Xeno Kovah

Tired of guessing inputs? Let the computer do the work! Learn about symbolic execution from @barbieauglend.bsky.social in "Reverse Engineering 3201" ost2.fyi/RE3201 and use SMT solvers to find the exact inputs to reach vulnerable code. Stop guessing, start solving!

HMU at that email below if you're interested in getting funded to create a class and make it freely available to the world!

But any topic is welcomed and encouraged! HMU at that email below if you're interested in getting funded to create a class and make it freely available to the world!

We're in discussion to form a partnership with the UEFI Forum. But as part of that we need to propose classes that can be taught on the topics they're involved with. Things like UEFI Measured Boot in particular would make a lot of sense now that we have robust TPM classes at OST2.

OST2 is putting out a request for proposals for an opportunity to be funded to create classes on UEFI and/or ACPI. If you are interested, please reach out to teach🌀ost2.fyi with a proposed class syllabus.
ost2.fyi/Training-RFP...

Reverse engineering Realtek RTL8761B* Bluetooth chips, to make better Bluetooth security tools & classes | Dark Mentor LLC We hold this truth to be self-evident&#58; SUFFERING BUILDS STRENGTH! In this talk I will walk you through the trials, tribulations, and triumph(!) of the worst debugging setup I've ever hacked together, which I used to reverse engineer the Realtek RTL8761B* family of Bluetooth chips.<p>This work was done because Bluetooth security tools are in an abominable state. We use "CSR4" (Cambridge Silicon Radio) dongles that don't support packets newer than Bluetooth 4.0 (released in 2010!), just to be able to spoof the Bluetooth Device Address (BDADDR) for MitM attacks.<p>Veronica Kovah & I have been creating Bluetooth security classes for <a href="https://ost2.fyi/">OpenSecurityTraining2</a>. And we wanted to use better hardware; ideally something that supports BT 5.4 (released in 2023). So I bought a bunch of cheap dongles off Amazon, and found that most of them used the same RTL8761B chip. So the goal was clear&#58; at a minimum, figure out a way to spoof the BDADDR on these dongles. But I also a set out a nice-to-have stretch goal - to figure out how to use these dongles to send custom LMP packets (which are architecturally not meant to be under full user control.) That way, could replace a bulky and expensive $55 dev board (that is only used for BT Classic), with a cheap and small $14 USB dongle (which has a better antenna to boot!) This would make Blue2thprinting (released at Hardwear.io 2023), and thus Bluetooth reconnaissance & vulnerability assessment, cheaper & better.<p>Bloodied (but not broken) by the ordeal, I achieved my goals and stretch goals. And given that there are no public descriptions of how Realtek Bluetooth chips work, I look forward to sharing hitherto-unknown information about how to navigate and understand these mostly-16-bit-MIPS-code systems. And I'll discuss how their ROM-"patch"ing firmware update mechanism works, how you can patch it to change its code too, and the security implications thereof.

Video released for "Reverse engineering Realtek RTL8761B* Bluetooth chips, to make better Bluetooth security tools & classes" (from @hardwear-io.bsky.social). Slides & video link here:
darkmentor.com/publication/...

Content neutral / Structure rebel

🤣

From: benjojo.co.uk/u/benjojo/h/...

*How much* it can do with known-bad function call tainted data/ACID sinks, is unknown without seeing the breakdown of the 500 claimed vulnerabilities

Most “My AI finds 0days” stories are mostly misleading. However there are two useful points in red.anthropic.com/2026/zero-da...:
1) Claude is good at variant analysis (which actually makes sense if you think about how LLMs work)
2) Claude can somewhat reason about taint sinks like strcat

Save the date! @blackhoodie.bsky.social is coming to Luxembourg! On May 6th we're partnering with #BSidesLuxembourg for a day of binary fun and joy 🥳🥳🥳

Hello, World! Welcome back! I have new blog :-)

tracesofhumanity.org/hello-world/

#doomscrolling

I cannot emphasize enough how contemptible I find this. The only thing they could have done to lose even more respect from other researchers would have been to add a logo to go along with it. Dear anyone who wants to be an actual researcher, don’t ever do this!

The researchers behind whisperpair.eu are deserving of our disrespect. They put out a website announcing their research, <<<and solicited a bunch of media attention, but didn’t publish their paper to go along with it>>>. This is clownish behavior for researchers🤡

#DistrictCon continues to live up to the example set by ShmooCon, right down to the coming snowpocalypse! (the day I’m supposed to present…)

Final call for beta testers! The class will begin later today!

Our Trusted Computing "Advanced TPM usage" class will begin this week. Sign up below.

Sponsors help cover the costs of keeping #OST2 free for everyone and helping us grow. Thanks to AMI for joining the cause!

We are happy to announce that AMI has become a 🥇Gold-level sponsor of #OST2!

Learn about their work creating firmware across the industry here: ost2.fyi/Sponsor_AMI_SM

The TPM class series reaches its epic conclusion! Advanced TPM usage! Don't let TPMs just be some magic black box to you, where you let others tell you what they are. Learn for yourself what they are (and aren't) capable of!

We still have seats open for @blackhoodie.bsky.social at @districtcon.bsky.social on January 23rd in Washington DC! The class will be reverse engineering their way through an integer overflow bug in libpng 🤓
blackhoodie.re/DistrictCon2...

TC1103: Advanced TPM Usage Beta Testing Pre-Class Survey TC1103 will take approximately 7 hours to complete, and will begin January 16th, and end February 13th. TC1103 is the follow up to TC1101 Intro TPM usage (https://ost2.fyi/TC1101) & TC1102 Intermedia...

📢Call for beta testers!📢
forms.gle/9QgwVSstXi7n...

The beta for Trusted Computing 1103: Advanced TPM Usage will start Jan 16th. It will take ~7 hours to complete. Sign up above if you're interested in participating. (Note: ost2.fyi/TC1101 & ost2.fyi/TC1102 are strongly recommended prerequisites.)

🧵Like TC1101 & TC1102, TC1103 has the goal of helping developers get bootstrapped on using TPMs more quickly than if they were to just rely on reading the spec or API documents alone.

Reverse engineering Realtek RTL8761B* Bluetooth chips, to make better Bluetooth security tools & classes | Dark Mentor LLC We hold this truth to be self-evident&#58; SUFFERING BUILDS STRENGTH! In this talk I will walk you through the trials, tribulations, and triumph(!) of the worst debugging setup I've ever hacked together, which I used to reverse engineer the Realtek RTL8761B* family of Bluetooth chips.<p>This work was done because Bluetooth security tools are in an abominable state. We use "CSR4" (Cambridge Silicon Radio) dongles that don't support packets newer than Bluetooth 4.0 (released in 2010!), just to be able to spoof the Bluetooth Device Address (BDADDR) for MitM attacks.<p>Veronica Kovah & I have been creating Bluetooth security classes for <a href="https://ost2.fyi/">OpenSecurityTraining2</a>. And we wanted to use better hardware; ideally something that supports BT 5.4 (released in 2023). So I bought a bunch of cheap dongles off Amazon, and found that most of them used the same RTL8761B chip. So the goal was clear&#58; at a minimum, figure out a way to spoof the BDADDR on these dongles. But I also a set out a nice-to-have stretch goal - to figure out how to use these dongles to send custom LMP packets (which are architecturally not meant to be under full user control.) That way, could replace a bulky and expensive $55 dev board (that is only used for BT Classic), with a cheap and small $14 USB dongle (which has a better antenna to boot!) This would make Blue2thprinting (released at Hardwear.io 2023), and thus Bluetooth reconnaissance & vulnerability assessment, cheaper & better.<p>Bloodied (but not broken) by the ordeal, I achieved my goals and stretch goals. And given that there are no public descriptions of how Realtek Bluetooth chips work, I look forward to sharing hitherto-unknown information about how to navigate and understand these mostly-16-bit-MIPS-code systems. And I'll discuss how their ROM-"patch"ing firmware update mechanism works, how you can patch it to change its code too, and the security implications thereof.

If you won’t be joining us, you can find the slides here: darkmentor.com/publication/...

If you managed to snag a ticket to @districtcon.bsky.social, I hope to see you at my talk on reverse engineering the Realtek RTL8761B* series of Bluetooth chips (where I will once again be trying to irresponsibly speed-run way too many slides)

In 2026 we will be fundraising to add a gamification plugin to our Open edX servers. This will add a leaderboard for learners, and provide a new way to track your sub-class-granularity skills that you're picking up on the site. To help early, donate here: www.every.org/ost2/f/lets-...

We're always looking for more sponsors for #OST2! If your company wants to support creating better security engineers everywhere in the world, get in touch!

A sincere thank you to everyone who donated to #OST2 as an individual in 2025(especially those who used corporate non-profit donation matching)! Your donations go directly to instructors as an honorarium, and show them that you value what they do for OST2 and you want them to keep helping the world!

We also want to give another shout-out to our Partner, Trusted Computing Group for helping to fund classes about how to build secure systems.

and Bronze Sponsor Cyber5W @cyber5w.bsky.social, all of whom help keep the servers running, and contribute towards instructor honorariums.