Project: mpengine-x64-pdb 1.1.24090.11
File: mpengine.dll
Address: 75a810cc4

Revert

SVG:
dark https://tmr232.github.io/function-graph-overview/render/?graph=https%3A%2F%2Fraw.githubusercontent.com%2Fv-p-b%2Fghidra-function-graph-datasets%2Frefs%2Fheads%2Fmain%2F%2Fmpengine-x64-pdb%2F75a810cc4.json&colors=dark
light https://tmr232.github.io/function-graph-overview/render/?graph=https%3A%2F%2Fraw.githubusercontent.com%2Fv-p-b%2Fghidra-function-graph-datasets%2Frefs%2Fheads%2Fmain%2F%2Fmpengine-x64-pdb%2F75a810cc4.json&colors=light

Our first keynote from Natalie is live! Want to find fully-remote bugs? Learn more about her workflow and lessons learned from a true expert in the field. Bonus: during the Q&A you can learn that even just finding a single obscure file format can be what it takes to find a bug: https://www.youtube.com/watch?v=UOr1F-Tx1Zg

For those who missed it, here's last year's OffensiveCon talk about BLASTPASS explaining what P0 understood at that time:

https://m.youtube.com/watch?v=ZawX9I9MM6Y

I have a question: In Signal, imagine that a new device gets added to your phone as a Linked Device. What sort of notification would you receive on your primary device (phone)? Are there photos of the current workflow here? This article https://www.npr.org/2025/03/25/nx-s1-5339801/pentagon-email-signal-vulnerability asserts that recently Signal added UI to prevent user getting phished and unknowingly adding a linked device. What did they add?

@nixfreak no and tbf I don't really want to provide support for some half-baked stuff, so please just stick to upstream until x64 support gets merged or maybe comment on the relevant PR's if you think you found a bug in them (#97 tracks x64 support).

[RSS] Llama's Paradox - Delving deep into Llama.cpp and exploiting Llama.cpp's Heap Maze, from Heap-Overflow to Remote-Code Execution

https://retr0.blog/blog/llama-rpc-rce

[RSS] Blasting Past Webp

https://googleprojectzero.blogspot.com/2025/03/blasting-past-webp.html

An analysis of the NSO BLASTPASS iMessage exploit

@xgranade Relevant article: LLMs use a lot of the same techniques as psychics' "cold reading" to convince people they know more than they do.

https://softwarecrisis.dev/letters/llmentalist/

@nixfreak submodules maybe? also pls note that I linked an experimental branch, you'll be better off with upstream. if you encounter problems please use the GH issue tracker so others can learn from the answers too!

If it annoys you— as it somewhat does me— that the precise definition of the Rust programming languages is "vibes" and "three separate PDFs, none of them authoritative" and "well, whatever the reference compiler does is the language", this is pretty neat news. https://mastodon.social/@rustfoundation/114229759326166359

When you do this, you think you’re showing how savvy, smart, or “realistic” you are. What you’re actually doing is wasting the time of, and demoralizing, the people who are actually working to try to stop the thing you’ve already surrendered to.

Protip: if someone posts a technical or legal analysis of something the administration is doing or proposing and your response is that legalities are irrelevant and a waste of time, the problem is YOU.

You know who wants you to think laws don’t matter anymore and that pushback is hopeless? Fascists.

Don’t act like a fascist.

Conservative folklore peeps in Hungary: "Folktales carry our Traditional Values and the Ancient Wisdom of Our Ancestors. They follow a strict set of Traditional Rules"

Literal Hungarian folktales I found in archives:

- Princess Rosalia Lemonfarts

- The Diamond Prince in a Rubber Suit

- The Magic Flying Penis

- Rapunzel, but it's a bloke who makes a rope from his body hair

- Saint Peter got drunk and puked the first 🌈

- The Princess who became a Prince

#folklore #folktales #storytelling

Here's how it looks

CodeQLEAKED – Public Secrets Exposure Leads to Potential Supply Chain Attack on GitHub CodeQL https://www.praetorian.com/blog/codeqleaked-public-secrets-exposure-leads-to-supply-chain-attack-on-github-codeql/

As you probably know loadlibrary by @taviso can load Windows DLL's - including Windows Defenders mpengine.dll - on Linux.

Since the loader needed some debugging I ended up figuring out how to load the Linux-native mpclient into #Ghidra's debugger and use it to debug the PE module too:

https://github.com/v-p-b/loadlibrary/blob/x64_waffle/GHIDRA.md

This can spare an IDA license and performing dark arts with awk and gas...which is actually pretty badass, so if you want to keep doing that without IDA here's a Ghidra script too:

https://gist.github.com/v-p-b/c7d934234297158047b678f655c7d99f

CVE-2025-30232 Exim use-after-free can potentially lead to privilege escalation

https://exim.org/static/doc/security/CVE-2025-30232.txt

(was ZDI-CAN-26250)

[RSS] Android VRP Announces AutoRepro - $1,000 bonus for eligible submissions!

https://bughunters.google.com/blog/6496960683835392/android-vrp-announces-autorepro-1-000-bonus-for-eligible-submissions

Day 421. Following up on the no longer available sustainability fact sheets of #Azure data centers from day 420, we have added those that we know of to the Internet Archive.

See https://pastebin.com/5f0dFRqZ