Publications

TALK — Journey to freedom: Escaping from VirtualBox and Unchaining Objects in the Windows Kernel — Corentin BAYET

Talk given at TyphoonCon 2025 on the vulnerability research conducted on VirtualBox and Windows for Pwn2Own Vancouver 2024.

EVENT — VMware ESXi VM escape at Pwn2Own Berlin 2025 — REverse Tactics team

Our participation at Pwn2Own Berlin 2025 where we demonstrated a VM escape on VMware ESXi.

TALK — Journey To Freedom: escaping from virtualbox — Corentin BAYET

Talk given at OffensiveCon 2025 on the vulnerability research conducted on VirtualBox for Pwn2Own Vancouver 2024.

TALK — Attacking hypervisors - A practical case — Corentin BAYET

Talk given at GreHack 2024 on the vulnerability research conducted on VirtualBox for Pwn2Own Vancouver 2024.

EVENT — Win at Pwn2Own Ireland 2024 — REverse Tactics team

Our participation at Pwn2Own Ireland 2024.

TALK — Hacking NAS at Pwn2Own — Corentin BAYET

A short talk about hacking Western Digital NAS for Pwn2Own Austin 2021.

EVENT — Win at Pwn2Own Vancouver 2024 — REverse Tactics team

Our participation at Pwn2Own Vancouver 2024.

TALK — Virtualization from an attacker point-of-view — Corentin BAYET

An introduction to attacking hypervisors from the guest.

EVENT — Win at Pwn2Own Vancouver 2022 — REverse Tactics team

Our participation at Pwn2Own Vancouver 2022.

TALK — SpeedPwning VMware Workstation — Corentin BAYET and Bruno PUJOS

Attacking VMware Workstation in a few weeks for Pwn2Own Vancouver 2020.

BLOG — A Journey in reversing UEFI Lenovo Passwords management — Bruno PUJOS

Reverse engineering of the passwords handling of a computer's firmware.

TALK — Scoop the Windows 10 Pool! — Corentin BAYET

An update on how to exploit pool overflows on latest Windows 10.

BLOG — Through the smm-glass and a vulnerability found there — Bruno PUJOS

Discovery and exploitation of a vulnerability in Lenovo Thinkpad's firmware.

BLOG — Code Check(Mate) in SMM — Bruno PUJOS

Bypassing SMM_CODE_CHK_EN protection.

TALK — Windows 10 Pool Party — Corentin BAYET

A talk on how to exploit pool overflows on Windows 10.

EXPLOIT — CVE-2017-6008 — Corentin BAYET

Exploit code for CVE-2017-6008.

BLOG — SMM unchecked pointer vulnerability — Bruno PUJOS

Exploitation of an SMM unchecked pointer vulnerability present in a SWSMI handler.

TALK — Short Talk: Introduction to Reversing DXE drivers — Bruno PUJOS

How to reverse DXE drivers, cover the basics of UEFI firmware and DXE.

TALK — Short Talk: Bitcoin on FPGA — Bruno PUJOS

Implementing a simple SHA256 calculator for bitcoin on a FPGA.

TALK — Short Talk: CVE-2014-4114 — Bruno PUJOS

Short talk giving a technical overview of the CVE-2014-4114 (Sandworm).

BLOG — Getting back determinism in the Low Fragmentation Heap — Bruno PUJOS

Overview of the Low Fragmentation Heap allocator in Windows.

TALK — Short Talk: Go Reverse — Bruno PUJOS

Short talk about reversing a golang binary.

TALK — An overview of the LFH — Bruno PUJOS

Overview of the Low Fragmentation Heap allocator in Windows.

TALK — Short Talk: Heartbleed, Technical Overview — Bruno PUJOS

Short talk about the Heartbleed vulnerability (CVE-2014-0160).

TALK — A Look into the Windows Kernel — Bruno PUJOS

Presentation of the evolution of the security inside the Windows kernel.