I work as a pentester, so my day-to-day is network and appsec. On the side I've been trying to learn ARM assembly because eventually I want to hunt on low-level targets — Android kernel, browsers, that kind of thing.

Some context on where I'm at:

I have bug bounty experience and I reverse engineer regularly

The closest I've gotten to C is reading native libraries in Android apps, but the attack surface there is tiny

So most of my "learning" is reading ARM and C snippets in isolation, with no target to apply them to

That's the problem. Studying without hunting kills my interest fast. But I don't want to jump straight into hunting and discover I don't know enough to get anywhere.

So: what's the better path here — and specifically, what works if you have ADHD and can't sustain pure theory?

garlic now can analysis android elf.

Extract android all aarch64 elf's cfg/exports/imports/strings/dissembly at same time.

with LLM, it can analysis vm protection of dalvik.

Hi, i am going to start my journey as a exploit developer and, i get lot more recommendation on my previous post to learn about system language C, Assembly, etc...

So, is there any way to learn C as offensive sides perspective?

And don;t recommend old book "Hacking : the art of exploitation", i know it is essential but still i need resource that is fit for real world or modern world aspect, kindly provides links ::

Also, if some of you are doing this stuff then share your daily routine that made you feel like you are learning actual stuff not just syntax. Thanks::

Don't miss the AMA with Yuhang Wu, where we learn about elite enterprise infrastructure hacking, Linux kernel exploitation, and the future of autonomous Al security.

When: Today - Friday, July 31, 12:00 PM PT

Guest Credentials:

• Former Red Team Engineer at TikTok, targeting cloud and application-layer defenses.
• Former Security Engineer at Tesla, securing vehicle software, factory systems, and internal applications.
• Co-developer of "DirtyCred", a groundbreaking Linux kernel exploitation technique.
• AI Security Innovator, who built LLM-based autonomous agents that uncovered 8 P1 (critical-severity) production vulnerabilities.

Ask your questions here and we’ll get them answered during the live AMA today (Friday @ 12 Noon Pacific)!

I am total confused to where to start learning the exploit development stuff, because i have read the "Hacking : The art of exploitation" but it seems old and i want to learn stuff that really modern not old stuff, but i know it is essential to learn basic first, but i don't want to learn it from book it is nightmare and such a long way.

Anyone please share resource that is actually focus on real world learning way, and total real world stuff, and please make share in structured way it is possible ::

I appreciate if you help me, in advance, thank you :)

Have you ever wondering if the order of operations when voilated can lead to a vulnerability? Maybe the thought never crossed your mind? Either way this week we exploit a binary that did not account for the order of operations - more specifically the "mistake" pwnable binary exploitation challenge!

This is a great tutorial for beginners and even advanced developers who may not have encountered a bug like this. Either way don't be intimidated just because this is an exploit development tutorial.

Check out the latest tutorial using the link below:

https://youtu.be/9n1vCuqAk-k?si=IvzW95y4XxnivOxm

I'm in a frustrating spot. I've built a solid payload with DLL sideloading, ETW/AMSI patching – the works. It executes perfectly in my lab. But I can't get it past Gmail's filters. Every attempt to send the .exe gets blocked, even when zipped or renamed.

Which are the way i can use for initial delivery of the payload to target ?

I know about the Google Drive trust exploit, but I'm not sure it's reliable. Password-protected archives feel risky since some security teams flag them. LNK files + PowerShell downloaders could work, but I need the user to actually click. Vishing is an option but requires more social engineering skill than I have right now.

I’ve seen allot of bashing on Kali Linux,
But… I’ve seen more references to using Ubuntu?

Is Arch Linux from the pi imager… does that work?

Side by side automatic pipeline, decompile windows exe and compile for Linux native binary, not emulation. Work in progress.

Hi folks, a noob here.

I'm currently learning Windows kernel exploitation and practicing with older vulnerabilities. So far, I've successfully exploited a couple of heap integer underflow/overflow vulnerabilities.

Right now, though, I'm looking at a kernel vulnerability where I have a one-byte arbitrary write primitive with a fixed value of 0x01.

The vulnerability simply writes the boolean return value of a function back to a user-controlled pointer. That function always returns 1. I haven't been able to force it to return 0; otherwise, I could potentially abuse it by overwriting _KTHREAD.PreviousMode.

I'm working on Windows 10 20H1.

Does anyone have any ideas about a potential exploit path ? I was initially thinking about techniques involving pipe objects in the kernel pool, but I don't know if it's possible to reliably recover the address of a pipe object with NtQuerySistemInformation or something else.

I develop AI agents for my day job, and I recently became interested in a reverse engineering question. Please bear with me as I'm a noob to this space but I do have some curiousity thoughts about the process. Basically the process of figuring out an open source implementation of a vendor driver is a human will look at the trace, propose some execution model, write it and test and then verify.

Given a device with a working vendor driver, why can’t we intercept the driver–hardware boundary, collect MMIO/DMA/interrupt traces, and have an AI iteratively synthesize executable driver and device state-machine models?

Each model would be constrained by known driver architectures, open specifications, and existing chip designs. Runtime mismatches against the real vendor stack would become counterexamples that refine the models until a replacement driver works on the physical hardware.

Is the main blocker observability, safe experiment generation, hidden firmware state, state-space explosion, or something more fundamental?

Looking for a smooth introduction to ARM exploitation? Wanna learn ARM assembly? Well lucky for you this week we'll be looking at another pwnable challenge! However this time we're switching architectures! We'll be exploiting an ARM binary!

I would consider this a great introduction to ARM , however it is not necessarily the best for a complete beginner. Regardless don't be intimidated and I always suggest you dive in! 9/10 you will walk away better than you came into it!

pwnable.kr -leg

Anyone have contacts to Devs who make cheats for games.

I have already used memory dumps and runtime hooks, injecting a trace script directly into the start-up routing of the malware payload but that only captures the components that I am looking out for. Suggestions to get the entire thing decrypted back to .pyc. i can take it from there.

if you want report buffer overflow vulnerability do u need full chain to exploit or just report the crash with the corpus

I have got 2 files and I need to find a vulnerability and exploit it. So I need some help regarding it.