I've put together a new blog post! This one re-treads @bl4sty's earlier AMLogic research but takes my own approach to exploit development, with an 'alternative' vulnerability and an emulator. Just for fun!

@nyan_satan Any plans to write this up?

RT @udunadan: This 1000% applies to vulnerability research & exploit development. I think it's even the single most defining thing about th…

@BHinfoSecurity Embedded device security research and exploit development:

@SinSinology @stephenfewer Going super sayian at Pwn2Own is ultimate goals Sina 👏👏

@viperbjk A YouTube or stream would be cool!

@ChatableApps It does! That, and I need to invest in more targets!

Unfortunately, this year all I found was bound checks and non exploitable bugs, but I'm sure I'll find some cool heap overflow issues soon!

Even with typical IDA plugins like VulFi, this process is labourious at scale and simply checking imports doesn't provide enough context. So I've improved my automation to detect known unsafe function use in libraries, their xrefs, and whose calling those xrefs🤠.

The Kenwood IVI for example, it has an almost monolithic structure where the one Infotainment binary employs many custom libraries for things like image resizing, calling into audio codecs, or doing string parsing. There are other components of course, but this is a big one.

@thezdi @SinSinology @SummoningTeam Super sayian status achieved!

👏👏👏

👏👏👏

Now that Pwn2Own Automotive is almost out of the way, what targets are you looking forward to working on next?

RT @Raspberry_Pi: Security through transparency: all chips have vulnerabilities, and most vendors' strategy is not to talk about them. In c…