Hi. To preface, I am not selling anything, and I am not suggesting to mindlessly use this tool.

I started initially using Claude to hunt on some programs, and from there built a harness so that I could work on an engagement for a long duration without losing progress, to make the process repeatable and high quality ( high quality submissions, final findings that can be trusted ), and several other things along the way.

Yes this is a AI created project, but from hundreds of hours and testing, and over 8 months. Yes you will find some weird Python code, and maybe some weird things in the prompts, its 80/20.

Please still review everything, you may have to have the Operator re-dispatch specific agents to re-verify things, or to QC the final submissions, human in the loop is so very important.

I have not added GLM 5.3, I know many people are starting to use it for black box engagements, I will be working on that soon.

Project - https://github.com/VigilOSS/Vigil

hi this is my research, https://github.com/mein-0/KnockGiga

To all the beginners and the "explorers" this is the way.....I had lost a lot of time searching for resources—Pico, Nightmare.....but finally this is what actually teaches the stuff

Also....pls do support me (I guess twitter is the last place where I can enter, considering the condition of the current market)

https://x.com/s0h0m_ch_/status/2111068178235445354

Are there any courses or programs you would recommend for learning malware development?

I have a coding assignment that includes coding exploits but no ai will code it for me. Any suggestions for how to get around it or an ai that will code it for me?

hello guys ,I m trying to learn Reverse engineering, is there a roadmap for it ?

As the title says, I'm looking for projects to contribute to. This way I would like to pivot from my current operational security job to binary.

Feel free to answer to this post or pm me.
Thank you.

Hypothetically, suppose you discover several reasonably critical vulnerabilities in systems belonging to different organisations. You develop working exploits that can be used to gain unauthorised access to restricted systems or data.

Assume you've successfully tested the exploits and confirmed that they work, but you haven't stolen, modified or destroyed any data, and you haven't used the access for anything malicious.

Now imagine a random buyer offers you a substantial amount of money for one of these exploits.

Have you already committed a crime simply by exploiting the vulnerability to gain unauthorised access, even if you haven't done anything further?

Is possessing and selling a working exploit itself illegal, or does it depend on the circumstances?

Could you face prison time for selling it, even if you never personally use it for malicious purposes?

If the buyer subsequently uses the exploit to attack the organisation, could you be held criminally liable?

Would it make a legal difference if you genuinely didn't know what the buyer intended to do with it?

This is a hypothetical scenario.

Hey guys,
Wanted to share a tool I've been using in my own reversing workflow:

I needed a straightforward way to pull decompilation, cross-references, and struct layouts out of IDA Pro and Ghidra from external Python scripts and CLI utilities without setting up heavy web servers or dealing with bloated RPC frameworks.
It’s just two standalone scripts (`ID_Server.py` for IDAPython and `Ghidra_Server.py` for Ghidra). Once running, you send plain text commands over local TCP and get back JSON

I have an ongoing static analysis project I'm writing in C++20.

It uses Zydis for instruction decoding, LIEF for binary parsing and wxWidgets for the UI.

A big help was learning that the .pdata section in PE64 contains the start and end address of every non-trivial function in the binary. Enabling it to support exception handling like VEH and SEH at runtime.

This comes with some useful unwind metadata like prologue information, stack allocation size, preserved registers, etc.

Combining this with recursive descent from entry point, IAT entry resolution and memory operands like strings and such has already made this project more useful.

Is there more PE64, static analysis relevant, metadata baked into the file structure? Some future candidates are gonna be RTTI, virtual function tables, and some other CRT specific machinery.

Thanks for any suggestions.

Hey everyone,

I graduated last year with a Bachelor's degree in Computer Science, and my current job requires me to port Ghostlock (CVE-2026-43499) to multiple android devices.

Honestly, a lot of it currently goes over my head. I think I understand the basic concept of a use-after-free vulnerability, but I don't understand how it works at the kernel level or how the exploit code actually works.

I'm also struggling to get the exploit working on my target device. Since I don't fully understand the exploit's internals or how the kernel processes the operations involved, I'm having a hard time figuring out what needs to be changed to make it work.

Here's what I have so far:

- Kernel panic logs from my attempts to run the exploit.

- The compiled kernel source code for my target device.

- The ability to modify the kernel source code and flash a custom kernel onto the device.

The problem is that I don't really know where to start. The kernel panic logs are difficult to understand, the exploit's source code is confusing, and navigating the relevant kernel code is equally challenging.

My current plan is to:

1. Learn how to interpret the kernel panic logs.

2. Understand the exploit's source code and how its different parts work.

3. Trace the relevant operations through the kernel source code to understand what's happening internally.

4. Use that understanding to troubleshoot the exploit and figure out what needs to change for my target device.

I'm not sure if this is the right approach or if I'm missing some important prerequisites.

For context, I'm still relatively new to low-level kernel exploitation, so I'm trying to figure out the best way to approach this without blindly changing things until they work.

For those experienced with Linux kernel exploitation or porting Android kernel exploits, how would you approach this problem? Are there any resources or concepts I should focus on first?

Any advice would be greatly appreciated!

I've been working on this for a while and finally got the first two volumes into a single public repo. It's a free, open-source curriculum for learning exploit development, reverse engineering, and low-level security from the ground up.
The books:
C: Zero to Exploit Dev (~400 pages) A complete C course written for future exploit developers. Preprocessor → variables → pointers → memory layout → dynamic memory → unsafe functions → security mindset. Includes "Under the Hood" boxes, challenges, and labs.

x86-64 Assembly & Reverse Engineering(~300 pages) From mov to crackmes. Registers, calling conventions, stack frames, reading compiler output, GDB/Ghidra/Radare2, anti-debugging, PE format, and a full worked crackme.

Volume 3 (Advanced Exploit Development: heap, ROP, browser, kernel) is currently being rewritten from scratch to focus on modern mitigations and original research. It will be released separately when complete.

Every chapter has theory, memory diagrams, verified code, and GDB walkthroughs. No prior C or assembly knowledge is assumed.
Repo: https://github.com/X1NONs/C-for-exploit-development
PDF Download: https://github.com/X1NONs/C-for-exploit-development/releases/tag/SideBooks
If you find it useful, ⭐ the repo. Happy to answer questions about the structure or the exploit dev path.

Hi everyone,

I’m currently developing malware in rust, from a defensive and educational perspective. But the main issue i face that the window defender is blocked the app and i cant test properply. and on starting the build the .exe file is deleted by the window defender can someone help me how to protect the malware from the window defender without turn of the window security.

I’m not looking for someone to write malware, exploits, or perform attacks for me. I want to understand the research process and build the skills myself in a legal, isolated lab environment.

Talking SCA here, not SAST, since a SAST finding already points at a line. with dependencies there's a big gap between this package has a CVE and our code calls the vulnerable function through this path. closing that gap by hand across a couple hundred repos eats most of our week. we have started letting an agent read the repo and trace whether the vulnerable function gets called before a ticket goes out. it's right more often than I expected, but I still spot check anything it marks unreachable. where do you draw the line between appsec doing the reachability work and the service team doing it?

Static recovery for ACE .qvm0 PE images, not a decryptor.

The Exception Directory points into the .qvm0 tail; the section named .pdata is still there but high-entropy. A linear sweep of the VM section desyncs within a few hundred bytes, so function bounds come from RUNTIME_FUNCTION and decoding starts at each entry.

Hidden branches are jmp reg fed by call $+5 / pop / add imm, lea [rip+disp], or mov imm64. The call $+5 form is usually a null branch whose target is the fallthrough. Register-form jmp reg was 8964 sites on the reference DLL; FF /2 and FF /4 altogether were 28382, the rest memory-indirect.

On the smaller ACE-PBC-Game64.dll: 4669 functions, 408 native-to-.qvm0 edges, 92 whole-function stubs, 527 boundary-checked CFG edges, 5028 symbols, 4384/4386 functions decompiled after symbol apply. The repaired image only rewrites the add+jmp tail, same size, changes confined to .qvm0. Flag effects of the add are dropped, so it is for IDA/Ghidra, not for running

I started this project primarily as a JVM implementation for the game Diamond Rush, but the reverse-engineering side of it gradually became just as important.

While implementing the JVM, I needed to understand Java class files, bytecode instructions, constant-pool structures, and the internals of the execution model. This naturally led me to build my own javap-like disassembler alongside the JVM, which ended up becoming much more detailed than I initially expected.

According to my benchmarks, DRVM is around 4× faster than javap while using roughly 30× less memory on the tested workload.

The project is still evolving, but it has become a pretty interesting combination of JVM implementation, bytecode tooling, and reverse engineering.

Feel free to ask questions!
Repo: https://github.com/VuqarAhadli/DRVM

https://medium.com/@mr.abdulbasithk.p/hacker101-ctf-level13-android-hardcoded-signing-key-flag-disclosure-09b85bb24b10

Hi everyone,

I’ve been doing some cybersecurity research regarding the feasibility of stealthy remote control on modern mobile OS (iOS and Android) without physical access or installing an application on the target device.

So far, I've tested a couple of methods in a lab environment to see what is actually achievable:

• I tried directing a test device to a web page crafted with known WebKit/Chromium memory corruption concepts to attempt spawning a background reverse shell. While it was possible to crash the browser session, modern OS sandboxing consistently prevented escaping the browser process to gain system-level control.

• I attempted delivering crafted payloads over a local network simulator aimed at media processing libraries (similar to legacy stagefright/MMS vulnerabilities). Current memory protections (ASLR, DEP) and automated patch models blocked execution before any control could be established.

I'm still actively researching what mechanics or vectors could theoretically allow full, stealthy remote control without a target app installed—or if modern OS security features (sandboxing, strict permission models, background indicators) make real-time screen takeover virtually impossible without complex multi-million dollar zero-click chains.

For those in offensive security, malware analysis, or mobile security research: Is app-less, real-time remote control realistically feasible on updated non-rooted devices, or is remote access without an app limited to passive data extraction in practice?

Thanks for any technical perspectives!

I started grinding in reverse engineering recently. I found this domain in cybersecurity very intriguing. Though I have penetration testing knowledge. But the low level especially reverse engineering and binary exploitation hits me different.

I was thrown with many prerequisites at first. I am trying to learn them from different resources.

1. C programming from "The C programming language book"
   

2. Assembly from "Intro to assembly" - HTB academy and other blogs. And, I am connecting both together with "The art of exploitation" book and godbolt

3. Grinding on a book: Computer Architecture from a Programmer's Perspective. A huge book. Finished 1st chapter and going through the second chapter rn. The book explained the computer and memory architecture well.

Haven't touched the kernel stuff yet. I started using GNU debugger. Sometimes it gets too overwhelming. I hardly get the full picture very often. No wonder it's a rare skill :')

I'd like to know who have expertise and experience in this field:
- As a fresher like me, How to approach the study of reverse engineering?
- Any advice I need to know as a reverse engineer enthusiast. I am gonna spend a couple of months in this field.

- Suggest me some resources that I must go for.

Thank you in advance :)

So yeah. After 1 month i'm finally done with it. I would appreciate some advices and reviews. I made the website pretty simple and the possibility for everyone to post script, with the Mods review.
Website: dispatchy.xyz
I appreciate any advice/review!
Thanks!