I could more easily reverse engineer a MIPS chip firmware, because the instructions are almost identical to the RISC-V asm I teach a class on

Are you making your own luck, by taking (and finishing) OST2 classes? ost2.fyi/Learning-Pat...

You can’t use a space in a RSA Conference account password. Just saying…