Reverse engineer and get full root access on the TP-Link Tapo C200 (2025)
https://quentinkaiser.be/security/2025/07/25/rooting-tapo-c200/
Remote
0xor0ne
@0xor0ne@infosec.exchange
Cyber Security - Reverse Engineering - IoT/Embedded - Exploit - Linux kernel and Cats - PhD - My Toots, My Opinions
0
Followers
0
Following
21
Posts
Joined November 18, 2022
Twitter:
GitHub:
Posts
Cybersecurity blog posts, writeups, papers, and tools
Great 3-parts series on 0-click exploit chain targeting Android Pixel 9
Arbitrary code execution in mediacodec -> kernel privilege escalation
Part 1: https://projectzero.google/2026/01/pixel-0-click-part-1.html
Part 2: https://projectzero.google/2026/01/pixel-0-click-part-2.html
Part 3: https://projectzero.google/2026/01/pixel-0-click-part-3.html
Research by Natalie Silvanovich and Seth Jenkins
Apple SEAR is hiring offensive security researchers!
We’re looking for talented researchers across multiple areas of security.
Check out the job description here:
https://jobs.apple.com/en-us/details/200623813-2911/offensive-security-researcher?team=SFTWR
If you’re interested in low level systems like RTOS, firmware, coprocessors, embedded components, or microkernels, my team would especially like to hear from you.
Feel free to reach out if you have any questions.
"Challenges and Pitfalls while Emulating Six Current Icelandic Household Routers"
Evaluation of different tools for routers firmware emulation
(FACT, QEMU, EMUX, Qiling, Firmadyne, FAT, FirmAE, Pandawan, and EMBA)
"My Emulation Goes to the Moon... Until False Flag" by Retooling
Exploring the re-implementation of APT41 Scatterbrain's obfuscation
https://retooling.io/blog/my-emulation-goes-to-the-moon-until-false-flag
"Compromise of Fuse Encryption Key for Intel Security Fuses"
Beginners introduction to Fault Injection (voltage glitching) attacks (esp32)
https://security.humanativaspa.it/fault-injection-down-the-rabbit-hole/
"CTF" challenge introducing Linux kernel exploitation
Bypass Linux kernel isolation technique using BPF infrastructure
Bypassing UART protection in TL-WR841N home router
https://iotsrg.org/blog/unlocking-full-shell-functionality-uart-rx-mitigation-bypass-on-tl-wr841n
KernelSnitch: Generic software side-channel attack targeting Linux kernel data structures
PUMAKIT malware analysis (dropper, memory-resident executables, LKM rootkit module and a shared object userland rootkit)
Analysis of capabilities and communication channels used by IOCONTROL IoT/OT malware
https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol
Bypass Linux kernel isolation technique by abusing the BPF infrastructure
Collection of write-ups, blog posts and papers related to cybersecurity, reverse engineering and exploitation
https://github.com/0xor0ne/awesome-list/blob/main/topics/cybersec.md
Creating Ghidra data types from header files
Part 1: @clearbluejar@medium.com
Part 2: @clearbluejar@medium.com
Exploiting Linux kernel io_uring subsystem (2022)
Great series on Linux privilege escalations
Great website if you need a quick reference to Linux kernel syscalls (numbers)