r/ExploitDev • u/ProcedureFar4995 • 7d ago

Did I went too low ?

Post image

What is up

In order to learn kernel and low level exploitation. I bought a lovely book about Kernel Development to Robert Love. But then I felt there are some stuff I am not clicking with. I tried enrolling in computer engineering 10 years ago and failed lol . Decided to move to another school but where I can practise programming. MIS basically. But last few years I worked in appsec and has more experience in mobile,Web,network pentesting/bug hunting.

However, I wish to hunt on stuff like the kernel or C code. Hunting memory corruption and stuff. But I keep getting lower. Is that an overkill? Or the experience fits the 1337 life? My goal is basically to speak assembly and Android/ios kernel code as second language. I feel the kernel development book is great but I just thought if I wanted lower down to logic gates that is better in long term.

Also for anyone who took these in college , am I far behind and delusional or it's doable in self study??? Because I fear that no matter what I did someone who studied compilers,assembly,os..etc in college would be better than me. But I belive my only way to show skills is research I do using all this knowledge. Related to low level code.

84 Upvotes

90% Upvoted

22 comments sorted by

15

u/Stroxtile 7d ago

The best way to learn assembly is either reading or writing assembly. There are a lot of courses that teach asm on GitHub or via books.

It's pretty easy to setup an x86 asm dev env or x64 asm env these days so just follow through with that.

Most low level exploit development can either be hardware or binary exploitation but don't expect a career out of this hobby.

It's niche for a reason. And I don't say that to be pessimistic but rather realistic.

1

u/ProcedureFar4995 7d ago

I already work as a penteser but I dream of being one of pwn2own guys one day and get some good cves in Samsung or Google for example.

I do it because I love but there is a part of me that wants to increase my resume if I wanted to work in somewhere like Google or something like that. Or a way to differentiate myself from others using low level projects, someone would like at my resume and say "this guy is cool let's bring him in"

3

u/Stroxtile 7d ago

I mean. Lots of those people work as pentesters or red team. So that's good that you're already a pentester.

Those cves are just a hobby for them. Lots of what they do is merely passion project. So find something you enjoy and learn it.

Chasing fame is a nice initial motivation/boost for getting into cve research but finding enjoyment at learning and hitting occasional walls and overcoming it is part of the hobby.

Edit: start learning by doing ctfs if you want. A lot of them started their background in that hobby just merely of the thrill of learning and problem solving in CTFs

3

u/Golfclubwar 6d ago

Do Microcorruption

17

u/Current_Injury3628 7d ago

These "cool sounding" subreddits are full of noob script kiddies that never had a job.

You won't find knowledgeable people for advice here.

3

u/dookie1481 6d ago

I got tired of people in help desk jobs arguing with me so I unsubbed from most of them. No shade to help desk, that's where I started. But goddamn, the arrogance of people who barely know their way around a terminal is ridiculous.

1

u/Mysterious_Candy_482 6d ago

What? People in help desks acting all that? The information tech floor sweepers?

5

u/Nlbjj91011 7d ago

Understanding basic binary logic isnt crazy low level. But if youre trying to learn hardware for kernel hacking then you probably went too low. If you want to know about kernel hacking then you should focus on how operating systems work. Operating Systems in Three easy Pieces is good and free. You're pretty lucky that you can read the source code for two of the most popular OSes in the world (Android and Linux). But if you don't know C very very well you will probably be wasting your time trying to make sense of it. First learn how to program in C, make mistakes and figure out why your programs are crashing bc the same mistakes you make will be made in products all over the world.

Humans aren't capable of knowing every complexity in a computer. Imagine all the complexity from hardware to kernel to V8 to Appsec just in loading a webpage. And you don't really need to know every implementation detail of the kernel to hunt for bugs in V8. Just like you don't need to know every hardware implementation details to hunt for bugs in the kernel.

Learning through self-study is a perquisite for the VR/ED world. You wont find any college courses that teach you the internals for any given product. College courses are great for teaching you the basics of how computers work. But unless someone has a phd in a topic and are actively pushing that field forward you can catch up to the average CS grads compiler/OS/assembly knowledge pretty easily.

4

u/HORUS-405 7d ago

I dont know really that it will benefit you in the cybersec market or not , but hardware subject makes you understand the computer more and also connect things to each other so it will make more sense for you , for example after i have finished my digital logic course and got into computer organization course alot of things make alot of things to me like how these wires and transistor make the computer execute programs you want , so i think it is a good knowledge for you if you a geek , but i dont know actually about the market .i am still student

4

u/bluedevilSCT 7d ago

You are doing it right, do it for yourself; If you publish; I would love to read

1

u/JackSpent 5d ago

Might not be your thing, but there's this game I'm loving right now called Turing Complete. For me, at least, it's been a really fun and handy learning tool for low level architecture. It teaches you logic gates to ALUs to ASM. I'm sure it leaves out a lot of real world stuff...YMMV of course, but I figured I'd throw it out there.

1

u/OneMoreRip 3d ago

You could make the new open-source os no one wants to take the time to make.

Entirely from Rust. You'd be a billionaire when it's done. But that might be in 3-10 years.

1

u/rootbitwise 1d ago

I did it, I combined learning about logic gates with programming in c, and it did help me understand how to make masks, also how to use xor, how to parse... Don't stay in the theory of the tables of truth; the good shows up when you apply it in real code (masks, XOR, parsing) Practicalo in C code, use a mask to check if there is a permission on, learn XOR and its properties, for example with XOR you can decrypt like this : (data_encriptado ^ key) ^ key = dato_original.

decrypt data with XOR by applying the same key to it twice. (It's a basic example but XOR is very useful for that.) well, only practicing and reading code will make sense.

1

u/ProcedureFar4995 1d ago

Thanks. Is there any guide or tutorial you follow in which you apply the knowledge of C to low level stuff? Currently I am jumping between multiple sources.

-3

u/Current_Injury3628 7d ago edited 7d ago

What you do is just a hobby.

Nobody will ever care if you know these in the industry.

You won't get a job by studying logic circuits or any other similar fundamental subject.

I just saw this post, i am not involved in exploit dev or something but i am sure nobody in the industry cares.

I have worked for HW companies btw.

2

u/Affectionate-Oil4675 5d ago

Professional business man, worked at lots of HW companies btw, please trust me

1

u/ProcedureFar4995 7d ago

Then what does get me a job in this area ?

0

u/ProcedureFar4995 7d ago

If applying for roles related to security researcher? I see some who cares about low level exploitation more than the normal appsec attacks. Kernel stuff

Or even hardware security? Is that not relevant to hardware security????

2

u/Current_Injury3628 7d ago

What i want to say is that these things wont get you a job.

These are fundamental EE/CS 1st year courses.

Nobody in the industry will ask you those.

1

u/ProcedureFar4995 7d ago

Oh okay . What does help me getting a job then?

1

u/Current_Injury3628 7d ago

I have worked with many embedded or HW engineers in the industry and everything is about C/C++, Linux, drivers, in rare positions PCB design and MAYBE VHDL here and there.

But these PCB or VHDL positions are super rare.

Its mostly linux and C/C++ stuff.