1ce0ear retweeted
New exploit: “xor dword [0xf80c2094], 1<<22”
Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed.
github.com/xoreaxeaxeax/skit…
Tomorrow will be my last day at Google after 27 years, and watching it grow from 25 people to 190,000+ has been an amazing journey. Below is a note I shared with many people internally at Google today. An excerpt is:
It has been an absolute pleasure to work with you and to help build some of the most widely used and impactful products of all time. As a kid, I dreamed of helping build software that would be used by many people, and Google now has thirteen products used by more than a billion people (amazing!). Our work has had a tremendous impact in the world, and I have been lucky enough to collaborate and form friendships with many colleagues that I deeply admire, respect, and enjoy. It still brings me joy every time I see people out in the world using our products to find information, handle email, translate documents, watch videos, learn new things, navigate and understand the physical world, browse the web, use their phone, run large-scale computations on our infrastructure, ride in an autonomous vehicle, or perform complex tasks with the help of our AI systems. I hope you all share this sense of joy, because it is a shared accomplishment! Thank you to all of my colleagues at Google over many years!
Now I'm excited to go start @DiscoLoopAI with my longtime friends and colleagues @Sanjay_Ghemawat, @OriolVinyalsML, and @quocleix.
(Updated post: slightly redacted to not have some personal info)
Slides for our OffensiveCon talk (by me and @jmartijnb) androidoffsec.withgoogle.com…:
A tiny mistake in a render config ➡️ corrupt a special GPU stack pointer register ➡️ GPU hardware “renders” pixels to the AP kernel directly ➡️ pwned
More presentations: androidoffsec.withgoogle.com… :)
1ce0ear retweeted
Back from an amazing @offensive_con 2026!
It's been an honor to be on stage and present our Google WiFi Pro/QSEE research.
Thanks everyone at @Binary_Gecko for making it awesome.
1ce0ear retweeted
Booyah it's been confirmed! 🎉 splitline (@_splitline_) of DEVCORE Research Team chained 2 bugs to exploit Microsoft SharePoint, earning $100,000 and 10 Master of Pwn points. Massive aura farming this year at #P2OBerlin. Full win! #Pwn2Own
Thanks to everyone who came out - an unconventional GPU exploit where the hardware itself becomes the primitive, ultimately patching the AP kernel back.
Tile-Based Deferred Rooting: When Your GPU Starts Rendering To Kernel Code Space! by @1ce0ear and @jmartijnb
Going to present an unconventional exploit ;)
By corrupting a GPU stack pointer register as part of the TBDR pipeline and some blackbox work, GPU hardware may write vertex / pixel shader to arbitrary pages. Ultimately, the hardware can patch AP kernel back~
Slide: powerofcommunity.net/2025/sl…
Thanks for the fantastic conference @POC_Crew :)
Sweet talk, enjoyed it!
Xingyu Jin (@1ce0ear) & Martijn Bogaard (@jmartijnb) – Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers 🐧🛠️
#POC2025
CVE-2022-22265 -> CVE-2025-23102 ? 😂
Slides from @n0psledbyte, @st424204 & @Peterpan980927 at @codeblue_jp talk are also up:
“Dancing with Exynos Coprocessor: Pwning Samsung for fun and ‘profit’”
github.com/star-sg/Presentat…
Shout-out to @rainbowpigeon_ for contributing a lot in this research during his internship.
1ce0ear retweeted
I've uploaded the slides of my recent talk "JS Engine Security in 2025": saelo.github.io/presentation…. I think there'll also be a recording available at some point (otherwise I can make one as not everything's in the slides).
Thanks for the fantastic conference @POC_Crew!
1ce0ear retweeted
Sweet talk, enjoyed it!
Xingyu Jin (@1ce0ear) & Martijn Bogaard (@jmartijnb) – Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers 🐧🛠️
#POC2025
1ce0ear retweeted
Guide to fuzzing the Binder kernel driver using the Linux Kernel Library (LKL)
androidoffsec.withgoogle.com…
Credits Eugene Rodionov, Gulshan Singh and Zi Fan Tan
#infosec


































