Technology enthusiast and mobile security researcher experienced in pentesting of mobile apps. Reach out at [email protected] for technical consultation.
Joined October 2022
- Tweets127
- Following108
- Followers592
- Likes504
FatalSec retweeted
Introducing usbliter8
An A12/A13 SecureROM exploit
A novel iPhone BootROM vulnerability discovered and exploited by our team. It covers the underlying bug, the associated exploitation techniques, and the post-exploitation steps required to achieve application processor's boot-chain compromise.
The exploit leverages both a hardware bug in the USB controller and a specific configuration flaw present in the device firmware.
ps.tc/pages/blog-usbliter8.h…
poc:
github.com/prdgmshift/usblit…
FatalSec retweeted
GitHub - lautarovculic/ioscpy: A macOS CLI that mirrors and controls a jailbroken iPhone over USB. github.com/lautarovculic/ios…
FatalSec retweeted
Syscall Tracer🔥🔥
Sometimes it’s useful to observe the system calls happening inside a given target process. Especially if the target includes some kind of Frida detection, root detection, or any other kind of Runtime Application Self-Protection (RASP).
frida.re/news/2026/03/09/fri…
FatalSec retweeted
I took time to wrap up some notes about PAC and play with it!
blog.reversesociety.co/blog/…
FatalSec retweeted
"Dr. Bytecode or: How I Learned to Stop Worrying and Obfuscate Java"
A tale about how @farenain started his journey in Java software obfuscation.
blog.quarkslab.com/how-to-wr…
ALT Java is a bomb you ride backwards.
FatalSec retweeted
🚨 REcon 2026 is LIVE!
🚀 Call for papers and registration are now open!
Join the world's top reverse engineers & exploit devs in Montreal:
🛠 Trainings: June 15-18 (19 hands-on classes – AI agents, kernel exploits, Rust/Go reversing, fault injection & more!)
📅 Conference: June 19-21
Tickets & early bird now open → recon.cx
Shoutout to the legends teaching: @SinSinology @KyleMartin @MalachiJonesPhD @andreyknvl @mr_phrazer @yarden_shafir @DrCh40s @pulsoid
+ more elite instructors! See website for all trainers and session info.
Limited spots – see you in MTL! #REcon2026 #ReverseEngineering
FatalSec retweeted
Our journey with the #iOS emulator continues.
We show how we reached the home screen, enabled multitouch, unlocked network access, and started running real apps 👉 eshard.com/posts/emulating-i…
FatalSec retweeted
Attention @kalilinux users! In the coming day(s), apt update is going to fail for pretty much everyone.
The reason? We had to roll a new signing key for the Kali repository. You need to download and install the new key manually: offs.ec/4lUEtak
FatalSec retweeted
After 2 years from the last release, APKiD v3.0.0 is out !🔥 - "Black Hawk edition"
📃 Changelog: github.com/rednaga/APKiD/rel…
🐍 Pypi package: `$ pip install --upgrade apkid`
Thanks to @AbhiTheModder for the stunning work 🙌
FatalSec retweeted
There is a small bug in the signature verification of OTA packages in the Android Open Source Framework.
Official builds doing normal double verification of packages are not vulnerable but OEMs and third party apps may be.
Jérémy Jourdois explains it here:
blog.quarkslab.com/aosp_ota_…
FatalSec retweeted
CVE-2025-24118 is an absolutely crazy race condition I found in the macOS / XNU kernel.
Safe memory reclamation, read-only objects, memcpy implementation details, and a race condition- oh my!
jprx.io/cve-2025-24118
FatalSec retweeted
Uploaded my slides for my presentation at #OBTS. Go check it out if you missed it!
FatalSec retweeted
Curious about mastering radare2? This Advent guide is perfect for both beginners and experts. It covers the essentials step-by-step, making it simple to learn from scratch. Start your journey here: rada.re/advent/
@radareorg #aor24
FatalSec retweeted
Go behind the scenes with @Fridadotre creator @oleavr to learn about the hard work entailed in achieving iOS 17 support in Frida & peep code examples for interacting directly with Apple device-side APIs. #Frida
loom.ly/nUccYIg 14
FatalSec retweeted
Heap overflow in JPEG loading in Samsung's Little Kernel in bootloader allows a privileged attacker to execute persistent arbitrary code (it survives reboots and factory reset) CVE-2024-20832 by @quarkslab
Paper: sstic.org/media/SSTIC2024/SS…
Slides: sstic.org/media/SSTIC2024/SS…
FatalSec retweeted
Happy to announce the release of our LLVM-based (dis)assembler framework, Nyxstone. It supports all architectures of LLVM, label-support in the assembler comes with Python & Rust bindings.
We are happy to open source Nyxstone, our (dis)assembly framework. It supports all LLVM 15 architectures, with C++, Rust, and Python bindings.
Check out our technical blog post and the repository for more details:
Blog: emproof.com/introducing-nyxs…
GitHub: github.com/emproof-com/nyxst…
FatalSec retweeted
📣📣📣 Calling all Google CTF players! Qualify for Hackceler8 2024 in Malaga by participating in our online CTF qualification round on June 21-23. Register your team now at goo.gle/ctf. See our blog post for details.
bughunters.google.com/blog/5…