I develop AI agents for my day job, and I recently became interested in a reverse engineering question. Please bear with me as I'm a noob to this space but I do have some curiousity thoughts about the process. Basically the process of figuring out an open source implementation of a vendor driver is a human will look at the trace, propose some execution model, write it and test and then verify.
Given a device with a working vendor driver, why can’t we intercept the driver–hardware boundary, collect MMIO/DMA/interrupt traces, and have an AI iteratively synthesize executable driver and device state-machine models?
Each model would be constrained by known driver architectures, open specifications, and existing chip designs. Runtime mismatches against the real vendor stack would become counterexamples that refine the models until a replacement driver works on the physical hardware.
Is the main blocker observability, safe experiment generation, hidden firmware state, state-space explosion, or something more fundamental?
Looking for a smooth introduction to ARM exploitation? Wanna learn ARM assembly? Well lucky for you this week we'll be looking at another pwnable challenge! However this time we're switching architectures! We'll be exploiting an ARM binary!
I would consider this a great introduction to ARM , however it is not necessarily the best for a complete beginner. Regardless don't be intimidated and I always suggest you dive in! 9/10 you will walk away better than you came into it!
So, he's selling access to the "upcoming" official API. I didn't want to provide my mobile number to sign up, and the huge number of ads was pissing me off, so I dug around and found the API, which they're claiming doesn't exist:
I've already tipped off a few contacts at news outlets and a couple YouTubers in case anyone wants to look into it further and figured I want to spread word as much as possible, so here we are.
Here's a Tampermonkey Userscript to add a button to all profiles which auto finds the account ID and copies the API URL for that account:
// ==UserScript==
// Truth Social API URL Copy Button
// trump-truth-site
// 2.0
// Adds a button above the media grid on Truth Social profile pages that copies the statuses API URL for that account
// UnusualTardigrade
// https://truthsocial.com/@*
// none
// document-idle
// ==/UserScript==
(function () {
'use strict';
console.log('[TS API Button] userscript loaded');
const BUTTON_ID = 'ts-api-copy-btn';
// The media grid on a profile page. Button is inserted just above it.
const GRID_SELECTOR = '.grid.grid-cols-3.gap-1.rounded-lg';
let lastUsername = null;
let currentAccountId = null;
let buttonEl = null;
function getUsernameFromUrl() {
const m = location.pathname.match(/^\/@([^/]+)/);
return m ? m[1] : null;
}
function buildStatusesUrl(id) {
return `https://truthsocial.com/api/v1/accounts/${id}/statuses?exclude_replies=true`;
}
function ensureButton() {
if (buttonEl) return buttonEl;
const btn = document.createElement('button');
btn.id = BUTTON_ID;
btn.textContent = 'Copy API URL';
Object.assign(btn.style, {
display: 'block',
width: '100%',
boxSizing: 'border-box',
margin: '0 0 8px 0',
padding: '10px 16px',
background: '#ff4d4d',
color: '#fff',
border: 'none',
borderRadius: '8px',
fontSize: '14px',
fontWeight: '600',
fontFamily: 'system-ui, sans-serif',
cursor: 'pointer',
boxShadow: '0 1px 3px rgba(0,0,0,0.2)',
opacity: '0.95',
transition: 'opacity 0.15s, background 0.15s',
});
btn.disabled = true;
btn.addEventListener('mouseenter', () => {
if (!btn.disabled) btn.style.opacity = '1';
});
btn.addEventListener('mouseleave', () => {
if (!btn.disabled) btn.style.opacity = '0.85';
});
btn.addEventListener('click', async () => {
if (!currentAccountId) return;
const url = buildStatusesUrl(currentAccountId);
try {
await navigator.clipboard.writeText(url);
flashButton(btn, 'Copied!', '#2ecc71');
} catch (e) {
// Fallback for contexts where clipboard API is blocked
const ta = document.createElement('textarea');
ta.value = url;
ta.style.position = 'fixed';
ta.style.opacity = '0';
document.body.appendChild(ta);
ta.select();
document.execCommand('copy');
document.body.removeChild(ta);
flashButton(btn, 'Copied!', '#2ecc71');
}
});
buttonEl = btn;
return btn;
}
function applyInlineStyle(btn) {
Object.assign(btn.style, {
position: 'static',
top: '', right: '', bottom: '', left: '', zIndex: '',
display: 'block',
width: '100%',
margin: '0 0 8px 0',
borderRadius: '8px',
boxShadow: '0 1px 3px rgba(0,0,0,0.2)',
});
}
function applyFixedStyle(btn) {
Object.assign(btn.style, {
position: 'fixed',
top: '80px',
right: '24px',
left: '',
bottom: '',
zIndex: '2147483647',
display: 'block',
width: 'auto',
margin: '0',
borderRadius: '999px',
boxShadow: '0 2px 8px rgba(0,0,0,0.3)',
});
}
function placeButton(btn) {
const grid = document.querySelector(GRID_SELECTOR);
if (grid) {
const wrapper = grid.parentElement || grid;
if (wrapper.previousElementSibling !== btn) {
applyInlineStyle(btn);
wrapper.parentNode.insertBefore(btn, wrapper);
}
return;
}
if (btn.parentElement !== document.body) {
applyFixedStyle(btn);
document.body.appendChild(btn);
}
}
function flashButton(btn, text, color) {
const prevText = btn.textContent;
const prevBg = btn.style.background;
btn.textContent = text;
btn.style.background = color;
setTimeout(() => {
btn.textContent = prevText;
btn.style.background = prevBg;
}, 1200);
}
function setButtonState(btn, { loading, id, username }) {
if (loading) {
btn.disabled = true;
btn.style.opacity = '0.5';
btn.textContent = 'Loading ID…';
} else if (id) {
btn.disabled = false;
btn.style.opacity = '0.85';
btn.style.background = '#ff4d4d';
btn.textContent = `Copy API URL (@${username})`;
} else {
btn.disabled = true;
btn.style.opacity = '0.5';
btn.textContent = 'No account found';
}
}
function fetchAccountId(username) {
const btn = ensureButton();
setButtonState(btn, { loading: true });
currentAccountId = null;
fetch(`https://truthsocial.com/api/v1/accounts/lookup?acct=${encodeURIComponent(username)}`, {
credentials: 'include',
})
.then((res) => (res.ok ? res.json() : Promise.reject(res.status)))
.then((data) => {
if (getUsernameFromUrl() !== username) return;
currentAccountId = data.id;
setButtonState(btn, { loading: false, id: data.id, username: data.username });
})
.catch(() => {
if (getUsernameFromUrl() !== username) return;
setButtonState(btn, { loading: false, id: null });
});
}
function checkForUsernameChange() {
const username = getUsernameFromUrl();
if (!username) {
if (buttonEl) buttonEl.remove();
lastUsername = null;
return;
}
if (username !== lastUsername) {
lastUsername = username;
fetchAccountId(username);
}
}
function tick() {
checkForUsernameChange();
if (buttonEl && getUsernameFromUrl()) placeButton(buttonEl);
}
const origPushState = history.pushState;
const origReplaceState = history.replaceState;
history.pushState = function (...args) {
origPushState.apply(this, args);
setTimeout(tick, 0);
};
history.replaceState = function (...args) {
origReplaceState.apply(this, args);
setTimeout(tick, 0);
};
window.addEventListener('popstate', () => setTimeout(tick, 0));
setInterval(tick, 1000);
tick();
})();
The data downloaded as JSON:
I think that's all. Any questions, lemme know! Enjoy
I have already used memory dumps and runtime hooks, injecting a trace script directly into the start-up routing of the malware payload but that only captures the components that I am looking out for. Suggestions to get the entire thing decrypted back to .pyc. i can take it from there.
I wanted to post in here to see if anyone would consider being a mentor. I want to break into malware dev and vulnerability research however since this is such a niche job community, it’s hard to find someone who has professional experience in the field. I would love to talk with anyone who has prior experience in the field and wouldn’t mind giving me some guidance. Thank you guys!
Hi I'm trying to pentest a banking app and the most difficult Bypass so far is USB Debugging. Without bypassing that I don't know how to Bypass SSL pinning with Frida. Is there any way to do this?
If you're looking for an exploit development tutorial for absolute beginners this week we're looking at what I would consider just that! This week we look at the "random" binary exploitation challenge hosted on pwnable[.]kr.
This is a great beginner tutorial since we exploit a flaw that is "easy" and unfortunately, still very real within some enterprise environments. It also helps you understand that no number is truly random.
The crazy part? We don't even drop into a debugger in this tutorial.
Be the end of this tutorial you should have:
- Learned about random number generation in C
- Learned about XOR operations
- Finding header files that contain dependencies using man pages
- Dissecting C source code
I’ve been doing some vulnerability research on a known CVE (CVE-2025-60690) on a consumer Linksys router and wanted to share the workflow I used to investigate it.
The process started by targeting the physical hardware: identifying the UART pads on the board using a digital multimeter to access the Linux-based shell console. From there, I extracted the vulnerable binary (from the CVE description), and reversed it in Ghidra. Next, I used a gdb+gdbserver setup to perform dynamic analysis to investigate the memory behaviors.
I managed to successfully achieve RCE from the stack-based buffer overflow vulnerability to land a root shell. The exploit PoC for CVE-2025-60690 just got cited on the official CVE page and exploit-db.com.
I just started a YouTube channel dedicated to breaking down IoT hacking concepts. Also, I’ve compiled my step-by-step research notes in a reference doc. If you're working on similar hardware research and want a copy of the notes, drop a comment or shoot me a DM and I'll gladly send them over!
USB-UART connection to Raspberry PiTesting UART pads with digital multimeterTesting buffer overflow behavior (gdb+gdbserver setup)
I started pwning from a year from pwn college, some THM, and I was quite good. In this month, I started getting into the real world. I find bugs, crashes, report, and wait for CVEs. But the problem for me is I can't exploit them. I can exploit the same bug in a CTF chall, but in the real world I can't, because of the stability, how large the target is, making me have the exploit just in my mind. And this is especially in kernel. When I was trying to re-exploit an old CVE using a different way, I get hit with the internals, nf_tables, TCP, and network. Those are complex. My feer is the internals and large targets. Did anyone pass with this and find a solve?
I want to share a small Python script I wrote. It is inspired by the exploit 46635 on Exploit-DB for CVE-2019-9053 (a time-based SQL Injection in CMS Made Simple).
I decided to write my own version when I was doing the SimpleCTF room on TryHackMe. I wanted to update the code to Python 3. I also wanted to make this new version more interactive and easy to use. So, I added a clean command line interface and some extra features (like different extraction modes, delay controls, and email alerts using environment variables).
Please try it and tell me what you think! I would love to hear your feedback and ideas to make it better.
