# Diary of a reverse-engineer Published articles for Diary of a reverse-engineer. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Competing in Pwn2Own ICS 2022 Miami: Exploiting a zero click remote memory corruption in ICONICS Genesis64 DevFeed: [Competing in Pwn2Own ICS 2022 Miami: Exploiting a zero click remote memory corruption in ICONICS Genesis64]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2023-05-05T15:00:00Z Content type: article Language: en Sources: [Diary of a reverse-engineer]() Topics: [Exploit](), [vulnerability](), [infosec](), [Windows]() Tags: [0-click-remote-code-execution](), [cve-2022-33318](), [exploit](), [exploitation](), [genbroker64-exe](), [genesis64](), [iconics](), [iconics-genesis64](), [ics](), [icsa-22-202-04](), [memory](), [memory-corruption](), [paracosme](), [pwn2own](), [pwn2own-2022](), [pwn2own-miami](), [remote](), [zdi-22-1041](), [zero-click]() ### AI overview A participant recounts preparing for and demonstrating a winning zero-click remote entry at the 2022 Pwn2Own ICS competition in Miami. The article focuses on exploiting a memory-corruption vulnerability in ICONICS Genesis64 software running on Windows. ### Source excerpt 🧾 Introduction After participating in Pwn2Own Austin in 2021 and failing to land my remote kernel exploit Zenith (which you can read about here), I was eager to try again. It is fun and forces me to look at things I would never have looked at otherwise. The one thing I ... ## Pwn2Own 2021 Canon ImageCLASS MF644Cdw writeup DevFeed: [Pwn2Own 2021 Canon ImageCLASS MF644Cdw writeup]() Original publisher: [Read original article]() Author: Nicolas "NK" Devillers & Jean-Romain "JRomainG" Garnier & Raphaël "\_trou\_" Rigo Published: 2022-06-11T15:00:00Z Content type: article Language: en Sources: [Diary of a reverse-engineer]() Topics: [Printer](), [Embedded Software Dev](), [Load Balancing](), [macOS]() Tags: [canon](), [cve-2022-24674](), [exploitation](), [firmware](), [imageclass](), [macos](), [memory-corruption](), [mf644cdw](), [printers](), [pwn2own](), [pwn2own-austin](), [research](), [writeup](), [zdi-22-516]() ### AI overview A technical writeup of research targeting the Canon ImageCLASS MF644Cdw printer for Pwn2Own Austin 2021. It describes analyzing the printer's firmware, obtaining firmware downloads, and investigating Canon's firmware URL structure and version availability. ### Source excerpt Introduction Pwn2Own Austin 2021 was announced in August 2021 and introduced new categories, including printers. Based on our previous experience with printers, we decided to go after one of the three models. Among those, the Canon ImageCLASS MF644Cdw seemed like the most interesting target: previous research was limited (mostly targeting ... ## Competing in Pwn2Own 2021 Austin: Icarus at the Zenith DevFeed: [Competing in Pwn2Own 2021 Austin: Icarus at the Zenith]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2022-03-26T15:00:00Z Content type: opinion Language: en Sources: [Diary of a reverse-engineer]() Topics: [Security](), [Ghidra](), [Hardware](), [Network](), [Code]() Tags: [archer-c7](), [competition](), [cve-2022-24354](), [exploitation](), [firmware](), [ghidra](), [memory-corruption](), [netusb](), [network](), [pwn2own](), [pwn2own-austin](), [remote-kernel](), [reverse](), [router](), [routers](), [security](), [tp-link](), [tp-link-archer-c7-v5](), [zenith]() ### AI overview A personal account of preparing for and entering the Pwn2Own 2021 Austin competition. The author describes reverse-engineering consumer router firmware, selecting a router target with teammates, and working toward participation in the contest. ### Source excerpt Introduction In 2021, I finally spent some time looking at a consumer router I had been using for years. It started as a weekend project to look at something a bit different from what I was used to. On top of that, it was also a good occasion to play ... ## Building a new snapshot fuzzer & fuzzing IDA DevFeed: [Building a new snapshot fuzzer & fuzzing IDA]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2021-07-15T15:00:00Z Content type: article Language: en Sources: [Diary of a reverse-engineer]() Topics: [Fuzzing/Fuzz testing](), [C++](), [Windows](), [App](), [Emulator](), [test-coverage](), [bug](), [cross-platform]() Tags: [bochs](), [bochscpu](), [bug-bounty](), [c-plus-plus](), [code-coverage](), [cross-platform](), [emulator](), [fuzzing](), [ida](), [kvm](), [misc](), [results](), [snapshot-fuzzing](), [whv](), [winhv]() ### AI overview This article describes the development of a Windows snapshot-based fuzzer designed to target user-mode and kernel applications and services. It explains the planned use of hypervisor and KVM APIs, instrumentation, code coverage, crash detection, mutation, cross-platform support, and fast restoration, with IDA selected as a development target. ### Source excerpt Introduction It is January 2020 and it is this time of the year where I try to set goals for myself. I had just come back from spending Christmas with my family in France and felt fairly recharged. It always is an exciting time for me to think and plan ... ## Reverse-engineering tcpip.sys: mechanics of a packet of the death (CVE-2021-24086) DevFeed: [Reverse-engineering tcpip.sys: mechanics of a packet of the death (CVE-2021-24086)]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2021-04-15T15:00:00Z Content type: tutorial Language: en Sources: [Diary of a reverse-engineer]() Topics: [Reverse Engineering](), [Vulnerabilities](), [Cybersecurity](), [TCP/IP](), [Windows](), [Kernel]() Tags: [cve-2021-24086](), [fragmentation](), [ipv6preassembledatagram](), [kernel](), [poc](), [recursive-fragmentation](), [reverse-engineering](), [tcp-ip](), [tcpip-sys](), [vulnerabilities](), [windows]() ### AI overview This article reverse-engineers CVE-2021-24086, a remotely triggerable NULL dereference in the Windows TCP/IP kernel code. It explains the patch-diffing and reverse-engineering process, the network-buffer condition behind the flaw, and the development of a proof of concept. ### Source excerpt Introduction Since the beginning of my journey in computer security I have always been amazed and fascinated by true remote vulnerabilities. By true remotes, I mean bugs that are triggerable remotely without any user interaction. Not even a single click. As a result I am always on the lookout for ... ## Modern attacks on the Chrome browser : optimizations and deoptimizations DevFeed: [Modern attacks on the Chrome browser : optimizations and deoptimizations]() Original publisher: [Read original article]() Author: Jeremy "@\_\_x86" Fetiveau Published: 2020-11-17T08:00:00Z Content type: article Language: en Sources: [Diary of a reverse-engineer]() Topics: [Chrome](), [Security](), [Vulnerabilities](), [V8](), [Hacking]() Tags: [chrome](), [exploitation](), [hacking](), [javascript](), [security](), [turbofan](), [v8](), [vulnerabilities]() ### AI overview This article analyzes a security vulnerability in Chrome's V8 JavaScript engine, focusing on how TurboFan's simplified lowering phase mishandles deoptimization-related nodes. The bug can cause incorrect deoptimization data, allowing a fake object to be materialized and execution to continue with an arbitrary object pointer in an accumulator register. ### Source excerpt Introduction Late 2019, I presented at an internal Azimuth Security conference some work on hacking Chrome through it's JavaScript engine. One of the topics I've been playing with at that time was deoptimization and so I discussed, among others, vulnerabilities in the deoptimizer. For my talk at InfiltrateCon 2020 in ... ## A journey into IonMonkey: root-causing CVE-2019-9810. DevFeed: [A journey into IonMonkey: root-causing CVE-2019-9810.]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2019-06-17T15:00:00Z Content type: tutorial Language: en Sources: [Diary of a reverse-engineer]() Topics: [Exploit](), [spidermonkey](), [JIT](), [Optimization](), [Compiler](), [Firefox](), [Assembly](), [Mozilla]() Tags: [assembly](), [browser](), [cve](), [exploit](), [exploitation](), [firefox](), [ion](), [ionmonkey](), [javascript](), [jit](), [mozilla](), [optimization](), [spidermonkey]() ### AI overview This article examines the root cause of CVE-2019-9810, an IonMonkey issue in Mozilla's speculative JIT engine. It describes the author's investigation of Ion's codebase, including the issue's alias information and the related AliasAnalysis optimization pass. ### Source excerpt A journey into IonMonkey: root-causing CVE-2019-9810. Introduction In May, I wanted to play with BigInt and evaluate how I could use them for browser exploitation. The exploit I wrote for the blazefox relied on a Javascript library developed by @5aelo that allows code to manipulate 64-bit integers. Around the same ... ## Circumventing Chrome's hardening of typer bugs DevFeed: [Circumventing Chrome's hardening of typer bugs]() Original publisher: [Read original article]() Author: Jeremy "\_\_x86" Fetiveau Published: 2019-05-09T15:00:00Z Content type: article Language: en Sources: [Diary of a reverse-engineer]() Topics: [bug](), [Chrome](), [V8](), [Exploit](), [Optimization]() Tags: [bugs](), [chrome](), [exploit](), [exploitation](), [hardening](), [optimization](), [turbofan](), [v8]() ### AI overview This technical article explains how Chrome's TurboFan engine hardened bounds checks against typer bugs and discusses how those bugs can still be exploited in recent V8 versions. It examines the relevant lowering and linearization changes and presents a sample exploit for V8 7.5.0. ### Source excerpt Introduction Some recent Chrome exploits were taking advantage of Bounds-Check-Elimination in order to get a R/W primitive from a TurboFan's typer bug (a bug that incorrectly computes type information during code optimization). Indeed during the simplified lowering phase when visiting a CheckBounds node if the engine can guarantee that ... ## Introduction to TurboFan DevFeed: [Introduction to TurboFan]() Original publisher: [Read original article]() Author: Jeremy "\_\_x86" Fetiveau Published: 2019-01-28T16:00:00Z Content type: tutorial Language: en Sources: [Diary of a reverse-engineer]() Topics: [JavaScript](), [V8](), [JIT](), [Exploit](), [compilers](), [debug](), [Linux](), [browser]() Tags: [browser](), [bytecode](), [chromium](), [compilers](), [exploit](), [exploitation](), [introduction](), [javascript](), [jit](), [turbofan](), [v8]() ### AI overview A tutorial on V8's TurboFan optimizing JIT compiler. It explains the sea-of-nodes structure, shows how to build V8 and use its d8 shell and Turbolizer, and examines a vulnerable optimization pass from Google's CTF 2018 before developing an exploit. ### Source excerpt Introduction Ages ago I wrote a blog post here called first dip in the kernel pool, this year we're going to swim in a sea of nodes! The current trend is to attack JavaScript engines and more specifically, optimizing JIT compilers such as V8's TurboFan, SpiderMonkey's IonMonkey, JavaScriptCore's Data ... ## Introduction to SpiderMonkey exploitation. DevFeed: [Introduction to SpiderMonkey exploitation.]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2018-11-19T16:25:00Z Content type: article Language: en Sources: [Diary of a reverse-engineer]() Topics: [Exploit](), [spidermonkey](), [Firefox](), [JavaScript](), [JIT](), [Windows](), [Shell](), [ctf]() Tags: [blazefox](), [ctf](), [exploit](), [exploitation](), [firefox](), [interpreter](), [javascript](), [jit](), [mozilla](), [payload](), [spidermonkey](), [ttd](), [windows]() ### AI overview This blog post explains the development of three exploits targeting the SpiderMonkey JavaScript engine and Mozilla Firefox on 64-bit Windows. It progresses from a WinDbg JavaScript extension and a build-specific interpreter exploit to dynamically resolving targets and using the baseline JIT to generate ROP gadgets or native code payloads. ### Source excerpt Introduction This blogpost covers the development of three exploits targeting SpiderMonkey JavaScript Shell interpreter and Mozilla Firefox on Windows 10 RS5 64-bit from the perspective of somebody that has never written a browser exploit nor looked closely at any JavaScript engine codebase. As you have probably noticed, there has been ... ## CVE-2017-2446 or JSC::JSGlobalObject::isHavingABadTime. DevFeed: [CVE-2017-2446 or JSC::JSGlobalObject::isHavingABadTime.]() Original publisher: [Read original article]() Author: yrp Published: 2018-07-15T01:49:00Z Content type: tutorial Language: en Sources: [Diary of a reverse-engineer]() Topics: [Exploit](), [WebKit](), [JavaScript](), [Tooling](), [Linux]() Tags: [browser](), [c-plus-plus](), [command-line](), [cve](), [cve-2017-2446](), [exploit](), [exploitation](), [javascriptcore](), [jsc](), [linux]() ### AI overview A technical post describes developing an exploit for the JavaScriptCore engine targeting CVE-2017-2446. It covers the author's background, WebKit exploitation resources, vulnerable-version setup, tooling, and a Linux-based JSC target. ### Source excerpt Introduction This post will cover the development of an exploit for JavaScriptCore (JSC) from the perspective of someone with no background in browser exploitation. Around the start of the year, I was pretty burnt out on CTF problems and was interested in writing an exploit for something more complicated and ... ## Breaking ledgerctf's AES white-box challenge DevFeed: [Breaking ledgerctf's AES white-box challenge]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2018-05-17T18:52:00Z Content type: article Language: en Sources: [Diary of a reverse-engineer]() Topics: [Cryptography](), [Encryption](), [Reverse Engineering](), [obfuscation](), [C++]() Tags: [aes](), [cryptography](), [encryption](), [ledgerctf](), [obfuscation](), [reverse-engineering](), [white-box](), [whitebox]() ### AI overview This article examines Ledger's ctf2 binary from its bug bounty puzzles, describing its AES white-box protection scheme and the author's reverse-engineering process for breaking it. The binary is presented as a C++ ELF64 executable with no apparent obfuscation, code encryption, or packing. ### Source excerpt Introduction About a month ago, my mate b0n0n was working on the ledgerctf puzzles and challenged me to have a look at the ctf2 binary. I eventually did and this blogpost discusses the protection scheme and how I broke it. Before diving in though, here is a bit of background ... ## beVX challenge on the operation table DevFeed: [beVX challenge on the operation table]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2018-03-12T00:22:00Z Content type: tutorial Language: en Sources: [Diary of a reverse-engineer]() Topics: [Reverse Engineering](), [Security](), [Encryption](), [Cryptography]() Tags: [bevx](), [conference](), [encryption](), [private-key](), [reverse-engineering](), [security]() ### AI overview A write-up of solving the beVX reverse-engineering challenge from OffensiveCon2018. The article explains how to set up the challenge locally, analyze its encryption service, and exploit the server to retrieve the private key. ### Source excerpt Introduction About two weeks ago, my friend mongo challenged me to solve a reverse-engineering puzzle put up by the SSD team for OffensiveCon2018 (which is a security conference that took place in Berlin in February). The challenge binary is available for download here and here is one of the original ... ## Debugger data model, Javascript & x64 exception handling DevFeed: [Debugger data model, Javascript & x64 exception handling]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2017-12-01T14:59:00Z Content type: tutorial Language: en Sources: [Diary of a reverse-engineer]() Topics: [debugging](), [JavaScript](), [Exception handling](), [Microsoft](), [Tooling](), [Reverse Engineering]() Tags: [debugging](), [debugging-tools](), [exception](), [exception-handling](), [javascript](), [microsoft](), [reverse-engineering](), [seh](), [time-travel-debugging](), [ttd](), [windbg]() ### AI overview This tutorial explores the WinDbg Preview debugger data model, JavaScript extensions, and Microsoft's time travel debugging tools. It explains how these features can be used to enumerate x64 try/except handlers in JavaScript. ### Source excerpt Introduction The main goal of today's post is to show a bit more of what is now possible with the latest Windbg (currently branded "WinDbg Preview" in the Microsoft store) and the time travel debugging tools that Microsoft released a few months ago. When these finally got released, a bit ... ## Binary rewriting with syzygy, Pt. I DevFeed: [Binary rewriting with syzygy, Pt. I]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2017-08-05T23:08:00Z Content type: tutorial Language: en Sources: [Diary of a reverse-engineer]() Topics: [Instrumentation](), [toolchain](), [MSVC](), [x86](), [C++](), [function](), [Chromium]() Tags: [binaries](), [binary-rewriting](), [c-plus-plus](), [chromium](), [dynamic-binary-instrumentation](), [instrumentation](), [intel](), [misc](), [msvc](), [program-analysis](), [syzygy]() ### AI overview This introductory article presents Syzygy, Google's transformation tool chain for statically instrumenting PE images. It outlines the framework's capabilities and limitations and introduces analysis and transformation passes, including call-graph generation and rewriting functions in /GS-protected binaries. ### Source excerpt Introduction Binary instrumentation and analysis have been subjects that I have always found fascinating. At compile time via clang, or at runtime with dynamic binary instrumentation frameworks like Pin or DynamoRIO. One thing I have always looked for though, is a framework able to statically instrument a PE image. A ... ## Notes on Unikernels and Memory Corruption Exploitation DevFeed: [Notes on Unikernels and Memory Corruption Exploitation]() Original publisher: [Read original article]() Author: yrp Published: 2016-12-22T02:59:00Z Content type: tutorial Language: en Sources: [Diary of a reverse-engineer]() Topics: [Kernel](), [POSIX](), [Vulnerabilities](), [toolchain](), [nginx]() Tags: [exploitation](), [kernel](), [memory-corruption](), [networking](), [nginx](), [posix](), [rumpkernel](), [toolchain](), [unikernel]() ### AI overview This article presents notes on unikernels, focusing on how applications can be compiled into a NetBSD-based kernel environment. It uses nginx and php5 examples to discuss memory corruption exploitation and payload options, then introduces a basic rumpkernel "Hello World" build process. ### Source excerpt Intro Below is a collection of notes regarding unikernels. I had originally prepared this stuff to submit to EkoParty's CFP, but ended up not wanting to devote time to stabilizing PHP7's heap structures and I lost interest in the rest of the project before it was complete. However ... ## Token capture via an llvm-based analysis pass DevFeed: [Token capture via an llvm-based analysis pass]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2016-11-28T04:43:00Z Content type: article Language: en Sources: [Diary of a reverse-engineer]() Topics: [LLVM](), [Compiler](), [Instrumentation](), [test-coverage](), [Fuzzing/Fuzz testing]() Tags: [analysis-pass](), [clang](), [code-coverage](), [compiler](), [fuzzing](), [instrumentation](), [llvm](), [misc](), [pass]() ### AI overview This technical blog article introduces LLVM's modular compiler architecture and discusses how AFL uses compiler-based static instrumentation and code coverage to guide fuzzing. The supplied text ends before the article's full discussion is available. ### Source excerpt Introduction About three years ago, the LLVM framework started to pique my interest for a lot of different reasons. This collection of industrial strength compiler technology, as Latner said in 2008, was designed in a very modular way. It also looked like it had a lot of interesting features that ... ## Keygenning with KLEE DevFeed: [Keygenning with KLEE]() Original publisher: [Read original article]() Author: Michele "brt\_device" Bertasi Published: 2015-08-19T05:12:00Z Content type: tutorial Language: en Sources: [Diary of a reverse-engineer]() Topics: [Software](), [Code](), [debug](), [Linux](), [gcc](), [Scripting, bash](), [WPF]() Tags: [code](), [debugging](), [gcc](), [ida](), [ida-pro](), [linux](), [reverse-engineering](), [scripting](), [software](), [symbolic-execution](), [virtual-machine](), [windbg]() ### AI overview This article examines the reverse engineering of a software serial-number validation process and describes using the KLEE symbolic virtual machine to build a key generator. It also discusses tools and practices including IDA Pro, WinDbg, Linux, gcc, Bash scripting, and a WPF application. ### Source excerpt Introduction In the past weeks I enjoyed working on reversing a piece of software (don't ask me the name), to study how serial numbers are validated. The story the user has to follow is pretty common: download the trial, pay, get the serial number, use it in the annoying nag ... ## Spotlight on an unprotected AES128 white-box implementation DevFeed: [Spotlight on an unprotected AES128 white-box implementation]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2015-02-09T06:59:00Z Content type: tutorial Language: en Sources: [Diary of a reverse-engineer]() Topics: [Cryptography](), [Encryption](), [C](), [Code](), [GitHub]() Tags: [aes](), [aes128](), [c](), [code](), [cryptography](), [encryption](), [github](), [implementation](), [obfuscation](), [practical-cryptography](), [white-box]() ### AI overview This tutorial introduces white-box cryptography through an unprotected AES128 implementation. It explains the design goals and outlines transforming a plain C AES128 encryption function into a white-box implementation, with emphasis on how design weaknesses can allow key extraction. ### Source excerpt Introduction I think it all began when I've worked on the NSC2013 crackme made by @elvanderb, long story short you had an AES128 heavily obfuscated white-box implementation to break. The thing was you could actually solve the challenge in different ways: the first one was the easiest one: you didn't ... ## Taming a wild nanomite-protected MIPS binary with symbolic execution: No Such Crackme DevFeed: [Taming a wild nanomite-protected MIPS binary with symbolic execution: No Such Crackme]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet & Emilien "tr4nce" Girault Published: 2014-10-12T04:35:00Z Content type: tutorial Language: en Sources: [Diary of a reverse-engineer]() Topics: [Assembly](), [Security](), [debug](), [Linux]() Tags: [assembly](), [debugging](), [intel](), [linux](), [mips](), [nosuchcon](), [reverse-engineering](), [security](), [symbolic-execution](), [z3](), [z3py]() ### AI overview A technical walkthrough of a No Such Con security challenge involving a nanomite-protected MIPS binary. The article introduces the challenge, MIPS fundamentals, debugging setup, and symbolic-execution-based analysis, with two co-authored solution paths. ### Source excerpt As last year, the French conference No Such Con returns for its second edition in Paris from the 19th of November until the 21th of November. And again, the brilliant Eloi Vanderbeken & his mates at Synacktiv put together a series of three security challenges especially for this occasion. Apparently, the ... ## Dissection of Quarkslab's 2014 security challenge DevFeed: [Dissection of Quarkslab's 2014 security challenge]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2014-09-07T03:37:00Z Content type: article Language: en Sources: [Diary of a reverse-engineer]() Topics: [Security](), [Code](), [Python](), [compilers]() Tags: [blog](), [code](), [compilers](), [python](), [reverse-engineering](), [security](), [virtual-machine]() ### AI overview A detailed walkthrough of solving Quarkslab's 2014 security challenge, including analysis of an obfuscated Python one-liner and the techniques used to understand it. ### Source excerpt Introduction As the blog was a bit silent for quite some time, I figured it would be cool to put together a post ; so here it is folks, dig in! The French company Quarkslab recently released a security challenge to win a free entrance to attend the upcoming HITBSecConf conference ... ## Corrupting the ARM Exception Vector Table DevFeed: [Corrupting the ARM Exception Vector Table]() Original publisher: [Read original article]() Author: Amat "acez" Cama Published: 2014-05-01T04:01:00Z Content type: article Language: en Sources: [Diary of a reverse-engineer]() Topics: [Arm](), [Exploit](), [Linux Kernel](), [Exception](), [Assembly](), [cpu]() Tags: [arm](), [assembly](), [cpu](), [exception](), [exceptions](), [exploitation](), [kernel](), [linux-kernel]() ### AI overview This article explains how the ARM Exception Vector Table can be abused during Linux kernel exploitation when an attacker has a write-what-where primitive. It covers the table's relationship to exception handlers, processor modes, and banked registers, and introduces local and remote exploit scenarios. ### Source excerpt Introduction A few months ago, I was writing a Linux kernel exploitation challenge on ARM in an attempt to learn about kernel exploitation and I thought I'd explore things a little. I chose the ARM architecture mainly because I thought it would be fun to look at. This article is ... ## Deep dive into Python's VM: Story of LOAD\_CONST bug DevFeed: [Deep dive into Python's VM: Story of LOAD\_CONST bug]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2014-04-18T06:22:00Z Content type: article Language: en Sources: [Diary of a reverse-engineer]() Topics: [Python](), [bug](), [x86](), [Code](), [C]() Tags: [bug](), [c](), [ctf](), [exploitation](), [python](), [virtual-machine](), [x86]() ### AI overview A technical deep dive into a known bug in Python 2.7.5's virtual machine. The article explains how the bug can be used to control the virtual processor, instrument the VM, and execute native x86 code, with a focus on Windows. ### Source excerpt Introduction A year ago, I've written a Python script to leverage a bug in Python's virtual machine: the idea was to fully control the Python virtual processor and after that to instrument the VM to execute native codes. The python27_abuse_vm_to_execute_x86_code.py script wasn't really self-explanatory, so I believe only a ... ## First dip into the kernel pool : MS10-058 DevFeed: [First dip into the kernel pool : MS10-058]() Original publisher: [Read original article]() Author: Jeremy "\_\_x86" Fetiveau Published: 2014-03-11T09:52:37Z Content type: tutorial Language: en Sources: [Diary of a reverse-engineer]() Topics: [Vulnerabilities](), [Exploit](), [Windows](), [Kernel](), [Code]() Tags: [exploit](), [exploitation](), [integer-overflow](), [kernel](), [kernel-pool](), [memory-corruption](), [ms10-058](), [poc](), [reverse-engineering](), [tcpip-sys](), [windows]() ### AI overview This tutorial explores a proof-of-concept exploit for the MS10-058 vulnerability in Windows 7 kernel pool memory management. It explains how an integer overflow in tcpip.sys causes an undersized non-paged pool allocation and subsequent pool overflow, based on the author's testing in a Windows 7 32-bit virtual machine. ### Source excerpt Introduction I am currently playing with pool-based memory corruption vulnerabilities. That's why I wanted to program a PoC exploit for the vulnerability presented by Tarjei Mandt during his first talk "Kernel Pool Exploitation on Windows 7" [3]. I think it's a good exercise to start learning about pool overflows ... [Next page]()