@SpecterDev

Interested in Security and Exploit Development. Nano is the one true text editor.

 🇨🇦 Ontario
dayzerosec.com
Joined August 2015
  • Tweets1.2K
  • Following272
  • Followers39.3K
60Media
Method we used (>5 years ago, now) on ps5 to fiddle with mp4 and hv memory: github.com/fail0verflow/pros… hope it helps for linux!

GitHub - fail0verflow/prosperous

Contribute to fail0verflow/prosperous development by creating an account on GitHub.

github.com
18
106
10
678
147,135
Specter retweeted
Ryan M@GrimdoomerMar 13
Incredible talk on hacking the Xbox One security processor youtube.com/watch?v=FTFn4UZs…

RE//verse 2026: Hacking the Xbox One by Markus 'doom' Gaasedelen

From RE//verse 2026, catch Markus Gaasedelen’s talk Hacking the Xbo...

youtube.com
7
51
3
364
45,485
My @dayzerosec co-host zi and I are giving our 1st training @ hardwear.io with a focus on attacking security hypervisors! Trainings are something we've wanted to do for a while. Take a look and share to those who would be interested :) hardwear.io/usa-2025/trainin…

Hardwear.io NL 2026 – Hardware Security Conference

Attend Hardwear.io NL 2026 for top hardware security trainings, talks, CTFs, and networking in Amsterdam this November. Register today!

hardwear.io
11
33
1
203
54,271
We have a training by @SpecterDev & Zi on Attacking Hypervisors From KVM to Mobile Security Platforms hardwear.io/usa-2025/trainin…
Specter@SpecterDev8 Mar 2025
I've published a write-up on reversing and analyzing Samsung's H-Arx hypervisor architecture for Exynos devices, which has had a lot of changes in recent years and pretty interesting design. Hope you all enjoy :) dayzerosec.com/blog/2025/03/…

Reversing Samsung's H-Arx Hypervisor Framework - Part 1

In many ways, mobile devices lead the security industry when it comes to defense-in-depth and mitigation. Over the years, it has been proven time and again that the kernel cannot be trusted to be...

dayzerosec.com
8
1
36
18,189
Specter retweeted
REcon
@reconmtl19 Feb 2025
Recon Training 23-26 June 2025: KVM to Mobile Security Platforms - Attacking Hypervisors with @SpecterDev and zi from @dayzerosec (4 days) For more details recon.cx/2025/trainingFromKV…
7
34
10,372
github.com/google/security-r… Our newest research project is finally public! We can load malicious microcode on Zen1-Zen4 CPUs!

AMD: Microcode Signature Verification Vulnerability

### Summary Google Security Team has identified a security vulnerability in some AMD Zen-based CPUs. This vulnerability allows an adversary with local administrator privileges (ring 0 from outside...

github.com
12
263
12
795
124,772
Inside console security: How innovations shape future hardware protection - helpnetsecurity.com/2024/10/… - @PlayStation @hardwear_io #HardwareSecurity #hw_ioNL2024 #PlayStation #gaming #CyberSecurity #netsec #security #InfoSecurity #ITsecurity #CyberSecurityNews #SecurityNews
8
3
31
22,234
The PS5's hypervisor has kept the system secure for years—now, vulnerabilities are being revealed. What does this mean for gamers? 🕵️‍♂️🚨 Join @SpecterDev at #hw_ioNL2024 Know More: hardwear.io/netherlands-2024… #ps5 #exploit #hardware
8
34
2
221
33,796
There are a few ways on PS5 to defeat HV. One of methods that I've found was related to APIC: struct apic_ops is located in RW segment of kernel data. With KRW you can overwrite a function pointer inside it like xapic_mode and get into ROP, for example (just need to bypass CFI).
34
58
6
578
73,282
Well, this is PS5's umtx exploit for BD-J (a part related to the exploit actually): gist.github.com/flatz/89dfe9…

KernelExploitGraal.java

GitHub Gist: instantly share code, notes, and snippets.

gist.github.com
21
77
6
467
84,878
Hello, folks. I'm in Serbia/UAE nowadays and looking for new job opportunities in info security. Remote jobs are currently preferred. CV: github.com/flatz/cv
17
50
9
222
68,547
the most annoying thing about the jailbreak beggars isn’t even the brazen entitlement. it’s refusing to understand that the time/effort needed to exploit something is not linear and often totally unpredictable. “Eta wen???” despite this being explained to them hundreds of times
26
25
4
485
98,820
Specter retweeted
Andy Nguyen@theflow030 Apr 2024
Decided to publish PPPwn early. The first PlayStation 4 Kernel RCE. Supporting FWs upto 11.00. github.com/TheOfficialFloW/P…
331
903
122
4,578
636,385
Specter retweeted
Geebz@Gbps11127 Mar 2024
I just published the long-awaited Part 2 to my PCIe blog post series - "All About Memory: MMIO, DMA, TLPs, and more!" This post also includes a companion experiment where I dive into what pcileech looks like over a PCIe protocol analyzer. Please enjoy! ctf.re/kernel/pcie/tutorial/…

PCIe Part 2 - All About Memory: MMIO, DMA, TLPs, and more!

Diving into how PCIe devices transfer data (Part 2 of the series)

ctf.re
4
62
2
199
27,853
github.com/TravMurav/Qcom-Se… Ohhh someone reverse engineered QC SL!! :-)

GitHub - TravMurav/Qcom-Secure-Launch: Overview of Secure-Launch process on Qualcomm devices

Overview of Secure-Launch process on Qualcomm devices - TravMurav/Qcom-Secure-Launch

github.com
1
19
77
17,607
sendspace.com/file/o0c0pi 4.03 hen courtesy of @sleirsgoevy . He calls it "ps4 fpkg enabler". give it a shot :)
49
89
9
413
174,765
Hello World
32
88
8
525
77,031
finally... hello, PS5 PSP :)
127
237
50
1,485
354,501
Talk Upload! 🐒Tamarin Cable (The 1st open-source iPhone JTAG cable) & JTagging the📲iPhone ⚡In this talk, Thomas @ghidraninja demonstrated his Lightning #Fuzzer + implemented a low-level fuzzing of the iPhone using Lightning▶️youtu.be/vmQcrU5pNvU #hw_ioUSA2023 #Conference
7
31
11,267
🎮PS5 enthusiasts! Specter's talk is here! ⚡Specter @SpecterDev presented the evolving attack surface, modern mitigations like Supervisor Mode Access Prevention (SMAP) etc + internal workings of the PS5's hypervisor ▶️youtu.be/HBFDjfmIUis #hw_ioUSA2023 #gamingconsole

Next-Gen Exploitation: Exploring The PS5 Security Landscape by...

Abstract:---------------The PlayStation 5 (PS5) represents a sign...

youtube.com
3
69
2
230
69,262
Load more