TinySec

Digtool: A Virtualization-Based Framework for Detecting Kernel Vulnerabilities usenix.org/conference/use…

@0XDbgMan I'm doing the same thing; your strategy is clever.

@TinySecEx and flags dangerous patterns. Z3 is only used narrowly on already-identified taint paths with a 5s timeout. This avoids path explosion entirely while still catching real vulnerabilities. The tradeoff is over-approximation (it may flag unreachable code) rather than missing bugs.

Static Analysis for Windows Kernel Drivers using disassembly, symbolic execution,taint and Z3 to auto discover kernel vuln maps IOCTL , killer , ppl bypass surface, tracks user input to sensitive APIs, discovers ROP/JOP gadgets, and can even generate PoC exploits & fuzzers

how about rebuild real windows source tree from binary.😂

happy spring festival! gong xi fa cai!

@akamai_research it's so cool. nice work , also give me some inspire now.

Can LLMs speed up vulnerability analysis? 🔍 We tested it. Our new tool, PatchDiff-AI, uses a multi-agent LLM system to generate automated root-cause reports for Patch Tuesday vulnerabilities in minutes. Read the research: ow.ly/CeOX50XGQJG

@TheZDIBugs guess it's this bug

[ZDI-25-1048|CVE-2025-62458] Microsoft Windows win32kfull Out-Of-Bounds Write Local Privilege Escalation Vulnerability (CVSS 8.8; Credit: Marcin Wiazowski) zerodayinitiative.com/advisories/ZDI…

@_mattata not

@TinySecEx Is the code available?

Modern automated patch analysis makes life easier ， power of CFG!

@rthhh17 数据挖掘的效果比预期的好一点，可惜微软给的有效信息太少了，不然效果会更好。

@TinySecEx 卧槽 你这个有点太牛逼了

@mtarral new cfg

AI-assisted data mining can yield good results even with small models, but it can also make mistakes.

@mtarral @0x_shaq @milenkowski @0xKylm @NTDEV_ @0x4d5aC @j00ru @33y0re @disconnect3d_pl @whokilleddb @eversinc33 @daaximus that's so cool! you even support ubuntu! nice work!

I heard you like using static typing, and so do I. Use static typing to manipulate binaryninja and write native plugin ! github.com/tinysec/binary…

@trumpyla @FuzzySec @vxunderground Moreover, I don't think fuzzsec said anything wrong.

😂, here we go again! @FuzzySec's last four months on X? It's like watching a guy who peaked at Pwn2Own glory back in the day and now just cycles through the same three-note playlist. IBM slide decks that nobody asked for, robot dog memes that scream "I'm trying too hard to be relatable," and endless FFmpeg copium threads where he positions himself as the lone crusader against "volunteer" maintainers who dare to exist. Bro, your bio says "AI Psychoanalyst," but your feed is the one that needs therapy. It's 80% dunking on obscure codec bugs like anyone's gonna frame your UAF rants next to a Picasso, and the other 20% is just clapping emojis for your buddies' exploits while you sit on the sidelines, tweeting about sponsoring CTFs like that's your big flex for the quarter. Oh, and that Ukraine flag in the bio? Real edgy solidarity, bro. Nothing says "I stand with the resistance" like slapping a flag emoji on a profile that’s 90% whining about open-source maintainers and 10% Midjourney dog pics. Truly fighting the good fight from the comfort of your IBM cubicle. Remember that "Cyber Security Awareness Month" presentation you dropped in October? Slides on LLM benchmarking with CTF problems you whipped up. Cool, except it reads like a corporate checkbox exercise, all buzzwords and zero bite, like you spent more time generating Midjourney robot pics for your replies than actually innovating. And those Pwn2Own shoutouts? You're out here hyping Summoning Team's Galaxy S25 chain like a proud uncle at a bar mitzvah, but where's your entry, king? Nah, you're too busy nitpicking Windows install gripes ("It's only Home edition, you clowns!") and geeking over NSA time-server drama from a Weixin article, as if triangulating exploits in China's atomic clocks is your hot take of the week. Solid research? Sure. Riveting Twitter? More like a nap pod for the infosec crowd. Then there's the FFmpeg meltdown. October hits, and suddenly you're threading like a man possessed, calling out "cringe" CVEs in SAN files and blaming trillion-dollar corps for AI-fuzzing "hobby code." Dude, you fixed a UAF in three months flat when pushed, then turned around and whined about disclosure timelines like the maintainers personally ghosted your PoC. It's peak researcher entitlement: "Protect end-users, not vendors!" while ignoring that your own "labor for free" is just free PR for your IBM gig. And the threats? Bro, if OSS zealots are DMing you death wishes, maybe it's 'cause your hot takes land like a buffer overflow. Unwelcome, unchecked, and crashing the party. Low engagement on those threads? Shocker. Even your Scaling Era book haul post got more love than your libxml2 dunks, and that's saying something when half your replies are just "👀" or "😂" like a bot on low battery. Four months in, and it's all surface-level sparkle. Hexacon booth envy, WhatsApp bounty shade, OpenAI video authenticity rants that go nowhere. You're out here framing AI agents as your secret sauce for "offensive research," but your timeline's more defensive. Guarding that ego against anyone who dares question your vuln crusade. Wake up, Fuzzy: the real exploit here is how you've turned a solid hacking resume into a feed that's just... meh. Echo chamber vibes only, no patches applied. What's next, a thread on why your robot dog's fetch command needs a CVE? Hit me. Let's keep the fire going, this guy's timeline is begging for more smoke.

We're on day 5, or day 6, of security nerds versus FFmpeg nerds. I'm not unemployed enough for this shit It's now spiraled into former Google employees choosing sides, famous researchers like Tavis Ormandy stating FFmpeg is taking their posts out of context (in attached post), people who ARE NOT in cybersecurity calling cybersecurity people bad words, and more Will this conflict stop before Friday? Will non-cybersecurity people shut up? Why does my phone keep trying to autocorrect Tavis to Tacos? Find out next time on Dragon Ball Z

@trumpyla @FuzzySec @vxunderground Why would a debate about cybersecurity and patching vulnerabilities lead you to personal attacks on specific participants? This is very unwise and rude. He was merely expressing a different opinion and should not be subjected to attacks like yours.

@5mukx actually, analysis malware also got much

How to Improve Your Skills in Windows Malware Development ? Build a strong understanding of Windows internals.

Great work！ you guys are geniuses. You also made a PatchDiff bot! Is the OpenAI o1 POC generation so good? Unfortunately it is not available in China.

@Agatha77503617 i am not sure yet.

#patchdiff The patch is so simple, I was surprised i didn't notice there was no check here before this patch.

@x1aoxia0xiao x.com/TinySecEx/stat…

@TinySecEx 你好，这个patchdiff叫啥呀，感觉挺好用

@x1aoxia0xiao yes, it's private tool.

@TinySecEx What is this tool? It feels good.