Call4pwn

121 posts

Call4pwn banner
Call4pwn

Call4pwn

@call4pwn

Software Engineer | Cybersecurity Specialist | Pwn/RE | CTF Player @0xfun

Katılım Eylül 2022
36 Takip Edilen32 Takipçiler
Call4pwn retweetledi
MiloTruck
MiloTruck@milotruck·
MiloTruck tweet media
stuxf@stuxfdev

We at @verialabs built an autonomous CTF agent in a weekend and won 1st place at @BSidesSF 2026, solving all 52/52 challenges. It races multiple AI models (Claude, GPT-5.4) in parallel, each in isolated Docker sandboxes with full CTF tooling. A coordinator LLM reads solver traces and sends targeted guidance to stuck agents. As AI gets better at finding and exploiting vulnerabilities, we think it's important to understand exactly how good it is and where it fails. github.com/verialabs/ctf-…

ZXX
0
9
85
8.3K
Call4pwn retweetledi
Coffin
Coffin@lostsec_·
The hype around Claude Code security will fade in a few months, just like what happened with Xbow AI. AI tools can assist, but they can’t replace human creativity, intuition and real attacker mindset. In bug bounty hunting, the edge still belongs to humans who think differently.
English
25
32
407
22.7K
Call4pwn
Call4pwn@call4pwn·
The immediate result is a General Protection Fault right on demand. From there, getting an LPE by overlapping a cred struct on the freelist is basically just a game of Heap Feng Shui.
English
0
0
0
13
Call4pwn
Call4pwn@call4pwn·
Wrote up my full analysis (from NDSS 2026) at a fresh Linux 7.0-rc2 build.Since KCFI is basically killing traditional control-flow hijacks, DOP via the SLUB allocator is definitely the new meta. byteco.dev/posts/dirtyfre… #Linux #Kernel #NDSS #C
Call4pwn tweet media
English
3
0
1
18
Call4pwn
Call4pwn@call4pwn·
The best part? If you have an OOB write, you don't even need to fake execution anymore. In the post, I walk through isolating the object in the physmap and simulating the corruption with pwndbg. Just destroy the IPC queue, and watch free_msg()->call kfree() right on your payload.
Call4pwn tweet media
English
0
0
0
20
Call4pwn
Call4pwn@call4pwn·
Honestly, struct msg_msg in the kmalloc-1024 cache is still the perfect target for this. Unlike msg_queue, it somehow dodged the __randomize_layout mitigation in 7.0-rc2. If you can corrupt a single qword (the next pointer at offset 0x20), you completely own the free path.
English
0
0
0
10
Call4pwn
Call4pwn@call4pwn·
They're stealing the best feeling from this world: being stuck, struggling for hours in the debugger, understanding the memory, and finally breaking the exploit yourself. Solving something just by making good prompts isn't playing CTFs. 🚩
English
0
0
0
16
Call4pwn
Call4pwn@call4pwn·
I'm not against AI. But when you see them throw the binary at the LLM, they don't even understand the vulnerability, and then they open a support ticket in the middle of a CTF because the generated script doesn't give them the flag... it's incredibly frustrating.
siunam@siunam321

I started playing CTFs in 2022, and LLMs definitely changed the **competitive** CTF scene a lot, especially since mid-2025. I also started using LLMs in late 2025. Yes, those models did one-shot many challenges, but what's the fun of slopping them? I learned absolutely nothing 🥲

English
3
0
1
75
Call4pwn
Call4pwn@call4pwn·
This is especially noticeable in pwning or reversing. An AI can tell you "there's an overflow here," but it won't build the ROP chain, adjust heap offsets, or bypass mitigations if you don't understand the fundamentals. Blindly running Python scripts isn't hacking.
English
0
0
0
20
Call4pwn
Call4pwn@call4pwn·
Doing that disrespects the author's time and those who are truly racking their brains to analyze. And be warned: the day this generation encounters a strict on-site CTF without AI, they'll be staring at the terminal, clueless.
English
0
0
0
18
Call4pwn
Call4pwn@call4pwn·
The post breaks down the theory and has a working prototype in C: manual patching of opcodes at the bit level and direct block chaining to bypass the dispatcher.
Call4pwn tweet media
English
0
0
0
22
Call4pwn
Call4pwn@call4pwn·
I wrote about the internal architecture of Dynamic Binary Instrumentation (DBI) engines and how to build one from scratch for ARM64 using pure C. When standard tools create a lot of noise in memory, it's time to go down to the JIT level. byteco.dev/posts/arm64-db… #Reversing #C
Call4pwn tweet media
English
4
0
2
49
Call4pwn
Call4pwn@call4pwn·
The direct consequence is the geometric explosion of instructions (N = A + B + 1). Isolating the context (GPRs, SIMD, NZCV) around a single opcode costs ~50 actual instructions. This overhead of O(1) to O(n) is the technical basis for timing-based avoidance.
Call4pwn tweet media
English
0
0
0
20
Call4pwn
Call4pwn@call4pwn·
Implementation requires translating these short jumps into runtime multi-instruction springboards: inverting logical conditions, using temporary registers (X16/IP0), and loading 64-bit inline literals to force absolute jumps.
Call4pwn tweet media
English
0
0
0
9
Call4pwn
Call4pwn@call4pwn·
The fundamental problem in AArch64 when hooking/DBI is PC-relative addressing. If you allocate a Code Cache with mmap and copy instructions like B.EQ or ADRP, the offset limit (e.g., ±1MB) causes them to point to invalid memory.
Call4pwn tweet media
English
0
0
0
22

Keşfet

@ubuntu @MozChile @DMConstantino @nhaines @linaporras @NaudyU @il_Vipero @z37a