amraam (@aim120c8) header
amraam (@aim120c8) profile picture

(en/kr) yet another script kiddie

Joined December 2025
Photo by amraam (@aim120c8)Photo by amraam (@aim120c8)Photo by amraam (@aim120c8)Photo by amraam (@aim120c8)Photo by amraam (@aim120c8)
amraam retweeted
How to find ALL PHP bugs: 1. Compile code (e.g. to RISC-V, x86, LLVM IR) 2. Vibe prove ASAN and non-ASAN versions have same behavior across all inputs. Hard, but Claude can do it! 3. Find a LOT of bugs Super proud of our work. A big step towards finding ALL memory safety bugs
New on our Frontier Red Team blog: using Claude to formally verify software at large scale. Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time). With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks. Read our research in full here: anthropic.com/research/forma…
24
61
5
1,190
55,674
amraam retweeted
Cloudflare の Public DNS 1.1.1.1 に脆弱性があることを示す PoC blog.alice.poc.debiru.net/ 1.1.1.1 を使っている人は FAKE サーバーに辿り着くはずです。 (参考) 検証用URL blog.alice.poc.debiru.net/ FAKEサーバー debiru.static.jp/ TRUEサーバー blog.bob.poc.debiru.net/
1
25
161
26,697
I am a reverse engineer. I worked on wine/proton myself. I even signed a contract with that billion dollar video game company. Wine/proton is clean room. This is not. Not even close.
Reverse engineering is legal in the United States. We have a billion dollar video game company shipping a Windows compatibility layer in their product. He’ll be fine. Stop the doom posting.
21
134
4
4,509
161,904
Why switched? Fable 5 (or Anthropic's cyber-whatever guardrail) rejected every single request I've tried so far for both my personal and work-relates uses. Sol does everything I requested just right, faster than always-stalling slow-af Opus 4.8 with just high or xhigh effort.
Or… what if we gave you $100 in Codex credits if you tell us what you love about GPT-5.6 Sol or why you switched? Tweet it, claim your gift, enjoy more usage. First 10k get the free tokens! switch-to-codex.openai.chatg…
68
30+ projects have already joined. Our goal is to prepare maintainers for machine-speed bug discovery. We put a team on each project, aim models at the code, patch the findings, and build custom security infrastructure for triage at scale. blog.trailofbits.com/2026/06…
1
8
2
28
5,359
amraam retweeted
How PatchGuard detects hypervisor-based hooks. Written by two Riot Games Anti-Cheat Engineers. Some of the most underrated researchers in the Windows internals and kernel/hypervisor security space. Microsoft embedded multiple detection techniques inside PatchGuard to catch hypervisors hiding the real LSTAR MSR value. Trap flags, MOV SS tricks, ICEBP edge cases, LSTAR shadowing, and deliberately triggered page faults that expose the real syscall handler address. Part 2 includes a custom detection technique with a full working PoC. Part 1: revers.engineering/patchguar… Part 2: revers.engineering/patchguar… PoC: github.com/ajkhoury/Errata13… Authors: @nickeverdox @aidankhoury #WindowsInternals #ReverseEngineering #AntiCheat
If you have ever wanted to learn reverse engineering but had no idea where to start, this is probably the best free series out there. Applied Reverse Engineering by @daaximus covers basic architecture, the stack, exceptions and interrupts, x64 assembly, control-flow tracing, and more still coming including hooking techniques, ROP, heuristic analysis, and C++ class reconstruction. Written for people who have opened a debugger a handful of times and got lost. Starts from zero and actually makes sense. revers.engineering/applied-r… #ReverseEngineering #WindowsInternals #InfoSec
4
67
465
33,247
amraam retweeted
Researcher found a design flaw in EasyAntiCheat's driver that allows injecting and executing unsigned code inside any EAC-protected game process. Even with HVCI and Secure Boot enabled. Covers how EAC bridges between the kernel driver and the game's modules and how a flaw in that bridge gives unrestricted code execution. Post is from 2021 but the design patterns in anti-cheat service initialization remain relevant. Blog: back.engineering/blog/10/08/… Video: youtube.com/watch?v=Q2kDhvhA… Authors: @sinclairq8 @_xeroxz #AntiCheat #ReverseEngineering #InfoSec
Researcher bypassed EasyAntiCheat's driver self-integrity using a hypervisor-based debugger with EPT to trace the integrity check routine, Capstone disassembly framework to analyze the driver, and ZwQuerySystemInformation to locate the checksummed pool copy. Patched both the original and the copy. Integrity checks disabled entirely. Once bypassed, any EAC code can be hooked or patched without triggering a kick or ban. Post is from 2020 but the underlying techniques still apply. Kernel pool manipulation, hypervisor-assisted debugging, and driver integrity analysis remain fundamental to anti-cheat research. Author: @iPowerPower @the_secret_club secret.club/2020/04/08/eac_i… github.com/thesecretclub/CVE… #AntiCheat #ReverseEngineering #InfoSec
24
1
144
34,667
> be gamers > "I DONT TRUST KERNEL MODE ANTI CHEATS!11" > "ILL NEVER TRUST A VIDEO GAME COMPANY" > runs anime_waifu_wallpaper.exe as admin
I don't know how is this even a news to anyone. Had a look at Kasperksy's website - big shock - what do you mean running an "exe" based wallpapers is used as attack vector. 🙄 If you don't know, there is a ton of pirated porn and games on Wallpaper Engine's workshop that just pretend to be wallpapers, but in reality it's just a way of certain "regions" share illegal content. So it's not surprising it's used as an attack vector - you are literally running a random exe on your PC, when you download those wallpapers.
49
149
2,977
79,590
amraam retweeted
- Hacker steals Claude agent - Hacker uses Claude to hack - Hacker pivots to compromised server - Hacker uploads Claude (with logs) to server??? - We investigate compromised server - Full agent logs detailing hacking recovered 😅 AI agentic hacking deep dive: 50 servers, 14 companies, all the prompts, tools, attribution...
25
85
11
708
176,226
Tired of noobs complaining the WINAPI for malware development is weird. It's not. How do you create a file? The CreateFile function. How do you open a file for reading? The CreateFile function. How do you open a file for writing? The CreateFile function. How do you get a handle to a directory? The CreateFile function. How do delete a file? The CreateFile function. How do you get access to a physical disk? The CreateFile function. How do you get access to a file stream? The CreateFile function. How do you get access to the console buffer? The CreateFile function. How do you get access to pipes? The CreateFile function. How do you perform interprocess communication? The CreateFile function. Just make sure you use the appropriate version of CreateFile (CreateFileA for ANSI, or CreateFileW for wide characters). Alternatively, you can use CreateFile2 which is the same as CreateFile except the parameters are passed as a data structure named CREATEFILE2_EXTENDED_PARAMETERS. However, be aware CreateFile2 only works on Windows 8 and above and designed more or less for programs running from the Windows app store. Alternatively, alternatively, you could use CreateFile3 which is nearly identical to CreateFile2 except it uses the CREATEFILE3_EXTENDED_PARAMETERS structure and is more or less designed for sandboxed packaged applications. However, be aware CreateFile3 only works on Windows11 24H2 and above. It's shrimple, honestly.
84
137
17
2,831
139,341
"Claudeへの指示"に脆弱性を探させるためのテクニックを設定しているので、Fable 5に「こんにちは」と言うだけでOpus 4.8にされる。
19
1
151
12,445
> protect the kids > look inside > mass surveillance
🚨 Tech companies like Apple and Google have three months. Activate safeguards on smartphones and tablets to detect and block nude images for children or we will bring forward legislation to force you to do so.
75
2,957
13
27,548
280,633
amraam retweeted
🍎 Happy #WWDC26 week! 🚀 We've just released a major update to Investigating macOS Endpoints, featuring an all-new hands-on macOS forensics scenario. Put your investigative skills to the test in a realistic case environment and gain experience tackling challenges you'll encounter during real-world macOS investigations. 👉 youtube.com/watch?v=tRvw13e3…
3
1
13
1,083
Latest post showing once again the power of system over model 👀 See how Gemma 4 31b performs trying to find CVE-2026-4747 : the same FreeBSD RCE that Mythos found and AISLE rediscovered with local models
1
4
11
1,073
amraam retweeted
i made a new game called js crossword where you have to solve it by literally writing javascript code that eval()'s into the correct values! check it out if you're into ctfs or wanna challenge your javascript skills hope y'all have fun playing it <3
23
39
6
454
47,206
One of the most frequent questions I'm asked is "how do you stay up to date on malware stuff?" Okay, here is a pro tip: 1. Google OTX AlienVault 2. Make account 3. Look at latest 4. Scroll until you find posts from a guy named Petr something-something (has numbers in his name). 4. Follow his account He monitors all the big malware places and shares the URL, hashes, etc. from malware vendors. I've been following this random ass dude for years and getting updates on everything. I have no idea who he is. I don't know where he's from. All I know is his setup is absolute fire and he keeps you up to date on literally everything malware related 24/7 365. He also has stuff from vendors in China, Russia, Japan, etc. Every morning I log into OTX and check up on my boy Petr to see what fire he's bringing me. I love him.
42
183
5
2,889
92,590
42
934
60
9,557
251,786
amraam retweeted
No. The vectors you keep citing (JS scan, DNS rebind, reflection) still require luring the victim to attacker-controlled content first. Exact private IP from the screenshot adds nothing practical—common RFC 1918 ranges scan in <100 ms regardless. Redaction changes zero remote risk. Private IPs remain non-routable from the public net.
1
1
128
7,782
Chinese LLMs can hack better than state-sponsored hackers with properly evolved harness - Kimi K2.5 managed to find and exploit 6 vulnerabilities in browsers: a single page view or an extension install by victims equal full system hijack. Check arxiv.org/abs/2604.20801
44
405
35
2,439
198,750