Team Lead of PSIRT and Threat Research, TXOne Networks. Speaker at Black Hat USA, CODE BLUE, DEFCON, HITB, HITCON, S4, SECTOR. Author of Windows APT Warfare
台灣
Joined December 2013
- Tweets3.1K
- Following570
- Followers2.8K
- Likes4.2K
adr retweeted
中国社区逆向拆解了Claude的封号机制。以下是他们的发现
Claude使用积分制。注册时账号获得初始分数，之后根据行为加分或扣分。低于阈值直接封号。回分很难
影响分数的因素:
注册
> 干净IP是最重要的因素。不一定要家宽，但必须干净
> Gmail已经不是最优选，有权重更高的邮箱服务
> 注册时直接弹KYC的号可以扔了
> 用手机App注册会加分
支付
> 刚注册就订阅会扣分
> 直接上Max会大幅扣分。最好等两天先订Pro
> 支付时弹KYC说明账号在考察期，但不一定会封
> 国外实体银行卡加分。Google Play也行。虚拟卡扣分
使用
> 不要一次把限额用完。宁可两个号轮换也不要一个号撸到底
> Desktop客户端有少量加分。尽量少用网页端
> 手机端也有少量加分
> 开启记忆功能加分。记忆文件越多分越高
IP和设备
> 稳定性是关键。不要跳IP，尽量一直用同一个
> 代理必须全局模式并开启TUN
> 多设备登录大幅扣分。理想状态是一台电脑一个客户端
> 频繁换IP、频繁登录、高并发都会大幅扣分
账号年龄
> 老号有巨大的容错空间。2023年的号明显更高
> 分数随时间增长，但很慢
其他
> Windows和macOS没区别。Linux会扣分
> 时区和语言基本不影响。不会因为北京时间就封号
> 跟Claude说自己是中国人没问题，记忆不会触发封号
> 大量使用Fable会扣分
> 升级Max大概率进入观察期，除非是高权重老号
观察期和封号
> 接近阈值时账号可能进入观察期。典型特征是掉登录
> 观察期继续扣分就会封号
> 高分号可以扛过多次观察期
关注我，拆解你每天在用的服务背后到底怎么运作的
adr retweeted
终于找到克制Codex过度防御的办法了。
用Codex最烦的就是改个小功能，塞满判空等一堆测试，浪费时间。
开源项目OpenCode 在 AGENTS.md 里立的 4 条规矩，专治 AI 的过度设计，建议直接抄进你的AGENT.MD：
1、防过度防御：几乎不会发生的边界/并发问题，讲清概率并经用户确认后再加，严禁为“理论上更稳”私自膨胀代码。
2、入口单次校验：外部数据只在边界校验一次，内部靠类型系统流转，禁止层层重复判断。
3、拒绝提前抽象：单次使用的逻辑就近内联，不随意提前拆分无意义的 helper。
4、控制复杂度：非必要不用 try/catch，能单函数清晰搞定的别硬拆。
以上4条分别对应图片中标记出来的几行内容，直接复制英文即可，github项目地址我帖在评论区。
adr retweeted
Yup, reverse the chain is fun 👍🏻🤟🏻
@orange_8361
adr retweeted
Everyone is running someone else's harness.
Kerness is the kernel underneath harness: provider transport, tool dialects, the turn loop, access control, memory, compaction, resume.
You write the Markdown saying how yours behaves. 60 seconds, not 6 weeks.
Written in rust with python binding.
github.com/xwings/kerness
adr retweeted
We're excited to highlight 2026 Microsoft Most Valuable Researcher Angelboy (@scwuaptx), who presented at Black Hat USA this week.
Drawing on years of Windows security research, Angelboy shared how vulnerabilities can emerge from unexpected interactions between drivers, transports, and system components, even within attack surfaces that have been studied extensively. His talk discussed a new way of thinking about vulnerability discovery, demonstrating how researchers can uncover overlooked paths to privilege escalation and sandbox escape by examining systems across layers rather than in isolation.
So glad to meet Taiwanese old friend @ashl3y_shen at Google Cloud event during Black Hat USA, with a new collection to have myself version card, so nice! 🥳 – at Las Vegas, NV
adr retweeted
RoguePlanet: Defender Quarantine Pipeline LPE Zero-Day:
offsitedark.com/signals/rogu…
#zeroday #exploit #exploitation #infosec #vulnerability #cybersecurity #lpe
adr retweeted
My Windows reverse engineering and exploit research workflow has been:
1. Pick a binary to research like tcpip.sys
2. Use github.com/joshterrill/post-… to automate seeing existing binary versions, download, and generate diffs from them
3. Load the resulting .binexport's and .bindiff into an LLM and ask it to analyze
4. Look up the build number of previous Windows version that old binary existed in from uupdump.net/ such as 26100.8328 and create a VM from it
5. Write code and test, working backwards from LLM analysis
adr retweeted
New #TinyTracer (4.0) is ready: github.com/hasherezade/tiny_… - refactored for compatibility with the latest PIN - and with some new features!
adr retweeted
There it is! Orange Tsai (@orange_8361) of DEVCORE Research Team was able to exploit Microsoft Exchange! If confirmed, they win a whooping $200,000 and 20 Master of Pwn points. Off to the disclosure room to explain how they did it and seal the deal. #Pwn2Own #P2OBerlin
adr retweeted
HITCON 2026 — Ticket Sales Are Now Live 🚀
Ready for Taiwan’s largest cybersecurity conference?
HITCON 2026 tickets are officially on sale!
This year, HITCON brings together cutting-edge topics ranging from vulnerability research, offensive and defensive security, to real-world cybersecurity practices. We’re also partnering with COSCUP to launch the brand-new “HITCON OpenSource Track”, exploring even more possibilities at the intersection of open source and cybersecurity ✨
And this year, our ticket system has been upgraded — the earlier you buy, the more you save!
General admission tickets are divided into multiple pricing stages:
Early Bird / Regular / Late Bird / On-site, so don’t wait until the last minute if you want the best deal 🫵
【Event Information】
📍 Date: Aug 21–22, 2026
📍 Venue: Humanities & Social Sciences Building, Academia Sinica (No. 128, Sec. 2, Academia Rd., Nangang Dist., Taipei City)
【Ticket Overview】
📬 Tickets:
HITCON 2026 Ticket Page: hitcon.kktix.cc/events/hitco…
🎟️ Ticket Types
1. General Admission (time-based pricing)
・Early Bird: NTD 5,000
・Regular: NTD 6,000
・Late Bird: NTD 7,000
・ On-site: NTD 8,000
2. Student Ticket (NTD 2,500)
・Valid student ID required for on-site verification
3. Concession Admission for HIT Individual/Group Member
・ Individual: NTD 4,800
・Group: NTD 5,400
Exclusively for Association of Hackers in Taiwan (HIT) members.
🎁 Tickets purchased before Aug. 2 will include an exclusive HITCON 2026 welcome pack
(including a Badge, commemorative T-shirt, and more)
⚠️ Notes
・On-site ticket purchase will not be available; online registration only
・T-shirt sizes are “not guaranteed” for Late Bird and On-site ticket holders
・KKTIX account registration is required before purchasing tickets
The earlier you buy, the better the deal — grab your Early Bird ticket before it’s gone! 🔥
#HITCON2026 #HITCON #COSCUP2026 #HITCONOpenSource #CyberSecurity #InfoSec #OpenSourceSecurity #TicketSales #資安年會 #開源安全 #票券開賣
adr retweeted
The FLARE team now freely distributes its quality reverse engineering and malware analysis educational content at github.com/mandiant/flare-le…. Launched with:
- Malware Analysis Crash Course
- Go Reversing Reference
- Intro to TTD
adr retweeted
The Microsoft Defender Research team has published guidance on detecting, investigating, and defending against the sophisticated CI/CD-focused supply chain compromise involving the widely used open-source vulnerability scanner Trivy: msft.it/6016QQ6wq
adr retweeted
An automated N-day research pipeline at PwnFuzz.
Ghidra + Ollama + n8n →Diffs Patch Tuesday binaries → LLM analyzes the output → Structured vuln reports, monthly AI-generated reports gets you oriented fast!
Blog: ghostbyt3.github.io/blog/nda…
Repo: github.com/ghostbyt3/nday-au…
