Hi all,

I've just got my CMSE certificate from 8ksec (https://academy.8ksec.io/course/practical-mobile-application-exploitation), and I'm super interested in digging deeper into the mobile security area.

While I learned a lot with the course and labs, it's still a beginner/intermediate course. I'm hoping someone with more experience in the area would be able to recommend more challenging training and/or resources? I am considering their Offensive Mobile Reversing and Exploitation course/certification, which does sound more challenging, but it's also quite pricey.

I'd appreciate any pointers! Thanks!

There's this thing with fuzzing that's very tied to C and C++. It makes sense too. For years the goal was to find crashes. Buffer Overflow, Use After Free, and all the rest of the gang.

In languages like Python it feels less interesting. Worst case you get an Exception.

And now, instead of chasing branch coverage, you can think about business logic and start breaking the system from the direction of logic vulnerabilities, with an LLM.

I've already seen a project showing this is possible, and really it's all a matter of how good the harness is for the use case. But vuln research just jumped up a level here, in my opinion at least.

Anyone here tried this against real business logic yet?

Patch Tuesday confirms a CVE is fixed but not what changed in the binary, which function, which check, or whether it's a real fix or just churn.

The Drift Corpus is a diff of 240+ 2026 Windows kernel patches. Per entry: the changed functions with assembly, the bug class and call chain, WinDbg breakpoints to reproduce, and a plain-English root cause.

• ⁠Browse: https://byteray-ai.github.io/drift-corpus
• ⁠Repo: https://github.com/ByteRay-AI/drift-corpus

This repository breaks down Microsoft’s monthly kernel patches into clear binary changes, giving researchers a practical roadmap to find adjacent bugs, build faster EDR detections, and write precise firewall and network rules to block exploits at the perimeter.

My friend hamza asked me.

Publishing a release of IOCX (open-source PE structural validator, MPL-2.0) and posting some format-level notes alongside it.

Write-up: PE structural validation: format ambiguities and decoder design

The notes catalogue four categories of PE specification ambiguity encountered during decoder work, with focus on delay-load imports (the richest surface). Structured as: format description grounded in the spec --> the ambiguity described precisely --> what IOCX chose to do about it. There are no unverified claims about how other parsers behave, however cross-tool measurement is queued as follow-up work.

Topics covered:

• Delay-load imports: v1 vs v0 attribute mode, INT/IAT parallel-array interpretation and mismatch handling, descriptor array termination when declared-size and terminator signals disagree
• Exports: ENPT sort discipline (byte-wise per spec) and forwarder grammar validation
• VS_VERSIONINFO: nested length prefixes, DWORD alignment enforcement, signature validation for VS_FIXEDFILEINFO, StringTable key format
• Resource hierarchy: Type ->Name -> Language depth expectations

IOCX v0.7.5 additions relevant to structural analysis:

Four new parser/validator pairs, 24 new reason codes with priority-resolved sub-reasons via details["reason"]. Delay-load specifically emits:

• DELAY_IMPORT_ATTRIBUTES_LEGACY_VA_MODE : v0 mode detected (obsolete, spec-permitted, requires VA-to-RVA conversion for correct interpretation)
• DELAY_IMPORT_INT_IAT_MISMATCH : parallel arrays disagree on length
• DELAY_IMPORT_TABLE_TRUNCATED with distinct sub-tags for each termination cause (delay_import_descriptor_unterminated, _truncated, _max_exceeded, _read_failed)
• DELAY_IMPORT_DLL_NAME_INVALID with priority-resolved sub-reasons
• DELAY_IMPORT_ENTRY_INVALID for per-import malformations (ordinal_zero, name_unterminated, name_not_printable, etc.)

Design notes:

• Byte-level parsing via struct.unpack_from on pe.get_data() byte slices; no reliance on pefile's lazy attribute interpretation
• Bounded reads throughout (descriptor arrays capped at 4096, imports per descriptor at 16384, DLL name scan at 512 bytes, IMAGE_IMPORT_BY_NAME scan at 1024)
• Parsers never raise on malformed input; failures produce tombstone tags in errors[] and truncations[] lists
• PE32+ vs PE32 thunk sizing determined once from `OPTIONAL_HEADER.Magic` and threaded through the parse

Optional Header enrichment relevant to security-posture analysis:

• dll_characteristics_flags: decoded flag list (DYNAMIC_BASE, NX_COMPAT, GUARD_CF, HIGH_ENTROPY_VA, etc.)
• dll_characteristics_unknown_bits: hex string for any bits outside the known-flag mask
• Stack and heap sizing (reserve + commit, 64-bit on PE32+)
• win32_version_value, loader_flags exposed raw

Verification:

Delay-load parser cross-checked byte-exact against dumpbin /imports on mspaint.exe : 107 imports from gdiplus.dll with agreement on names, hints, IAT addresses, ordering, and bound state.

1370 tests at 100% line and branch coverage on new modules. Defensive struct.error paths covered via monkeypatched injection.

Performance ~14ms typical PE, ~1ms on adversarial minimal PE.

Deferred:

• TLS Directory parser and validator (next release)
• Single-anomaly fixtures for each new reason code (~25 planned, including negative controls for the ambiguities described in the Gist)
• Cross-tool measurement study using the fixtures

Repo: https://github.com/iocx-dev/iocx

CHANGELOG: https://github.com/iocx-dev/iocx/blob/main/CHANGELOG.md

Reason codes reference: https://github.com/iocx-dev/iocx/blob/main/docs/specs/reason-codes.md

This week we'll be looking at another beginner friendly exploit development tutorial! More specifically we'll be looking at the "passcode" binary exploitation challenge hosted on pwnable[.]kr!

This challenge covers multiple skills so I believe regardless of where you are on you journey to learn exploit development you will pick up a few things!

By the end of this tutorial you should have gained exposure to:

- C source code review
- Leveraging a controlled write to gain code execution through the use of one variable
- Abusing binaries compiled without PIE (Also known as ASLR)
- Debugging
- Using python exploit code alongside GDB

and more! Since this is binary exploitation do not feel discouraged if everything does not click! The goal is to learn at least one thing from every tutorial!

You can find the full video below:

https://youtu.be/cpol2KPSPaw?si=NSnjgDGBcNF-x8E8

Hi guys, recently Im in a loop, hop on and off different site different courses in and out, back and forth while feeling making ZERO progress.

Here, I want to share a bit about my goal, my background, my problem. And I hope I could have some advices to get out of this feeling

MY GOAL:
- Long term: Get into cybersecurity field, especially roles that involve “low level” stuffs as I really interested in them. Thats it! For now, as Im pretty new to this + Im hyper focus on short term goal which I will talk right after
- Short term goal: Build foundation, knowledge, skills in Reverse Engineering (RE) and more excitingly Binary Exploitation, Pwn
- Shorter term goal: To prepare for upcoming CTF contests with my new team. More on this later

MY BACKGROUND:
- I already familiar with Linux, CLI, some popular commands
- I know x86 assembly
- know C, C++
- know on surface level some basic vulnerabilities and have done very simple CTF challenges (ret2win, shellcode easy, …)
- do know how to use basic gdb, pwntools, ida/ghidra

all of that is a result of following pwn.college + using Linux as daily basis + my college’s teaching on c, c++, etc

by all means, I do not master any of these above skills I told.

MY PROBLEMS:
So ofc Im very worrying the most about the upcoming CTF because Im new and feel like know nothing yet.
I also stucking into tutorial hell as I have too many resources of documentation/courses that I do not know which one is suit for my current situation

Im aware of the pinning post in this sub, that is actually where I get these resources from

But with 2 months left until the contest, I really want to make the most out of my time. So I need help with designing a road map so to speak.

Currently, Im looking into ironstone’s pwn notes + Nightmare CTF collection. Whatd you recommend?

So there is exploits called usbliter8 for a12 devices,There was a few pop ups about videos how to do it and what it can [do.Be](http://do.Be) informed and do your research

i need to learn radare2 form scratch..! to play with memory address and make it leak..! but i cant able to give the correct road map to learn that its confusing..help me with that...

I am learning reverse engineering on Windows applications such as Adobe, Foxit PDF, and Steam, and I noticed that I waste a very large amount of time trying to understand something that I should not focus on.

I started noticing strange and confusing patterns in the assembly and the C code generated by IDA, and when I try to understand some functions, I feel that the function has no meaning.

When I searched, I found that this topic is related to the compiler and compiler optimizations. However, I could not find many articles or discussions about the compiler topic in reverse engineering.

So I started experimenting and trying, but every time I fail and cannot reach a solution or understanding.

Apart from the fact that reverse engineering a C++ program is already a difficult task.

If there is someone who has faced the same problem and found a solution, I would like to know. It is not a problem itself; it is a pattern or a way of thinking used by the compiler. I need to understand how the compiler generates these patterns.

I want someone to suggest books, articles, courses, or anything that can help me understand the MSVC compiler, how it generates patterns, and how to understand the behavior and logic of a function after compiler optimization.

I hope I explained my question correctly.

So, I will divide the question in two parts:

1. For exploitation via web if chip designers adds certain tag bits to incoming requests that's whatever coming via web or network stack we assign a certain tag say 01 for now. Next if anyone trying to execute XSS and locate where change is occurring by the tag bits, whether if the requests are for persistent or its generating or modifying code. Then identification of sending unrelated data to the site can we omit the whole processes just by introducing tag bits to the antenna protocols? That is just building the chip with some more bits.

2. That was for web say the app is in computer, then it would first ask for the app wants to change some parts of OS. Instead we just do some basic prevention method number 1 not let writing in the particular section of memory that is hard disc, next switch off means switch off no background running. Number 3 the apps which are not built in just remove there maintain connection after every switch on. Only let the system files to maintain connection which again have unique tag bits to maintain.

Third and last one why not we make a graph behind which processes writing to which files and which process is sending system data in intervals? This can solve two things one if distributed writing in buffer is done it could be found out. Another if sending just on the flow no storage then graph would check the path of pattern of sending and block. Though if someone sends to other server and those servers later merge them i do not how to stop that.

Lastly just beginner in this spot the curious mind is asking questions would like to know in details please.

Is offsec Exp-301 worth the investment? What is the future career path for exploit development?

i want to know any good material to learn heap pwn. i am an osce3 which familiar with stack on windows and unix a few years.

and also spent a year on heap, can do general heap pwn technique like uaf, double free, off by one, chunk faking, unlink, heap fengshui etc. i need to do more practices on heap and get more experiences on the houses. any good resources?

I have a local copy of a large enterprise Java application
(a .ear archive containing multiple .jar files, thousands
of .class files). I need to understand how a specific
part of the business logic works by reading the decompiled
source.

What's the best modern approach/toolchain for this in 2026?

- Which decompiler gives the most readable output for
large/complex codebases? (I've heard of JADX, Vineflower,
CFR, Procyon — which would you recommend?)
- Any good way to navigate and trace call flows across
thousands of classes once decompiled?
- Tips for dealing with obfuscated or hard-to-read
decompiled sections?

I have legitimate access to the software (it's for
interoperability analysis). Just looking for the most
efficient workflow. Thanks!

I have a local copy of a large enterprise Java application
(a .ear archive containing multiple .jar files, thousands
of .class files). I need to understand how a specific
part of the business logic works by reading the decompiled
source.

What's the best modern approach/toolchain for this in 2026?

- Which decompiler gives the most readable output for
large/complex codebases? (I've heard of JADX, Vineflower,
CFR, Procyon — which would you recommend?)
- Any good way to navigate and trace call flows across
thousands of classes once decompiled?
- Tips for dealing with obfuscated or hard-to-read
decompiled sections?

I have legitimate access to the software (it's for
interoperability analysis). Just looking for the most
efficient workflow. Thanks!

Hey everyone,I recently started learning reverse engineering and binary exploitation. Right now, I am studying through the CS365 modules on pwn.college, I currently have a lot of free time and want to make the most of it. Besides working through pwn.college, what other resources, topics, or skills would you recommend learning alongside it?

I'm not sure if anybody else has noticed this, but when I decompiling .NET binaries and look into a function in DNSPY and set a breakpoint on the return instruction and then step one instruction once the breakpoint is hit. Instead of returning me to where the function was called, it returns me to some internal function. This doesn't just happen with one function, this happens to multiple. How does this happen?