2026-10-28T06:58:26Z https://njump.me clearbluejar https://njump.me/npub1fpc8rw6saqly2yxv04uu49ef7jc0rf2vg6uezjsn8wuta0dngxqqtyjx2d https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/396/299/069/714/193/original/6bad708e0975ef5d.jpeg https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/396/299/069/714/193/original/6bad708e0975ef5d.jpeg https://njump.me/nevent1qqstcy4947rhhglr5dse4sv4w8nnvzpww9efe9cmzrzt20vdfpt7tdgzypy8qudm2r5ru3gse37hnj5h986tpud9f3rtny22zvam304akdqcqygcmjn Patch diffing + RCA for clfs.sys can take awhile.<br/><br/>I gave the diff + binary to a local LLM.<br/><br/>It mapped the UAF path, race condition, all IOCTLs in &lt;20 min<br/><br/>LLMs don&#39;t replace the work, they are momentum.<br/><br/>New blog post following the UAF trail of CVE-2025-29824:<br/><br/><a href="https://clearbluejar.github.io/posts/how-llms-feed-your-re-habit-following-the-uaf-trail-in-clfs/">https://clearbluejar.github.io/posts/how-llms-feed-your-re-habit-following-the-uaf-trail-in-clfs/</a> 2026-02-03T18:29:50Z https://njump.me/nevent1qqsymkdhdv3mugxaqj5yd4r0ffg9vycvceq4nqpn78n9vs4avkuq7eszypy8qudm2r5ru3gse37hnj5h986tpud9f3rtny22zvam304akdqcq3j7dye New #ghidriff release! v0.9.0 <br/><br/>- Set custom analysis options<br/>- Set custom base address (bootloaders, etc)<br/><br/><a href="https://github.com/clearbluejar/ghidriff/releases/tag/v0.9.0">https://github.com/clearbluejar/ghidriff/releases/tag/v0.9.0</a><br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/416/591/454/725/377/original/1f2ff83cae6cf039.png"> <br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/416/592/184/940/109/original/301d216b2a136d32.png"> <br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/416/592/791/665/783/original/38759e5b9ce4ffcb.png"> <br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/416/593/121/793/386/original/2f6ede08880c5957.png"> <br/> 2025-04-28T16:44:48Z https://njump.me/nevent1qqstsec3kk3vqlw3lcalnc2zfkhya8r4hc3pxhaevfvymam4rqz63qszypy8qudm2r5ru3gse37hnj5h986tpud9f3rtny22zvam304akdqcqcfhhsm &#34;Running #Ghidra on the same platform as the binaries you’re analyzing isn’t just convenient — it’s strategic.&#34;<br/><a href="https://medium.com/@clearbluejar/everyday-ghidra-how-platform-choice-influences-ghidras-binary-analysis-76c40db0e407">https://medium.com/@clearbluejar/everyday-ghidra-how-platform-choice-influences-ghidras-binary-analysis-76c40db0e407</a> 2025-02-28T17:35:02Z https://njump.me/nevent1qqsqqdj2f8hrjtd0krz89zu72cvq9gd539vesrcd2g4wfw90gljdsngzypy8qudm2r5ru3gse37hnj5h986tpud9f3rtny22zvam304akdqcq5yfkps Just released #ghidriff v0.8.0 - Ghidra 11.3 Support + PyGhidra 🔥👀<br/><br/>This release uses the latest PyGhidra now officially supported by Ghidra 🤓💪<br/><br/><a href="https://github.com/clearbluejar/ghidriff/releases/tag/v0.8.0">https://github.com/clearbluejar/ghidriff/releases/tag/v0.8.0</a><br/><br/>🔋 included!<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/989/941/941/222/060/original/4fd04854a840a574.png"> <br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/989/942/870/688/714/original/1f283383aa3b5e20.png"> <br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/989/943/661/187/556/original/9aefbb3c446f5a0a.png"> <br/> 2025-02-12T08:21:49Z https://njump.me/nevent1qqstzqzdh3y52vfwkrxpv90au2f4l7lkqalndypgxadrnax0zcexjrszypy8qudm2r5ru3gse37hnj5h986tpud9f3rtny22zvam304akdqcqehwy4v CVE-2024-43625 - 2024-Nov - Microsoft Windows VMSwitch Elevation of Privilege - Use After Free - CVSS 8.1<br/><br/>#ghidriff vmwsitch diff <br/><a href="https://gist.github.com/clearbluejar/b5c12615270a54d031dc13a7d07988c9">https://gist.github.com/clearbluejar/b5c12615270a54d031dc13a7d07988c9</a><br/>👀🔥<br/><br/>Side-by-side view: <a href="https://diffpreview.github.io/?b5c12615270a54d031dc13a7d07988c9">https://diffpreview.github.io/?b5c12615270a54d031dc13a7d07988c9</a> 🧐<br/><br/>A patch diffing 🧵...<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/960/783/699/100/935/original/1bede97725457113.png"> <br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/960/784/011/626/767/original/e90136ccf4894f26.png"> <br/> 2025-02-07T04:47:29Z https://njump.me/nevent1qqsx0xlyt8kwgjtyytjzu0hs0ljrhlcs5pe23e2kpv6aj0s0gkv42egzypy8qudm2r5ru3gse37hnj5h986tpud9f3rtny22zvam304akdqcqjdzq3l CVE-2025-21325 - 2025-Jan - ARM64 - Windows Secure Kernel Mode Elevation of Privilege<br/><br/>#ghidriff full diff 👀 <a href="https://gist.github.com/clearbluejar/318abe5d072eef55b9ea7c23a591726e">https://gist.github.com/clearbluejar/318abe5d072eef55b9ea7c23a591726e</a><br/><br/>Incorrect permission assignment? 🧐 <a href="https://gist.github.com/clearbluejar/318abe5d072eef55b9ea7c23a591726e#skmicommitpte-diff">https://gist.github.com/clearbluejar/318abe5d072eef55b9ea7c23a591726e#skmicommitpte-diff</a><br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/915/704/885/222/974/original/a5566b8d0f55c896.png"> <br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/915/705/482/809/305/original/2e0736e45581223d.png"> <br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/915/706/176/672/513/original/fb35af0819fe207c.png"> <br/> 2025-01-30T05:42:20Z https://njump.me/nevent1qqswk5pyapwz547d4uuqc5pd8mkxx8qyzzxth9785y9jk4yge3lauzgzypy8qudm2r5ru3gse37hnj5h986tpud9f3rtny22zvam304akdqcqjfvgls Exciting! My talk recording just dropped from #OBTS v7! 🗣️✨ Learn how to patch diff on Apple with #Ghidra, #ghidriff, and #ipsw: &#34;Patch Different on *OS&#34;: <a href="https://www.youtube.com/watch?v=Ellb76t7nrc">https://www.youtube.com/watch?v=Ellb76t7nrc</a> 2024-12-21T14:55:56Z https://njump.me/nevent1qqsy70927uqwr4erlk2z7x42ttv8gx6ldvtae6l8hktynz5z5vrnrxszypy8qudm2r5ru3gse37hnj5h986tpud9f3rtny22zvam304akdqcqejq02k In an ideal world for reverse engineering, every function would have a name, and every variable would be correctly typed. Take a step towards that world, learn to build your own custom Ghidra Data Types in my latest post: <a href="https://medium.com/@clearbluejar/everyday-ghidra-ghidra-data-types-creating-custom-gdts-from-windows-headers-part-2-39b8121e1d82">https://medium.com/@clearbluejar/everyday-ghidra-ghidra-data-types-creating-custom-gdts-from-windows-headers-part-2-39b8121e1d82</a> 2024-11-22T16:39:57Z