Specter @SpecterDev

Interested in Security and Exploit Development. Nano is the one true text editor. dayzerosec.com 🇨🇦 Ontario Joined August 2015

Tweets

1K
Followers

38K
Following

274
Likes

2K

Specter @SpecterDev

2 months ago

Some people already know this, but thought I'd mention here too... unfortunately basically all of my low fw PS5s got stolen recently, so I'm not sure what my future in console research will look like. Replacing this stuff might be too be difficult & expensive to be worth it :(

42 26 320 41K 13

DAY[0] @dayzerosec

5 months ago

We have a special episode this week, where we interview @JohnCarse of @getsquarex. We talk about John's industry experience, history of browser security, and the work SquareX is doing on detecting and mitigating browser-based attacks. Check it out: youtube.com/watch?v=GtFpxB…

0 1 30 12K 0

Specter @SpecterDev

8 months ago

My @dayzerosec co-host zi and I are giving our 1st training @ hardwear.io with a focus on attacking security hypervisors! Trainings are something we've wanted to do for a while. Take a look and share to those who would be interested :) hardwear.io/usa-2025/train…

6 35 211 43K 13

hardwear.io @hardwear_io

7 months ago

We have a training by @SpecterDev & Zi on Attacking Hypervisors From KVM to Mobile Security Platforms hardwear.io/usa-2025/train…

Specter @SpecterDev

7 months ago

We have a training by @SpecterDev & Zi on Attacking Hypervisors From KVM to Mobile Security Platforms hardwear.io/usa-2025/train…

3 113 503 48K 157

0 8 42 15K 8

Specter @SpecterDev

7 months ago

I've published a write-up on reversing and analyzing Samsung's H-Arx hypervisor architecture for Exynos devices, which has had a lot of changes in recent years and pretty interesting design. Hope you all enjoy :) dayzerosec.com/blog/2025/03/0…

3 113 503 48K 157

REcon @reconmtl

7 months ago

Recon Training 23-26 June 2025: KVM to Mobile Security Platforms - Attacking Hypervisors with @SpecterDev and zi from @dayzerosec (4 days) For more details recon.cx/2025/trainingF…

0 8 36 8K 4

Download Video

Matteo Rizzo @_MatteoRizzo

8 months ago

github.com/google/securit… Our newest research project is finally public! We can load malicious microcode on Zen1-Zen4 CPUs!

13 283 818 117K 267

Specter @SpecterDev

11 months ago

RE: byepervisor do people care enough about not wanting to use rest mode and resume to switch the primary exploit for byepervisor to the jump table one? its higher maintenance and possibly slightly less stable but would be slightly more convenient to run I guess

21 12 107 21K 5

Help Net Security @helpnetsecurity

11 months ago

Inside console security: How innovations shape future hardware protection - helpnetsecurity.com/2024/10/29/gam… - @PlayStation @hardwear_io #HardwareSecurity #hw_ioNL2024 #PlayStation #gaming #CyberSecurity #netsec #security #InfoSecurity #ITsecurity #CyberSecurityNews #securityNews

0 9 32 21K 7

Download Image

Specter @SpecterDev

11 months ago

Slides github.com/PS5Dev/Byeperv…

Specter @SpecterDev

11 months ago

Slides github.com/PS5Dev/Byeperv…

42 125 661 97K 54

9 51 292 39K 28

Specter @SpecterDev

11 months ago

I've published the repo for Byepervisor (we love named vulns out here). Contains exploit implementation for two PS5 hypervisor bugs for 2.xx and lower. Slides from the talk + vod should hopefully be published soon. github.com/PS5Dev/Byeperv…

42 125 661 97K 54

hardwear.io @hardwear_io

12 months ago

The PS5's hypervisor has kept the system secure for years—now, vulnerabilities are being revealed. What does this mean for gamers? 🕵️‍♂️🚨 Join @SpecterDev at #hw_ioNL2024 Know More: hardwear.io/netherlands-20… #ps5 #exploit #hardware

8 36 233 33K 22

Download Image

Aleksei Kulaev @flat_z

12 months ago

There are a few ways on PS5 to defeat HV. One of methods that I've found was related to APIC: struct apic_ops is located in RW segment of kernel data. With KRW you can overwrite a function pointer inside it like xapic_mode and get into ROP, for example (just need to bypass CFI).

31 64 599 69K 41

Specter @SpecterDev

a year ago

Feels great when an idea can finally be tested and works out after like a year :) Shouts to ChendoChap for working out the ROP chain. Protip: staying < 3.00 is a good idea.

53 95 785 124K 40

Download Image

Specter @SpecterDev

a year ago

Pushed v1.2, exploit's been updated with an implementation that works on 3.xx-5.xx (heap spray go brrr), also some support for other misc low fw. ELF loader and payloads will not work on 5.00+ for a while due to dlsym changes. Payload SDK needs changes. github.com/PS5Dev/PS5-UMT…

64 80 536 66K 23

Specter @SpecterDev

a year ago

Added 1.xx firmware support to UMTX exploit chain. github.com/PS5Dev/PS5-UMT…

28 43 405 43K 7

Specter @SpecterDev

a year ago

I've published a webkit implementation of UMTX exploit for PS5 on 2.xx firmwares. Hoping to add support for 1.xx firmwares soon, higher firmwares will take some changes to make it work. See README for details as always. github.com/PS5Dev/PS5-UMT…