@0xdea
Followers
14K
Following
290
Media
1K
Statuses
13K
When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.
Europe
Joined July 2010
It finally happened… I’ve been published on #Phrack! After more than five years since the last issue, #Phrack70 is out, featuring my article “Exploiting a Format String Bug in Solaris CDE”! I guess I can retire now 🐛 https://t.co/6wN7pN0R6p
phrack.org
Click to read the article on phrack
6
64
324
If you’re into #ReverseEngineering, #VulnerabilityResearch, or #Rust, don’t miss @0xdea’s latest: Streamlining Vulnerability Research with the idalib Rust Bindings for IDA 9.2 💻 🦀 Now live on our restyled blog! https://t.co/nHOxQoGnFs
hnsecurity.it
HN Security's Technical Director Marco Ivaldi walks through using idalib's Rust bindings with IDA 9.2 to streamline vulnerability research.
0
8
26
Frida 17.4 introduces Simmy, a new backend for Apple’s Simulators on macOS. Spawn, attach, and instrument apps — just like on a real device.
2
121
472
👉 Check out this guest post from Marco Ivaldi (@0xdea), where he walks through using idalib’s Rust bindings with IDA 9.2 to streamline vulnerability research. Worth a read for anyone in security. https://t.co/nutSZ9RQ5j
0
16
48
It’s a real pleasure to be featured in the @HexRaysSA blog! Thanks for having me.
👉 Check out this guest post from Marco Ivaldi (@0xdea), where he walks through using idalib’s Rust bindings with IDA 9.2 to streamline vulnerability research. Worth a read for anyone in security. https://t.co/nutSZ9RQ5j
1
4
37
Heads up to #mobile pentesters: I've ported my @NowSecureMobile #Frida scripts (#iOS and #Android) to Frida 17, which introduced some breaking changes. The original scripts from 2017 are preserved as release 0.1 for compatibility and historical reference. https://t.co/EK7Bb2JUca
github.com
A collection of my Frida instrumentation scripts for reverse engineering of mobile apps and more. - 0xdea/frida-scripts
2
36
224
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog:
dirkjanm.io
While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise...
143
903
3K
Who is coming to #RomHack2025 next week? See you there 🔥
Another Monday. Another week of… endless emails, annoying meetings, and oh look, a three-headed monkey behind you! Now that we have your attention, we can unveil the agenda for #RomHack2025
https://t.co/P793dQAZdu
#infosec #securityconference
0
1
3
I've updated my #VulnerabilityResearch and #ReverseEngineering tools to use the latest version of @binarly_io #idalib #Rust bindings, which support @HexRaysSA IDA Pro 9.2 and their freshly open-sourced SDK. https://t.co/MbMFvjHrtT
https://t.co/c4hLimHqWu
https://t.co/wPsWzyUax3
github.com
Vulnerability research assistant that locates calls to potentially insecure API functions in a binary file. - 0xdea/rhabdomancer
0
25
101
I'm pleased to announce a new release of the Rust bindings for @HexRaysSA IDA SDK! This release includes v9.2 compatibility, and a number of new features and fixes. Code: https://t.co/h1HJUxe45z Thank you to our contributors: @withzombies Cole Leavitt @IrateWalrus @yeggorv
github.com
Idiomatic Rust bindings for the IDA SDK, enabling the development of standalone analysis tools using IDA v9.x’s idalib - binarly-io/idalib
0
18
60
Eight years later, I’ve updated my most-starred @github repository with some new @fridadotre scripts, inspired by @spaceraccoonsec new book “From Day Zero to Zero Day”. Check it out:
github.com
A collection of my Frida instrumentation scripts for reverse engineering of mobile apps and more. - 0xdea/frida-scripts
0
40
164
Today I have a more serious topic than usual, please consider reposting for reach: My wife and I are urgently looking for a specialist in neuropediatrics or a similar field for our autistic child with a diagnosed, but not further specified, movement disorder [1/3]
3
112
70
We have gone a step further with Noa: memories are machine encoded and stored privately on encrypted servers with **no rich media retained** So you can feel secure using Noa for recall years in the future.❤️ In true Brilliant Labs fashion, we built this because we believed it
1
4
17
Thanks @PortSwigger and @BugBountyDEFCON for this awesome event — and also to my @d3vc0r3 buddies for standing on stage to collect the trophy for me! A little follow-up article on this research is coming soon... stay tuned! 🤘
12
32
461
Always happy news to see my work spark new joy. In this case, my @semgrep ruleset at https://t.co/UQpsnQ8Grv. Congrats to @trailofbits and best wishes for a wonderful career to Will 👍
github.com
A collection of my Semgrep rules to facilitate vulnerability research. - 0xdea/semgrep-rules
Today, we’re disclosing two 9.8 CVSS memory corruption vulnerabilities in the @NVIDIA Triton Inference Server that lets attackers crash production AI services through malicious HTTP requests (CVE-2025-23310 and CVE-2025-23311) 🧵
0
11
45
In our last post, @apps3c shares some PoCs of GenAI/LLM security issues found in real-world assessments conducted for corporate clients, with a focus on vulnerabilities that can be exploited to gain unauthorized access to data, resources, and services. https://t.co/aDxF6OqQpR
hnsecurity.it
Generative AI and LLM technologies have shown great potential in recent years, and for this reason, an increasing number of applications […]
0
3
12
We are very happy to announce the nominees for the 2025 Pwnie Awards! As a reminder, we will be presenting the winners at DEF CON this year. Saturday the 9th, 10:00AM Main Stage. Hope to see you there! https://t.co/hWUu2PcM8B
docs.google.com
Pwnie for Best Crypto Bug X.509DoS Exploiting and Detecting Denial-of-Service Vulnerabilities in Cryptographic Libraries using Crafted X.509 Certificates Bing Shi, Wenchao Li, Yuchen Wang, Xiaolong...
0
48
142
Today I’m celebrating one year of #Rust! 🦀 I started learning it last summer, and since then, I’ve pretty much stopped programming in any other language. I’ve documented my journey in this series of articles: https://t.co/eCbdxsT7uM Here’s to many more years with Rust! 🥂
2
5
51
I'm pleased to announce a new version of the Rust bindings for @HexRaysSA IDA Pro! With: - Improved strings, metadata, and core APIs - Support for the name API Thank you to @0xdea & @williballenthin for contributing! Docs: https://t.co/CcSXJK4rAV Code: https://t.co/4wnfZvRXIH
1
33
114
As an old fart in #xdev, I often get asked how to get into binary exploitation in 2025. I looked around, and here’s my recommendation: https://t.co/hc1SlbSHSj
#pwncollege is a huge collection of free #lectures and practical #challenges maintained by a team of #hackers at @ASU.
1
25
104
In our last blog post, our colleague Gianluca shares the story of a lucky discovery: a bug initially spotted during a routine assessment turned out to be a high impact vulnerability in Microsoft Graph API — earning a $3,000 bounty. https://t.co/F38RmgTUAk
hnsecurity.it
Some months ago, while analyzing a client’s web application, I came across a file conversion feature that transformed documents in […]
0
9
17