Pau Oliva

DroidRun brings AI-driven automation to Android: ✔ Auto-fill OTP codes ✔ Automate app/device initial setup ✔ Security/malware testing with #Frida running in the background ✔ Automate food orders & shopping github.com/droidrun/droid… by @droid_run

Frida 17.4 introduces Simmy, a new backend for Apple’s Simulators on macOS. Spawn, attach, and instrument apps — just like on a real device.

Dropping the source code for OG IOLI-crackmes here, 18 years later 😅 github.com/poliva/IOLI-cr…

@Jahaudant Right now it only supports GAN cubes, as it's using gan-web-bluetooth library underneath. I'll try to add support for more smartcubes when I have some free time.

And in case you were wondering, I used A-Instant to create the previous tweet 🤪 – consider it a sneak peek "A-I" did there.

Introducing A-Instant: an AI-powered text assistant for Mac that works in any app! Highlight text, double-tap your trigger key, enter a prompt and get instant AI-powered edits or summaries. Supports multiple AI providers & local models. Open source & free! pof.eslack.org/a-instant/

🚀 Just launched Cubedex – a new smartcube alg trainer to dril your algs like a pro! 🎉 Cubedex is a Progressive Web Application (PWA) that connects to your Gan smartcube using Bluetooth. 🧩 Try it out now: cubedex.app #cubing #speedcubing #GANcube #CubeDex

Check out Pau Oliva's, Senior Security Consultant at IOActive, talk on retro game emulation at @BarcelonaBsides tomorrow, 30 May! Pau's talk kicks off at 1pm.

Please welcome @pof from @IOActive to our lineup. He will dive deep into the fascinating world of retro game emulation, explaining techniques to hack emulators to enhance classic games with modern features. Tickets 👉lnkd.in/d2XwtVq5 #BSidesBCN24

@double_somer Hello! Athena Cup was awesome and we had a lot of fun, thanks for the warm welcome and for fighting with us, it was a pleasure to play wit you and all the other Osaka players 🙏 Hopefully we can fight with our main characters very soon! 🥊

@vsnikaiten @Mattsun_Ken @Kan_Sho_NPO yes, Yogaboy is organizing teams 👍👍👍

@pof @Mattsun_Ken @Kan_Sho_NPO Thank you for making me feel welcome. I will leave it up to Yogaboy to decide on the team division. (I'm in touch with him via DM)

5月4日(土)開催のスーパーストIIX 5on5大会カケルゴにスペインから8人の選手が来日するそうです。 一緒に組んでくれる日本人を探してるとのことなのでよろしければ是非お願いします。

@vsnikaiten @Mattsun_Ken @Kan_Sho_NPO こんにちは👋 あなたとチームを組めることをとても嬉しく思います！🥊 Hello 👋 I will be super grateful to team with you! 🥊

@Mattsun_Ken @Kan_Sho_NPO 2回転Xバイソン 海外チームに入れてもらいたいです！

@_EL_KOZUKIODEN @MikadoCenter @RickiTTT @yogaboy2X @sete_kitt @vins2X @Marcade18 por supuesto que si 🤜🤛🕹️

@MikadoCenter @RickiTTT @yogaboy2X @sete_kitt @vins2X @pof @Marcade18 ¿Nos vemos en Barcelona? 😁

I'm officially subscribed for Fightcade Offline Festival @MikadoCenter 🔥❤️

New blog on exploring AMD Platform Secure Boot including common misconfigurations and implementation issues. Enjoy the read at labs.ioactive.com/2024/02/explor… #AMD #Firmware

BLE spam but for adult toys Using Flipper Zero or nRF Connect app, it is possible to send Bluetooth LE advertisement packets (without being paired) to adult toys in vicinity and make them all vibrate. It is also possible to start Denial of Pleasure by continuously broadcasting the stop packet whid.ninja/blog/denial-of… by @whid_ninja

I just enabled MTE on my new Pixel 8!! 😁🔥 Check out Mark's blog on how to enable MTE on the Pixel 8 and Pixel 8 Pro: googleprojectzero.blogspot.com/2023/11/first-…

bugs.chromium.org/p/project-zero… just derestricted. Potential untrusted_app -> kernel r/w 😬 Fix is not on any end-user devices AFAIK but fixes are in OEM's hands.

💫 Here are my slides from my @BSidesCbr Keynote: "When Exploits Aren't Binary" 💫 github.com/maddiestone/Co…

I just released a blog post on an Android ITW exploit chain: googleprojectzero.blogspot.com/2023/09/analyz… A big thanks to Google TAG and the other members of Project Zero who participated in the creation of this blog post and analysis of the chain!

Android 14 blocks downgrading apps through the 'adb install'/'pm install' shell commands, unless the app is marked as debuggable. Previously, the May 2023 security release included a patch that only blocked downgrading system apps to a version older than the one preloaded on the system image. However, starting in Android 14 Beta 5.2, this applies to all apps, as shown below. I can confirm this was only introduced in a 5.X release, as I was able to downgrade both the WhatsApp and Reddit apps using the '-d' flag on Android 14 Beta 5 but was no longer able to do so after updating to Android 14 Beta 5.3. According to one tipster, they first saw this behavior in Beta 5.2, which is why I'm saying it's Beta 5.2+. Also, since the One UI 6 beta is based on the latest Android 14 source code, it is also affected by this change. Now in order to downgrade a non-system app, you'll need to either fully uninstall the app and then install the older version afterward or be sure always manually install the app using the --enable-rollback flag so you can use Android's built-in rollback manager feature. This change has its benefits, of course. Older versions of apps can have security issues or just not use the latest security/Android feature. Plus, generally it's not recommended to downgrade an app without clearing its data, as it can cause issues with mismatched settings/databases. That's why it makes sense why this restriction doesn't apply to apps marked debuggable, so that developers can continue to downgrade apps for testing purposes. (Thanks to @Fasten_M and Moshe E for the tip!)