# exploitation Published articles for exploitation. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## EU chat-control proposal would require messaging services to scan photos and links with AI DevFeed: [EU chat-control proposal would require messaging services to scan photos and links with AI]() Original publisher: [Read original article]() Published: 2025-08-17T15:15:00Z Content type: opinion Language: fr Sources: [Bert Hubert's writings]() Topics: [Meta](), [Image]() Tags: [2025](), [exploitation](), [images](), [meta](), [photos](), [surveillance]() ### AI overview The article discusses an EU chat-control proposal, reportedly driven by Denmark and supported by numerous member states, that would require messaging services such as WhatsApp and Signal to use AI to inspect users' photos and links. It says suspected material and associated details could be reported to Europol and local police, while refusal to allow scanning could restrict image and link sharing. The article also notes that Signal has said it would leave the EU if the law were adopted. ### Source excerpt En bref, sous l'impulsion du Danemark, de nombreux États membres de l'UE demandent que les messageries comme WhatsApp/Signal/etc. soient contraintes d'inspecter toutes nos photos et tous nos liens en utilisant de l'IA. Si l'IA a le moindre "doute" quant à la possibilité qu'il s'agisse de pédopornographie, votre photo, votre localisation, votre numéro de téléphone ainsi que d'autres détails sont signalés à Europol et aux forces de police locales. La suite n'est pas précisée, mais vos vacances à Chypre pourraient se vite se terminer par l'obligation d'expliquer vos photos au poste de police local. ## Competing in Pwn2Own ICS 2022 Miami: Exploiting a zero click remote memory corruption in ICONICS Genesis64 DevFeed: [Competing in Pwn2Own ICS 2022 Miami: Exploiting a zero click remote memory corruption in ICONICS Genesis64]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2023-05-05T15:00:00Z Content type: article Language: en Sources: [Diary of a reverse-engineer]() Topics: [Exploit](), [vulnerability](), [infosec](), [Windows]() Tags: [0-click-remote-code-execution](), [cve-2022-33318](), [exploit](), [exploitation](), [genbroker64-exe](), [genesis64](), [iconics](), [iconics-genesis64](), [ics](), [icsa-22-202-04](), [memory](), [memory-corruption](), [paracosme](), [pwn2own](), [pwn2own-2022](), [pwn2own-miami](), [remote](), [zdi-22-1041](), [zero-click]() ### AI overview A participant recounts preparing for and demonstrating a winning zero-click remote entry at the 2022 Pwn2Own ICS competition in Miami. The article focuses on exploiting a memory-corruption vulnerability in ICONICS Genesis64 software running on Windows. ### Source excerpt 🧾 Introduction After participating in Pwn2Own Austin in 2021 and failing to land my remote kernel exploit Zenith (which you can read about here), I was eager to try again. It is fun and forces me to look at things I would never have looked at otherwise. The one thing I ... ## Pwn2Own 2021 Canon ImageCLASS MF644Cdw writeup DevFeed: [Pwn2Own 2021 Canon ImageCLASS MF644Cdw writeup]() Original publisher: [Read original article]() Author: Nicolas "NK" Devillers & Jean-Romain "JRomainG" Garnier & Raphaël "\_trou\_" Rigo Published: 2022-06-11T15:00:00Z Content type: article Language: en Sources: [Diary of a reverse-engineer]() Topics: [Printer](), [Embedded Software Dev](), [Load Balancing](), [macOS]() Tags: [canon](), [cve-2022-24674](), [exploitation](), [firmware](), [imageclass](), [macos](), [memory-corruption](), [mf644cdw](), [printers](), [pwn2own](), [pwn2own-austin](), [research](), [writeup](), [zdi-22-516]() ### AI overview A technical writeup of research targeting the Canon ImageCLASS MF644Cdw printer for Pwn2Own Austin 2021. It describes analyzing the printer's firmware, obtaining firmware downloads, and investigating Canon's firmware URL structure and version availability. ### Source excerpt Introduction Pwn2Own Austin 2021 was announced in August 2021 and introduced new categories, including printers. Based on our previous experience with printers, we decided to go after one of the three models. Among those, the Canon ImageCLASS MF644Cdw seemed like the most interesting target: previous research was limited (mostly targeting ... ## Competing in Pwn2Own 2021 Austin: Icarus at the Zenith DevFeed: [Competing in Pwn2Own 2021 Austin: Icarus at the Zenith]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2022-03-26T15:00:00Z Content type: opinion Language: en Sources: [Diary of a reverse-engineer]() Topics: [Security](), [Ghidra](), [Hardware](), [Network](), [Code]() Tags: [archer-c7](), [competition](), [cve-2022-24354](), [exploitation](), [firmware](), [ghidra](), [memory-corruption](), [netusb](), [network](), [pwn2own](), [pwn2own-austin](), [remote-kernel](), [reverse](), [router](), [routers](), [security](), [tp-link](), [tp-link-archer-c7-v5](), [zenith]() ### AI overview A personal account of preparing for and entering the Pwn2Own 2021 Austin competition. The author describes reverse-engineering consumer router firmware, selecting a router target with teammates, and working toward participation in the contest. ### Source excerpt Introduction In 2021, I finally spent some time looking at a consumer router I had been using for years. It started as a weekend project to look at something a bit different from what I was used to. On top of that, it was also a good occasion to play ... ## Modern attacks on the Chrome browser : optimizations and deoptimizations DevFeed: [Modern attacks on the Chrome browser : optimizations and deoptimizations]() Original publisher: [Read original article]() Author: Jeremy "@\_\_x86" Fetiveau Published: 2020-11-17T08:00:00Z Content type: article Language: en Sources: [Diary of a reverse-engineer]() Topics: [Chrome](), [Security](), [Vulnerabilities](), [V8](), [Hacking]() Tags: [chrome](), [exploitation](), [hacking](), [javascript](), [security](), [turbofan](), [v8](), [vulnerabilities]() ### AI overview This article analyzes a security vulnerability in Chrome's V8 JavaScript engine, focusing on how TurboFan's simplified lowering phase mishandles deoptimization-related nodes. The bug can cause incorrect deoptimization data, allowing a fake object to be materialized and execution to continue with an arbitrary object pointer in an accumulator register. ### Source excerpt Introduction Late 2019, I presented at an internal Azimuth Security conference some work on hacking Chrome through it's JavaScript engine. One of the topics I've been playing with at that time was deoptimization and so I discussed, among others, vulnerabilities in the deoptimizer. For my talk at InfiltrateCon 2020 in ... ## A journey into IonMonkey: root-causing CVE-2019-9810. DevFeed: [A journey into IonMonkey: root-causing CVE-2019-9810.]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2019-06-17T15:00:00Z Content type: tutorial Language: en Sources: [Diary of a reverse-engineer]() Topics: [Exploit](), [spidermonkey](), [JIT](), [Optimization](), [Compiler](), [Firefox](), [Assembly](), [Mozilla]() Tags: [assembly](), [browser](), [cve](), [exploit](), [exploitation](), [firefox](), [ion](), [ionmonkey](), [javascript](), [jit](), [mozilla](), [optimization](), [spidermonkey]() ### AI overview This article examines the root cause of CVE-2019-9810, an IonMonkey issue in Mozilla's speculative JIT engine. It describes the author's investigation of Ion's codebase, including the issue's alias information and the related AliasAnalysis optimization pass. ### Source excerpt A journey into IonMonkey: root-causing CVE-2019-9810. Introduction In May, I wanted to play with BigInt and evaluate how I could use them for browser exploitation. The exploit I wrote for the blazefox relied on a Javascript library developed by @5aelo that allows code to manipulate 64-bit integers. Around the same ... ## Circumventing Chrome's hardening of typer bugs DevFeed: [Circumventing Chrome's hardening of typer bugs]() Original publisher: [Read original article]() Author: Jeremy "\_\_x86" Fetiveau Published: 2019-05-09T15:00:00Z Content type: article Language: en Sources: [Diary of a reverse-engineer]() Topics: [bug](), [Chrome](), [V8](), [Exploit](), [Optimization]() Tags: [bugs](), [chrome](), [exploit](), [exploitation](), [hardening](), [optimization](), [turbofan](), [v8]() ### AI overview This technical article explains how Chrome's TurboFan engine hardened bounds checks against typer bugs and discusses how those bugs can still be exploited in recent V8 versions. It examines the relevant lowering and linearization changes and presents a sample exploit for V8 7.5.0. ### Source excerpt Introduction Some recent Chrome exploits were taking advantage of Bounds-Check-Elimination in order to get a R/W primitive from a TurboFan's typer bug (a bug that incorrectly computes type information during code optimization). Indeed during the simplified lowering phase when visiting a CheckBounds node if the engine can guarantee that ... ## Introduction to TurboFan DevFeed: [Introduction to TurboFan]() Original publisher: [Read original article]() Author: Jeremy "\_\_x86" Fetiveau Published: 2019-01-28T16:00:00Z Content type: tutorial Language: en Sources: [Diary of a reverse-engineer]() Topics: [JavaScript](), [V8](), [JIT](), [Exploit](), [compilers](), [debug](), [Linux](), [browser]() Tags: [browser](), [bytecode](), [chromium](), [compilers](), [exploit](), [exploitation](), [introduction](), [javascript](), [jit](), [turbofan](), [v8]() ### AI overview A tutorial on V8's TurboFan optimizing JIT compiler. It explains the sea-of-nodes structure, shows how to build V8 and use its d8 shell and Turbolizer, and examines a vulnerable optimization pass from Google's CTF 2018 before developing an exploit. ### Source excerpt Introduction Ages ago I wrote a blog post here called first dip in the kernel pool, this year we're going to swim in a sea of nodes! The current trend is to attack JavaScript engines and more specifically, optimizing JIT compilers such as V8's TurboFan, SpiderMonkey's IonMonkey, JavaScriptCore's Data ... ## Introduction to SpiderMonkey exploitation. DevFeed: [Introduction to SpiderMonkey exploitation.]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2018-11-19T16:25:00Z Content type: article Language: en Sources: [Diary of a reverse-engineer]() Topics: [Exploit](), [spidermonkey](), [Firefox](), [JavaScript](), [JIT](), [Windows](), [Shell](), [ctf]() Tags: [blazefox](), [ctf](), [exploit](), [exploitation](), [firefox](), [interpreter](), [javascript](), [jit](), [mozilla](), [payload](), [spidermonkey](), [ttd](), [windows]() ### AI overview This blog post explains the development of three exploits targeting the SpiderMonkey JavaScript engine and Mozilla Firefox on 64-bit Windows. It progresses from a WinDbg JavaScript extension and a build-specific interpreter exploit to dynamically resolving targets and using the baseline JIT to generate ROP gadgets or native code payloads. ### Source excerpt Introduction This blogpost covers the development of three exploits targeting SpiderMonkey JavaScript Shell interpreter and Mozilla Firefox on Windows 10 RS5 64-bit from the perspective of somebody that has never written a browser exploit nor looked closely at any JavaScript engine codebase. As you have probably noticed, there has been ... ## CVE-2017-2446 or JSC::JSGlobalObject::isHavingABadTime. DevFeed: [CVE-2017-2446 or JSC::JSGlobalObject::isHavingABadTime.]() Original publisher: [Read original article]() Author: yrp Published: 2018-07-15T01:49:00Z Content type: tutorial Language: en Sources: [Diary of a reverse-engineer]() Topics: [Exploit](), [WebKit](), [JavaScript](), [Tooling](), [Linux]() Tags: [browser](), [c-plus-plus](), [command-line](), [cve](), [cve-2017-2446](), [exploit](), [exploitation](), [javascriptcore](), [jsc](), [linux]() ### AI overview A technical post describes developing an exploit for the JavaScriptCore engine targeting CVE-2017-2446. It covers the author's background, WebKit exploitation resources, vulnerable-version setup, tooling, and a Linux-based JSC target. ### Source excerpt Introduction This post will cover the development of an exploit for JavaScriptCore (JSC) from the perspective of someone with no background in browser exploitation. Around the start of the year, I was pretty burnt out on CTF problems and was interested in writing an exploit for something more complicated and ... ## Notes on Unikernels and Memory Corruption Exploitation DevFeed: [Notes on Unikernels and Memory Corruption Exploitation]() Original publisher: [Read original article]() Author: yrp Published: 2016-12-22T02:59:00Z Content type: tutorial Language: en Sources: [Diary of a reverse-engineer]() Topics: [Kernel](), [POSIX](), [Vulnerabilities](), [toolchain](), [nginx]() Tags: [exploitation](), [kernel](), [memory-corruption](), [networking](), [nginx](), [posix](), [rumpkernel](), [toolchain](), [unikernel]() ### AI overview This article presents notes on unikernels, focusing on how applications can be compiled into a NetBSD-based kernel environment. It uses nginx and php5 examples to discuss memory corruption exploitation and payload options, then introduces a basic rumpkernel "Hello World" build process. ### Source excerpt Intro Below is a collection of notes regarding unikernels. I had originally prepared this stuff to submit to EkoParty's CFP, but ended up not wanting to devote time to stabilizing PHP7's heap structures and I lost interest in the rest of the project before it was complete. However ... ## Corrupting the ARM Exception Vector Table DevFeed: [Corrupting the ARM Exception Vector Table]() Original publisher: [Read original article]() Author: Amat "acez" Cama Published: 2014-05-01T04:01:00Z Content type: article Language: en Sources: [Diary of a reverse-engineer]() Topics: [Arm](), [Exploit](), [Linux Kernel](), [Exception](), [Assembly](), [cpu]() Tags: [arm](), [assembly](), [cpu](), [exception](), [exceptions](), [exploitation](), [kernel](), [linux-kernel]() ### AI overview This article explains how the ARM Exception Vector Table can be abused during Linux kernel exploitation when an attacker has a write-what-where primitive. It covers the table's relationship to exception handlers, processor modes, and banked registers, and introduces local and remote exploit scenarios. ### Source excerpt Introduction A few months ago, I was writing a Linux kernel exploitation challenge on ARM in an attempt to learn about kernel exploitation and I thought I'd explore things a little. I chose the ARM architecture mainly because I thought it would be fun to look at. This article is ... ## Deep dive into Python's VM: Story of LOAD\_CONST bug DevFeed: [Deep dive into Python's VM: Story of LOAD\_CONST bug]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2014-04-18T06:22:00Z Content type: article Language: en Sources: [Diary of a reverse-engineer]() Topics: [Python](), [bug](), [x86](), [Code](), [C]() Tags: [bug](), [c](), [ctf](), [exploitation](), [python](), [virtual-machine](), [x86]() ### AI overview A technical deep dive into a known bug in Python 2.7.5's virtual machine. The article explains how the bug can be used to control the virtual processor, instrument the VM, and execute native x86 code, with a focus on Windows. ### Source excerpt Introduction A year ago, I've written a Python script to leverage a bug in Python's virtual machine: the idea was to fully control the Python virtual processor and after that to instrument the VM to execute native codes. The python27_abuse_vm_to_execute_x86_code.py script wasn't really self-explanatory, so I believe only a ... ## First dip into the kernel pool : MS10-058 DevFeed: [First dip into the kernel pool : MS10-058]() Original publisher: [Read original article]() Author: Jeremy "\_\_x86" Fetiveau Published: 2014-03-11T09:52:37Z Content type: tutorial Language: en Sources: [Diary of a reverse-engineer]() Topics: [Vulnerabilities](), [Exploit](), [Windows](), [Kernel](), [Code]() Tags: [exploit](), [exploitation](), [integer-overflow](), [kernel](), [kernel-pool](), [memory-corruption](), [ms10-058](), [poc](), [reverse-engineering](), [tcpip-sys](), [windows]() ### AI overview This tutorial explores a proof-of-concept exploit for the MS10-058 vulnerability in Windows 7 kernel pool memory management. It explains how an integer overflow in tcpip.sys causes an undersized non-paged pool allocation and subsequent pool overflow, based on the author's testing in a Windows 7 32-bit virtual machine. ### Source excerpt Introduction I am currently playing with pool-based memory corruption vulnerabilities. That's why I wanted to program a PoC exploit for the vulnerability presented by Tarjei Mandt during his first talk "Kernel Pool Exploitation on Windows 7" [3]. I think it's a good exercise to start learning about pool overflows ... ## Adversarial Bandits and the Exp3 Algorithm DevFeed: [Adversarial Bandits and the Exp3 Algorithm]() Original publisher: [Read original article]() Published: 2013-11-08T09:00:40Z Content type: tutorial Language: en Sources: [Jeremy Kun]() Topics: [Machine Learning & Artificial Intelligence](), [Algorithm](), [Learning]() Tags: [algorithm](), [bandit-learning](), [bandits](), [exp3](), [exploitation](), [exploration](), [machine-learning](), [mathematics](), [multiplicative-weights-update-algorithm](), [programming](), [python]() ### AI overview This article introduces adversarial bandit learning and explains how the Exp3 algorithm addresses decisions with uncertain outcomes. It contrasts adversarial payoffs with the simpler stochastic setting and frames success relative to the best single action over repeated trials. ### Source excerpt In the last twenty years there has been a lot of research in a subfield of machine learning called Bandit Learning. The name comes from the problem of being faced with a large sequence of slot machines (once called one-armed bandits) each with a potentially different payout scheme. The problems in this field all focus on one central question: If I have many available actions with uncertain outcomes, how should I act to maximize the quality of my results over many trials? ## Optimism in the Face of Uncertainty: the UCB1 Algorithm DevFeed: [Optimism in the Face of Uncertainty: the UCB1 Algorithm]() Original publisher: [Read original article]() Published: 2013-10-28T11:42:55Z Content type: tutorial Language: en Sources: [Jeremy Kun]() Topics: [Algorithm](), [Mathematics](), [Data Science]() Tags: [algorithm](), [bandit-learning](), [bandits](), [big-o-notation](), [calculus](), [confidence-bounds](), [exploitation](), [exploration](), [machine-learning](), [mathematics](), [programming](), [python](), [random-variables](), [randomized-algorithm](), [science]() ### AI overview This tutorial introduces the multi-armed bandit problem as a model of the exploration-exploitation tradeoff and presents the UCB1 algorithm, which the article describes as performing close to optimally. ### Source excerpt startups The software world is always atwitter with predictions on the next big piece of technology. And a lot of chatter focuses on what venture capitalists express interest in. As an investor, how do you pick a good company to invest in? Do you notice quirky names like "Kaggle" and "Meebo," require deep technical abilities, or value a charismatic sales pitch? When it comes to innovation in software engineering and computer science, and that as a society we should value big pushes forward much more than we do.