CVE-2025-8045

CVE-2025-8045 — UAF en la cola KCPU de la GPU Arm Mali Un exploit de escalada de privilegios local para CVE-2025-8045 , un use-after-free en el controlador del kernel de la GPU Arm Mali kbase. Un proceso local sin privilegios hace una carrera contra la ruta de volcado de la cola KCPU del CSF para...

sony-vp-extract

Sony WH-1000XM4 Extractor de Paquetes de Voz Descifra y extrae las indicaciones MP3 de guía de voz de los archivos de firmware cifrados de los Sony WH-1000XM4. La clave AES-128-CBC se ob...

rtl_433

rtl433 rtl433 despite the name is a generic data receiver, mainly for the 433.92 MHz, 868 MHz SRD, 315 MHz, 345 MHz, and 915 MHz ISM bands. The official source code is in the https://github.com/merbanan/rtl433/ repository. See also a list of software that works with rtl433 in the wiki. For more...

BootStomp

BootStomp BootStomp 是一个引导加载程序漏洞查找工具。它针对两类不同的漏洞进行检测：内存损坏和状态存储漏洞。更多信息请参考 BootStomp 论文：https://seclab.cs.ucsb.edu/academic/publishing/bootstomp-security-bootloaders-mobile-devices-2017 要运行 BootStomp 的分析，请阅读以下说明。请注意，BootStomp 适用于为 ARM 架构（32 位和 64 位）编译的引导加载程序，并且结果可能因 angr 和 Z3 的版本而略有不同。这是因为 angr...

deREferencing

deREferencing deReferencing 是一个 IDA Pro 插件，实现了新的寄存器和栈视图。它添加了解引用指针、颜色和其他有用的信息，类似于某些 GDB 插件（例如：PEDA、GEF、pwndbg 等）。 支持以下架构：x86、x86-64、ARM、ARM64、MIPS32 和 MIPS64 要求 IDA-Pro = 7.1 安装 使用 hcli 安装： root@kitploit: hcli plugin install dereferencing 或者，手动安装：将 dereferencing.py 文件和 dereferencing 文件夹放入 IDA 的插件目...

CVE-2023-6241

Exploit for CVE-2023-6241 The write up can be found here. This is a bug in the Arm Mali kernel driver that I reported in November 2023. The bug can be used to gain arbitrary kernel code execution from the untrusted app domain, which is then used to disable SELinux and gain root. The exploit is...

unicorn

Unicorn Engine LOOKING FOR CONTRIBUTORS! See this. Unicorn is a lightweight, multi-platform, multi-architecture CPU emulator framework, based on QEMU. Unicorn offers some unparalleled features: Multi-architecture: ARM, ARM64 ARMv8, M68K, MIPS, PowerPC, RISCV, SPARC, S390X, TriCore and X86 16, 32,...

pefile

pefile pefile is a multi-platform Python module to parse and work with Portable Executable PE files. Most of the information contained in the PE file headers is accessible, as well as all the sections' details and data. The structures defined in the Windows header files will be accessible as...

Trinity

Trinity Trinity es el tercer jailbreak público para la PS Vita™ , que es compatible con los firmware más recientes 3.69 y 3.70. La cadena de explotación consta de tres etapas: el exploit del kernel MIPS, el escape del emulador de PSP y el exploit del kernel ARM. Write-up Una explicación técnica d...

checkov

...

internalblue

Broadcom chips are used in approximately a billion of devices, such as all iPhones , MacBooks , the Samsung Galaxy S series, the older Google Nexus series, older Thinkpads , Raspberry Pis , various IoT devices, and more. In 2016, Cypress acquired the IoT division of Broadcom. Since then, firmware...

DEBIAN-CVE-2026-90306

In the Linux kernel, the following vulnerability has been resolved: ARM: 9481/2: breakpoint: CFI breakpoints only on demand This removes the stub hwbreakpointcfihandler from ARM, making it not steal breakpoint type 0x03 ARMENTRYCFIBREAKPOINT unless CFI is actively used in the kernel. When not...

patching

Patching - Interactive Binary Patching for IDA Pro Overview Patching assembly code to change the behavior of an existing program is not uncommon in malware analysis, software reverse engineering, and broader domains of security research. This project extends the popular IDA Pro disassembler to...

patching

Patching - IDA Pro的交互式二进制补丁工具 概述 在恶意软件分析、软件逆向工程以及更广泛的安全研究领域中，通过修改汇编代码来改变现有程序的行为并不罕见。本项目扩展了流行的 IDA Pro 反汇编器，打造了一个更强大的交互式二进制补丁工作流，旨在支持快速迭代。 本项目目前基于普遍使用的 Keystone Engine 的一个小型 fork，支持 x86/x64 和 Arm/Arm64 架构的补丁，并计划在未来的版本中启用剩余的 Keystone 架构。 特别感谢 Hex-Rays 对本插件开发的支持。 版本发布 v0.2 —— 重要错误修复，IDA 9 兼容性 v0.1 —...

kali-rpi-luks-crypt

Cifrado de disco completo para Kali en Raspberry u otra arquitectura similar usando LUKS Esta guía está dedicada a ejecutar Kali en Raspberry u otra arquitectura similar, p. ej. ODROID-C2 usando cifrado de disco completo con LUKS. Basada en el documento un poco desactualizado aquí. Motivación...

plasma

PLASMA 旧项目名称为 Reverse 。 PLASMA 是一个交互式反汇编器。它可以生成更易读的汇编代码（伪代码）并带有彩色语法。你可以使用可用的 Python API 编写脚本（见下方示例）。该项目仍在大力开发中。 wiki : TODO 列表和一些文档。 它支持： 架构：x8664、ARM、MIPS64（ARM 和 MIPS 部分支持） 格式：ELF、PE、RAW 警告 ：在结构和类型定义实现之前，数据库兼容性可能被破坏。 依赖项 python = 3.4 capstone，测试版本 4.0-alpha5 python-pyelftools pefile +...

CVE-2026-90306

CVE-2026-90306 affects the Linux kernel on ARM architectures. The vulnerability resides in the hw_breakpoint_cfi_handler() stub, which was unconditionally claiming breakpoint type 0x03 (ARM_ENTRY_CFI_BREAKPOINT) even when CFI (Control Flow Integrity) was not actively instrumented in the kernel. T...

CVE-2026-90305

CVE-2026-90305 affects the Linux kernel on ARM when PREEMPT_RT is enabled. The root cause is that commit c6e61c06d606 enabled PREEMPT_RT on ARM without selecting HAVE_POSIX_CPU_TIMERS_TASK_WORK , leaving CPU timers to expire in hard IRQ context . On PREEMPT_RT, this causes run_posix_cpu_timers() ...

CVE-2026-90304

CVE-2026-90304 affects the Linux kernel on ARM architectures. The vulnerability resides in the exception handlers do_DataAbort() and do_PrefetchAbort() , where PREEMPT_RT requires interrupts to be enabled when sending signals. However, when an unhandled user fault is triggered (i.e., the hook fun...

CVE-2026-90303

CVE-2026-90303 affects the Linux kernel on ARM architecture. When CONFIG_DEBUG_USER=y and the kernel command-line option user_debug=31 are active, a user fault can trigger show_pte() without holding any lock. If another thread in the same process concurrently calls munmap() , page table pages may...