mastodon 4.8.0-alpha.3+glitchSecurity Engineer at Trail of Bits. Pwndbg contributor, justCatTheFish CTF team captain
TIL if you run uv run script.py and interpreter segfaults the uv will swallow the SIGSEGV and you won't get the nice Linux's "Segmentation fault (core dumped)" msg. It returns an exitcode of 139 which you need to find through echo $? :(
https://github.com/astral-sh/uv/issues/11886#issuecomment-5682464773
Pwndbg 2026.02.18 is out! Enhance your GDB or LLDB experience!
We visualize branches in nearpc, synchronize your decompiler (IDA/Binja/Ghidra) via decomp2dbg, annotate stack variabless from debug info or decompiler, support new Linux kernel debugging commands - for tracing SLUB allocs/frees or dumping tasks information.
See what's changed in: https://github.com/pwndbg/pwndbg/releases/tag/2026.02.18
Want Pwndbg to keep moving fast, or, having us give a talk about it? Sponsor us: https://github.com/sponsors/pwndbg/
A call to memcpy() in a single binary that uses glibc may behave in 12 different ways depending on the features of the specific x86-64 CPU you run it on.
Here is a list of those impls in glibc:
Fwiw this may matter a lot during binary exploitation. This was important in a challenge from PlaidCTF 2025. E.g. passing a negative (or: very huge) length allowed you to write past a buffer without a crash (the given implementation was not doing a wild copy).
Fwiw there is an update about Anthropic's Project Glasswing: https://anthropic.com/research/glasswing-initial-update
The coordinated vulnerability disclosure program can now be seen here: https://red.anthropic.com/2026/cvd/ledger/
Example finding: https://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E
:)
We released new Pwndbg: https://github.com/pwndbg/pwndbg/releases/tag/2025.05.30 !
Among others it brings:
- New & improved kernel debugging commands (buddydump, msr, slab) and more x64 regs in context
- New command for dealing with armcm exceptions: dump-register-frame
- Disasm now shows an ✘ marker for emulated branches we know won't be taken
- Improved disasm for ARM, MIPS and LoongArch64 architectures
- Initial support for the IBM s390x architecture
- IDA sync integration fixes
And also cool portable one-liner installers:
$ curl -qsL 'https://install.pwndbg.re' | sh -s -- -t pwndbg-gdb
$ curl -qsL 'https://install.pwndbg.re' | sh -s -- -t pwndbg-lldb
Want to support us? Sponsor us at https://github.com/sponsors/pwndbg !
Released new Pwndbg: 2025.04.18
It adds display of breakpoints in the disasm view, new libcinfo command, improves attachp & hexdump commands, UI, TUI and more. Also, command names use "-" istead of "_" now for consistency.
Read more and download it on https://github.com/pwndbg/pwndbg/releases/tag/2025.04.18 !
We scored 1st place in the DiceCTF 2025 Quals cybersecurity competition with my team justCatTheFish 😼🐟 this weekend. We qualified for and will go to the finals in New York 🙂
Full scoreboard & challenges: https://ctf.dicega.ng/scores
I have written a blog post about null pointers on Linux:
https://disconnect3d.pl/2025/03/03/when-null-isnt-null-on-linux/
Released Pwndbg 2025.02.19 with new commands for dumping Linux kernel nftables, initial LoongArch64 support and more!
See changelog on https://github.com/pwndbg/pwndbg/releases/tag/2025.02.19 !
#pwndbg #gdb #pwning #reverseengineering #binaryexploitation #kernel #debugging
I will be giving a talk on Pwndbg open source development in ~1h on a local Python meeetup!
It will be livestreamed on: https://www.youtube.com/live/euK_S81Qnuo?si=EhZ-WhnP-4yZRElE
Why does most/many security conferences do not have lightning talks for which you would sign up during the conference? Do they think people do not have 5min stories to tell or just aren't aware of such a thing?
E.g., EuroPython has 1h lightning talk sessions every day and a lightning talk doesn't even have to be technical, even though they usually are.
Also Security PWNing conference, AlligatorCon and WarCon had it, why not others? ;)
Example lightning talk:
https://www.youtube.com/watch?v=tRtxCCRdZOs&t=35227s
1. Win $250 credits on DigitalOcean from SEKAI CTF 2022
2. Apply it on DO to host your own ctf
3. Find out credits are valid only for 3mo after 2mo of applying
4. Ask DO support for extending
5. They can't
6. No profit
Would be great if DigitalOcean refined their sponsorship prize rules...
mkdir 'a\nb' && cd a\\nb && claude
🥶
I hope to be proven wrong, but it feels like whenever a new contributor writes something like this in a PR, they never come back to iterate on their broken code...
