Check out the latest from our Labs! Gilbert, in our Browsers team, talks us through how he used one-click memory corruption to exploit a patch-gap in the UC Browser. www.interruptlabs.co.uk/articles/one...

Excited to be here with the Interrupt crew!

SURE is proud to announce that we have **9** epic works that have been accepted for presentation at SURE on October 13. Topics span decompilation, (de)obfuscation, debugging, fundamental benchmarks, and more! sure-workshop.org/pa... (paper links out soon)

Created Go bindings for Apple's Hypervisor.framework. Why? Because I wanted to test a Pure Go emulator I'm writing against and couldn't get unicorn2 to work on macOS 26. Plus what's going to be faster than Apple's OWN hypervisor 😎 Check it out! 🎉 github.com/blacktop/go-...

Check out our latest blog post on modeling complex control flow with function-level basic block analysis in Binary Ninja 5.1. From DSPs to Brain***k, this update makes it easier to develop plugins for tricky architectures. binary.ninja/2025/08/12/f...

🛬 I'm at USENIX Security in Seattle this week, where on Friday at 2pm my former postdoc Tristan Benoit will be presenting our paper "BLens: Contrastive Captioning of Binary Functions using Ensemble Embedding," joint work with Yunru Wang and Moritz Dannehl from my group. Here's the gist:

WOOT 2025 schedule, all papers are now online open access: usenix.org/conference/w... Talks are recorded, and should be online in a few weeks.

New blog post: Exploiting the Synology TC500 at Pwn2Own Ireland 2024 We built a format string exploit for the TC500 smart cam. It didn’t get used, but it made for a fun case study. blog.infosectcbr.com.au/2025/08/01/e...

We released our Fuzzilli-based V8 Sandbox fuzzer: github.com/googleprojec... It explores the heap to find interesting objects and corrupts them in a deterministic way using V8's memory corruption API. Happy fuzzing!

Linux Kernel Hardening: Ten Years Deep Talk by Kees Cook about the relevance of various Linux kernel vulnerability classes and the mitigations that address them. Video: www.youtube.com/watch?v=c_Nx... Slides: static.sched.com/hosted_files...

CVE-2023-52927: Turning a Forgotten #syzkaller Report into #kctf #exploit https://qriousec.github.io/post/cve-2023-52927/

CTADL - a Datalog-based interprocedural static taint analysis engine for Java/Android bytecode (via JADX) and Pcode (via Ghidra) Code: github.com/sandialabs/c... Talk (via @krismicinski.bsky.social): youtu.be/3ec9VfMUVa8?...

Ghidra, scripting, LLM, automagic automation. That should grab the attention for this thread. If you want to read the complete blog, you can do so here: www.trellix.com/blogs/resear... 1/n

Can we statistically estimate how likely an LLM-generated program is correct w/o knowing what is a correct program for that task? Sounds impossible-but it's actually really simple. In fact, our measure of "correctness" called incoherence can be estimated (PAC guarantees). arxiv.org/abs/2507.00057

Firmwire 🤝 LibAFL

Solo: A Pixel 6 Pro Story (When one #bug is all you need) https://starlabs.sg/blog/2025/06-solo-a-pixel-6-pro-story-when-one-bug-is-all-you-need/

Just Accepted to ACM TOSEM! The "Havoc Paradox" is about the relationship between byte-level fuzzer mutations and their effect on the inputs produced by generators for structured strings (e.g. XML/SQL). Can disruptive mutations be controlled? Should they be? Find out. 📄 dl.acm.org/doi/pdf/10.1...

[Blog Post] New high-level API in LIEF that allows the creation of DWARF files. Additionally, I present two plugins designed to export program information from Ghidra and BinaryNinja into a DWARF file. lief.re/blog/2025-05... (Bonus: DWARF file detailing my reverse engineering work on DroidGuard)

Our team member Man Yue Mo is back, showing a new way to bypass MTE protection on Android phones with CVE-2025-0072. github.blog/security/vul...

Happy to share my upcoming #ATC25 paper w/ @snagycs.bsky.social: "BIN2WRONG: a Unified Fuzzing Framework for Uncovering Semantic Errors in Binary-to-C Decompilers"! Bin2Wrong creates binaries by mutating source, compiler, optimizations, and format—revealing 48 new bugs in 7 decompilers! 💪

We're are happy to announce a new release of our #Rust bindings for idalib. What's new: - New APIs for working with IDBs, segments, and more - Rust 2024 support - New homepage: idalib.rs H/T to our contributors @yeggor.bsky.social & @raptor.infosec.exchange.ap.brid.gy github.com/binarly-io/i...

with offensivecon around the corner, i figured id write another post on linux kernel exploitation techniques - this time i cover the world of page table exploitation! enjoy 🤓 sam4k.com/page-table-k...

Gave a talk on external fuzzing of Linux kernel USB drivers with syzkaller at SAFACon. Includes a demonstration of how to rediscover CVE-2024-53104, an out-of-bounds bug in the USB Video Class driver. Slides: docs.google.com/presentation...

Wrote a lil' guide to help get people started with the 🆕 `ipsw` AI decompiler 📖 blacktop.github.io/ipsw/docs/gu...

Can confirm the hardware lab is pretty cool 😎

In today's #AST2025 keynote on our new #Fandango fuzzer, I presented ongoing extensions for protocol fuzzing, oracle checking, coverage guidance, much more. Slides now available: conf.researchr.org/details/ast-...

Fuzzing Windows ARM64 binaries with a DBI and LLVM? Here we go: www.romainthomas.fr/post/25-04-w...

I'm proud to announce that myself and @AtipriyaBajaj have created the Workshop on Software Understanding and Reverse Engineering (SURE), which will be co-located at CCS 2025. sure-workshop.org/ Please follow our workshop account @sureworkshop and RT it for visibility :).

Just skimmed over or it so far but looks like a nice overview on snapshot fuzzing by @theoabel.com fuzzinglabs.com/state-of-lin...

the guy who reversed the denuvo drm @momo5502.bsky.social works on a high-perf windows emulator for security research. I noticed that it supports icicle as a backend, a fuzzing-specific emulator. awesome to see academic work being continuously developed and making it into the real world

About to celebrate Easter with your family but don't know what to talk about at the table? Then don't lose time and read our new article about RPAC! Written by @zadig.trollab.org ! blog.epsilon-sec.com/cve-2025-312...

“15,000 lines of verified cryptography now in Python” Nice write up on integrating the hash and HMAC routines from the HACL* verified crypto library into Python 🎉 jonathan.protzenko.fr/2025/04/18/p...

My new blog post, which I presented at #Zer0Con2025 A binary level macOS KEXT kernel address sanitizer r00tkitsmm.github.io/fuzzing/2025...

What do you get if you combine #grammars, #constraints, #evolutionary algorithms, and #Python in one? A mighty fuzzer! Check out our latest #FANDANGO work, to appear at #ISSTA2025: publications.cispa.de/articles/sta... To try out Fandango yourself, check out its home page: fandango-fuzzer.github.io

From firmware dumps to wireless exploration — check out our latest dive into DVB receiver analysis and the hidden attack surface it exposes! www.synacktiv.com/en/publicati...

Fun fact: you can attach to the gdbserver exposed by #rr and do #TimeTravelDebugging from #Ghidra :) UX is similar to ret-sync. Original->

Saturday morning read: “QUIC-Fuzz: An Effective Greybox Fuzzer For The QUIC Protocol” arxiv.org/abs/2503.19402

Check out or work on automated testing of MLIR compilers, which Jacob Yu will present at @ASPLOSConf next week (joint work with Nick Wu) www.doc.ic.ac.uk/~afd/papers/...

There's still time to submit to FUZZING'25! This year, we're accepting both the (now classic) registered reports _and_ new short papers (fuzzing nuggets). Deadline is now March 26th! fuzzingworkshop.github.io

Looks fun! Under-constrained symbolic execution for ARM, PPC, and x86 binaries + LLM bitcode. Also plugs into Ghidra.

Need a fuzzing harness? No time to write one? Tired of false-positives? Let OGHarn lead the way to bug discovery!🐞 I'm excited to share my paper(with @snagycs.bsky.social)"No Harness, No Problem: Oracle-guided Harnessing for Auto-generating C API Fuzzing Harnesses" at @icseconf.bsky.social 2025!

libAFL is a beast. it has so many settings to tweak, different modes to select and the code can be quite scary at first. but writing a target-specific custom fuzzer is super powerful! to get started, Trail of Bits just published a nice primer: appsec.guide/docs/fuzzing...

My total rewrite of the instructions on cross-compiling Clang/LLVM for Linux using Clang/LLVM for Linux has now landed. If you want to cross-compile LLVM without getting angry - this is your guide! llvm.org/docs/HowToCr...

Really enjoyed speaking at the inaugural edition of @re-verse.io! You can find Tomasz' and my slides on tricks with SIMs and interposers here: tinyurl.com/reverse25-si...

I had a blast speaking and being at the RE//verse conference! so many cool people and great discussions on firmware, fuzzing, ai and binary analysis if you want to find out more about firmware rehosting or are an enjoyer of ascii diagrams, check out the slides to my talk below :)

If you are looking for my slides from my Reverse talk, you can find it and useful artifacts here: github.com/mahaloz/t...

Only a week and a half left for USENIX WOOT '25 conference submissions - deadline March 11 AoE. We’re looking forward to seeing even more of your amazing offensive security papers this year! And still a few days for up-and-coming track (March 4). CfP at www.usenix.org/conference/w...

We @binarly.bsky.social are pleased to announce a new release of our Rust bindings for Hex-Rays IDA Pro (crates.io/crates/idalib) with support for the latest v9.1 release! Special thanks to @yeggor.bsky.social for taking care of the changes needed to make everything compatible with this release!

Interested in #fuzzing #hypervisors? With Truman we create precise device models that are state-aware and precisely mutate message sequences #NDSS25 nebelwelt.net/blog/2025/02...

Did you always want to fuzz with #MSan but were worried about false positives? Fear no more, with QMsan #NDSS25, we create a binary-rewriting based approach that reduces false positives efficiently! nebelwelt.net/blog/2025/02...