Loading video...

Video Failed to Load

There was a problem loading this video. This could be due to a temporary network issue or the video might be unavailable.

New video on format string vulnerabilities. It's the classic printf(user) bug. An attacker can read and write almost any memory in the process, from a single print statement. I walk through all of it in a live GDB session. Leaking the stack with %p, turning %n into an arbitrary... show more

tetsuo

240,195 subscribers

12,610 views • 7 days ago •via X (Twitter)

Anya Rossi• Live Now

Private livecam show

8 Comments

acidburn7 days ago

java devs discovering printf can spawn a shell

tetsuo7 days ago

I'll cover Apache Log4j next. 😂

Pitchfork & Torch ♞7 days ago

Hello world?

BullBear.News7 days ago

Using percent n for arbitrary write is a clean demonstration of classic memory corruption risks.

Path of Totality7 days ago

Quite educational thanks

Robi7 days ago

Idź mi stąd w pizdu -90 ty kurwa pajacu .

Ricci Research7 days ago

Beautiful illustration of the real lesson: the bug isn't a missing bounds check, it's an API where the safe call and the catastrophic one differ by four characters. Compilers have warned about this for twenty years and it still ships, which says more about how warnings get triaged than about the developers.

why7 days ago

The single-print-statement angle really shows why printf(user) is far more dangerous than a simple crash.

Related Videos

BROP is such a clean ASLR bypass. After brute-forcing the stack canary, the attacker starts overwriting the return address with guesses. Most guessed addresses jump into garbage or non-executable memory. The child process segfaults, and the socket closes. But occasionally, a guessed return address lands in real code that does something like sleep, pause, or an infinite loop. The process hangs, so the socket stays open. That address becomes a stop gadget. A known "safe landing pad" in the ROP chain. It gives the attacker a reusable signal. From there, they probe for stack-pop gadgets. probe_addr > trap_addr > stop_addr If probe_addr is not a pop reg; ret, execution returns into the trap address and crashes. If probe_addr is a pop reg; ret, it consumes the trap value from the stack and returns into the stop gadget instead. The socket stays open. So the attacker can remotely classify gadgets without seeing the binary. On x86-64, syscall/function args are in registers, not on the stack. So it’s not enough to know "this gadget pops one value." You need to know which register it controls. BROP uses signal syscalls like pause to map the gadgets. find pop rax; ret find pop rdi; ret find pop rsi; ret find pop rdx; ret find syscall Once those gadgets are identified, the attacker can directly assemble a write(2) syscall: rax = SYS_write rdi = socket fd rsi = pointer into .text rdx = length then return into syscall to execute it Once write(2) is reachable, BROP turns the live process into its own ASLR leak, and the server sends its text segment back over the socket. From that dump, the attacker recovers gadgets and offsets offline, then builds the final ROP chain for the same randomized layout the forked server keeps reusing. MIT 6.858.

BROP is such a clean ASLR bypass. After brute-forcing the stack canary, the attacker starts overwriting the return address with guesses. Most guessed addresses jump into garbage or non-executable memory. The child process segfaults, and the socket closes. But occasionally, a guessed return address lands in real code that does something like sleep, pause, or an infinite loop. The process hangs, so the socket stays open. That address becomes a stop gadget. A known "safe landing pad" in the ROP chain. It gives the attacker a reusable signal. From there, they probe for stack-pop gadgets. probe_addr > trap_addr > stop_addr If probe_addr is not a pop reg; ret, execution returns into the trap address and crashes. If probe_addr is a pop reg; ret, it consumes the trap value from the stack and returns into the stop gadget instead. The socket stays open. So the attacker can remotely classify gadgets without seeing the binary. On x86-64, syscall/function args are in registers, not on the stack. So it’s not enough to know "this gadget pops one value." You need to know which register it controls. BROP uses signal syscalls like pause to map the gadgets. find pop rax; ret find pop rdi; ret find pop rsi; ret find pop rdx; ret find syscall Once those gadgets are identified, the attacker can directly assemble a write(2) syscall: rax = SYS_write rdi = socket fd rsi = pointer into .text rdx = length then return into syscall to execute it Once write(2) is reachable, BROP turns the live process into its own ASLR leak, and the server sends its text segment back over the socket. From that dump, the attacker recovers gadgets and offsets offline, then builds the final ROP chain for the same randomized layout the forked server keeps reusing. MIT 6.858.

tetsuo

25,142 views • 3 months ago

MIT GAVE DEBUGGING ITS OWN FULL LECTURE -- BECAUSE MOST DEVS STILL HUNT BUGS WITH PRINT STATEMENTS LIKE IT'S 1995 54 minutes that take the thing you do every single day, badly, and show you the tools schools never bothered to teach. -> The moment it lands, you realize "add a print, run it, add another print" was never debugging. It was guessing with extra steps. Most people never learned the real toolkit. A proper debugger, breakpoints, tracing what the program actually does instead of what you assume it does. In 2026 guessing isn't good enough -> the bug is buried in code you didn't even write, and printf won't find it for you. An AI agent will generate hundreds of lines in seconds. When one of them quietly breaks, finding it runs on exactly the skills in this lecture. Anyone can add a print statement. The person who can actually trace a bug to its source is the one who ships while everyone else guesses. Bookmark & Watch it ↓

MIT GAVE DEBUGGING ITS OWN FULL LECTURE -- BECAUSE MOST DEVS STILL HUNT BUGS WITH PRINT STATEMENTS LIKE IT'S 1995 54 minutes that take the thing you do every single day, badly, and show you the tools schools never bothered to teach. -> The moment it lands, you realize "add a print, run it, add another print" was never debugging. It was guessing with extra steps. Most people never learned the real toolkit. A proper debugger, breakpoints, tracing what the program actually does instead of what you assume it does. In 2026 guessing isn't good enough -> the bug is buried in code you didn't even write, and printf won't find it for you. An AI agent will generate hundreds of lines in seconds. When one of them quietly breaks, finding it runs on exactly the skills in this lecture. Anyone can add a print statement. The person who can actually trace a bug to its source is the one who ships while everyone else guesses. Bookmark & Watch it ↓

slash1s

10,864 views • 3 months ago

After the death of an unknown family member, a woman inherits a burial ground and finds herself in the center of a string of murders and dark secrets. The Bequeathed -- an all new mystery series -- is now streaming.

After the death of an unknown family member, a woman inherits a burial ground and finds herself in the center of a string of murders and dark secrets. The Bequeathed -- an all new mystery series -- is now streaming.

Netflix

303,859 views • 2 years ago

RedNova: From Arbitrary File Write to Command Execution Using COM in Windows Months ago, I wrote a post ( about the unique method used in the RedSun exploit to turn a file write into command execution by using a COM object that can be triggered by a low-privileged user and runs as SYSTEM. In that post, I mentioned that there are other COM objects that can be used in the same way. I presented one object called CoFilterPipeline and noted that it needs some tricks before it can be weaponized. Now I've written a full blog post on how you can find such objects and how you can weaponize them in exploits like RedSun. The video below shows another COM object with the same behavior (windows 11). It's called PerceptionSimulationCoClass. A low-privileged user can activate it, and it runs as SYSTEM. The video doesn't contain any exploit (it just replaces the COM server as administrator). The goal is only to demonstrate how a file write can be turned into command execution as SYSTEM while being triggered by a low-privileged user.

RedNova: From Arbitrary File Write to Command Execution Using COM in Windows Months ago, I wrote a post ( about the unique method used in the RedSun exploit to turn a file write into command execution by using a COM object that can be triggered by a low-privileged user and runs as SYSTEM. In that post, I mentioned that there are other COM objects that can be used in the same way. I presented one object called CoFilterPipeline and noted that it needs some tricks before it can be weaponized. Now I've written a full blog post on how you can find such objects and how you can weaponize them in exploits like RedSun. The video below shows another COM object with the same behavior (windows 11). It's called PerceptionSimulationCoClass. A low-privileged user can activate it, and it runs as SYSTEM. The video doesn't contain any exploit (it just replaces the COM server as administrator). The goal is only to demonstrate how a file write can be turned into command execution as SYSTEM while being triggered by a low-privileged user.

Haidar

13,588 views • 25 days ago

What actually happens when a program calls write(). A program can't put bytes on the screen by itself. Only the kernel can drive hardware, and the only way in is a system call. On x86-64, that is one instruction, syscall, this video follows a single write, from the program's registers into the kernel, down to the serial port, and back. The request goes into rax, rdi, rsi and rdx. The syscall instruction saves the return address in rcx and the flags in r11, loads the kernel's entry point from LSTAR, and drops the processor to ring 0. entry_SYSCALL_64 runs swapgs, switches to the kernel stack, and hands the saved registers to do_syscall_64. The write handler goes down through the tty layer to the UART driver, one out instruction per byte. sysret brings the program back with the byte count in rax. Tools Used gdb, strace, ltrace, trace-cmd function_graph, KernelShark, and the same kernel booted under QEMU so gdb can step the entry code. Chapters 0:00 the request, in registers 2:27 what syscall does in the instant it runs 7:00 from sys_write to the wire 10:21 libc's write is the same instruction 11:38 43 crossings, the vDSO

What actually happens when a program calls write(). A program can't put bytes on the screen by itself. Only the kernel can drive hardware, and the only way in is a system call. On x86-64, that is one instruction, syscall, this video follows a single write, from the program's registers into the kernel, down to the serial port, and back. The request goes into rax, rdi, rsi and rdx. The syscall instruction saves the return address in rcx and the flags in r11, loads the kernel's entry point from LSTAR, and drops the processor to ring 0. entry_SYSCALL_64 runs swapgs, switches to the kernel stack, and hands the saved registers to do_syscall_64. The write handler goes down through the tty layer to the UART driver, one out instruction per byte. sysret brings the program back with the byte count in rax. Tools Used gdb, strace, ltrace, trace-cmd function_graph, KernelShark, and the same kernel booted under QEMU so gdb can step the entry code. Chapters 0:00 the request, in registers 2:27 what syscall does in the instant it runs 7:00 from sys_write to the wire 10:21 libc's write is the same instruction 11:38 43 crossings, the vDSO

tetsuo

19,187 views • 5 days ago

And here's today's AI news from X as a video. In an hour I had my AI agents read all of tech on X, find all the important news, papers, and much more. Write a report. Bring that report over to @NotebookLM. Then create all this and post it back to you. It's all X.

And here's today's AI news from X as a video. In an hour I had my AI agents read all of tech on X, find all the important news, papers, and much more. Write a report. Bring that report over to @NotebookLM. Then create all this and post it back to you. It's all X.

Robert Scoble

36,408 views • 6 months ago

Don't be deceived by the "x got tazkiyyah from shaykh..." gang If you can actually read alot of the time its nothing to do with studying in their classes or graduating from knowledge, just a general statement Anyone can sit and act for scholars then ask them to write on paper

Don't be deceived by the "x got tazkiyyah from shaykh..." gang If you can actually read alot of the time its nothing to do with studying in their classes or graduating from knowledge, just a general statement Anyone can sit and act for scholars then ask them to write on paper

Hussain al-Naijiri

30,398 views • 8 months ago

Miss Timesplitters? Did you know it's back with a new entry? 100% FREE? Timesplitters Rewind is free to play, it a total remake of the original series in Cry Engine 3, thanks to decades of progress from the community! Its an all-star collection of content in the series featuring a playable single player campaign, co-op, multiplayer, and so much more! Try it out in the comments!

Miss Timesplitters? Did you know it's back with a new entry? 100% FREE? Timesplitters Rewind is free to play, it a total remake of the original series in Cry Engine 3, thanks to decades of progress from the community! Its an all-star collection of content in the series featuring a playable single player campaign, co-op, multiplayer, and so much more! Try it out in the comments!

TiredAndOnFire-HD Remasters/Gamedev

228,843 views • 5 months ago

ANTHROPIC KILLED THE VECTOR DATABASE AND REPLACED IT WITH A FOLDER no embeddings. no black-box retrieval. no special memory tools. the agent just reads and writes a folder the insight: your agent already knows how to use a filesystem. so Anthropic made long-term memory a directory of small markdown files, mounted straight into the agent's sandbox at /mnt/memory the agent manages it with the tools it already has, bash, read, write, edit, grep, and Anthropic auto-injects a note into the system prompt so the agent always knows the memory is there and where to look the result: > every change is an immutable version: full audit trail, point-in-time recovery, redaction > read-only or read-write per store, so many agents can safely share one memory > workspace-scoped and persistent, memory that survives every session end most teams bolt on a vector DB and pray retrieval works. Anthropic went the opposite way: compiled knowledge as plain, human-readable files you can open, diff, and edit yourself and there's a second layer. Anthropic's "Dreaming" runs offline, reviews past sessions and the store, and rewrites it into a cleaner, higher-signal version. the agent literally consolidates memory in its sleep. bookmark this. the most production-grade agent memory right now is just a well-organized folder, and Anthropic proved it.

ANTHROPIC KILLED THE VECTOR DATABASE AND REPLACED IT WITH A FOLDER no embeddings. no black-box retrieval. no special memory tools. the agent just reads and writes a folder the insight: your agent already knows how to use a filesystem. so Anthropic made long-term memory a directory of small markdown files, mounted straight into the agent's sandbox at /mnt/memory the agent manages it with the tools it already has, bash, read, write, edit, grep, and Anthropic auto-injects a note into the system prompt so the agent always knows the memory is there and where to look the result: > every change is an immutable version: full audit trail, point-in-time recovery, redaction > read-only or read-write per store, so many agents can safely share one memory > workspace-scoped and persistent, memory that survives every session end most teams bolt on a vector DB and pray retrieval works. Anthropic went the opposite way: compiled knowledge as plain, human-readable files you can open, diff, and edit yourself and there's a second layer. Anthropic's "Dreaming" runs offline, reviews past sessions and the store, and rewrites it into a cleaner, higher-signal version. the agent literally consolidates memory in its sleep. bookmark this. the most production-grade agent memory right now is just a well-organized folder, and Anthropic proved it.

NO1ennn

13,359 views • 1 month ago

I'm oddly proud and stoked about this one - live video preview w/ audio of the Robotron AI training on the web. You can watch it live here: I started simple yesterday, a canvas I updated with a snapshot of the game that I pumped over a socket from an emulator session. That evolved into a video tag with a properly encoded video stream, and today I spent a full damned day almost adding audio and keeping it in sync with the game (which runs at an uncorked and unpredictable framerate). Assuming my machine can handle the load, it's available for viewing pleasure now at the link above :-) You have to click on the preview to enable the audio, and you can turn it off/on at the bottom of the page. Thanks to dsobeski for beta-testing it!

I'm oddly proud and stoked about this one - live video preview w/ audio of the Robotron AI training on the web. You can watch it live here: I started simple yesterday, a canvas I updated with a snapshot of the game that I pumped over a socket from an emulator session. That evolved into a video tag with a properly encoded video stream, and today I spent a full damned day almost adding audio and keeping it in sync with the game (which runs at an uncorked and unpredictable framerate). Assuming my machine can handle the load, it's available for viewing pleasure now at the link above :-) You have to click on the preview to enable the audio, and you can turn it off/on at the bottom of the page. Thanks to dsobeski for beta-testing it!

Dave W Plummer

15,271 views • 6 months ago

The same kinds of productivity gains we've seen in coding with AI agents are heading to the rest of knowledge work. This is the jump when you go from having a chatbot to being able to actually have an agent go off and do work for minutes or even hours and come back with a complete work output that you then review. Here's an example of the new Box Agent filling out an RFP response from an existing knowledge base. This process would normally take hours to fill out, and requires the full attention of the user doing the work. Now, you provide the Box Agent with the RFP questions, and it will go off, make a plan, extract all the relevant questions, read through existing source material to come up with an answer, and then generate a new word document as the final output. All while you're doing something else. The key to this architecture is that the agent is able to use all of the same tools in the background that a user uses to get work done. The agent can search for documents, read entire files, run scripts and tools in the background, and even be able to write code on the fly to automate tasks it hasn't seen before. And best of all, the Box Agent will (soon) work from the Box MCP and CLI so you can invoke it in any agentic system as a step in a process. This kind of agent complexity would have been impossible even 6 months ago. Models consistently failed at tracking long running tasks or using the right tools at the right moment for the task. But this is all now possible because of models like GPT-5.4, Opus 4.6, and Gemini 3, and is only getting better by the month. Just as we moved from engineers writing code and using AI as an assistant to answer questions, in many areas of knowledge work -like legal, finance, consulting, sales, marketing, and more- when we have a problem we'll just kick off the AI agent to just go work on it for us in the background.

The same kinds of productivity gains we've seen in coding with AI agents are heading to the rest of knowledge work. This is the jump when you go from having a chatbot to being able to actually have an agent go off and do work for minutes or even hours and come back with a complete work output that you then review. Here's an example of the new Box Agent filling out an RFP response from an existing knowledge base. This process would normally take hours to fill out, and requires the full attention of the user doing the work. Now, you provide the Box Agent with the RFP questions, and it will go off, make a plan, extract all the relevant questions, read through existing source material to come up with an answer, and then generate a new word document as the final output. All while you're doing something else. The key to this architecture is that the agent is able to use all of the same tools in the background that a user uses to get work done. The agent can search for documents, read entire files, run scripts and tools in the background, and even be able to write code on the fly to automate tasks it hasn't seen before. And best of all, the Box Agent will (soon) work from the Box MCP and CLI so you can invoke it in any agentic system as a step in a process. This kind of agent complexity would have been impossible even 6 months ago. Models consistently failed at tracking long running tasks or using the right tools at the right moment for the task. But this is all now possible because of models like GPT-5.4, Opus 4.6, and Gemini 3, and is only getting better by the month. Just as we moved from engineers writing code and using AI as an assistant to answer questions, in many areas of knowledge work -like legal, finance, consulting, sales, marketing, and more- when we have a problem we'll just kick off the AI agent to just go work on it for us in the background.

Aaron Levie

24,728 views • 5 months ago

We built an app called Hatch It enables Karpathy's entire LLM Knowledge Base workflow out of the box, in 2 or 3 clicks, in a single interface. No need to stitch together Obsidian + plugins + markdown files + custom tools + etc. Hatch is an AI workspace where files, docs, and chats all live together. Not only can the chats READ files and docs, but they can WRITE and ORGANIZE them as well. This means you can set up an LLM Wiki in literally 3 steps, as I show in this video.

We built an app called Hatch It enables Karpathy's entire LLM Knowledge Base workflow out of the box, in 2 or 3 clicks, in a single interface. No need to stitch together Obsidian + plugins + markdown files + custom tools + etc. Hatch is an AI workspace where files, docs, and chats all live together. Not only can the chats READ files and docs, but they can WRITE and ORGANIZE them as well. This means you can set up an LLM Wiki in literally 3 steps, as I show in this video.

Channing Allen

182,240 views • 5 months ago

After T-Roc and Passat, Altroz is the 3rd car for which I have made a specific video on the design (not a walkaround of features) I just want to sit and write a poem for the design it has. Sharing an unedited raw clip from a 10 min video.

After T-Roc and Passat, Altroz is the 3rd car for which I have made a specific video on the design (not a walkaround of features) I just want to sit and write a poem for the design it has. Sharing an unedited raw clip from a 10 min video.

Sunderdeep - Volklub

39,991 views • 7 months ago

Check out some of the new features in #TrailsbeyondtheHorizon! There's a drone shop you can buy items from on the go, Van and company finally get the chance to write reviews of all the delicious sweets they've tried across Calvard, a new mini game, and Timely Terms!

Check out some of the new features in #TrailsbeyondtheHorizon! There's a drone shop you can buy items from on the go, Van and company finally get the chance to write reviews of all the delicious sweets they've tried across Calvard, a new mini game, and Timely Terms!

NISAmerica

92,734 views • 1 year ago

Wow! 😮 They always tell us the truth. 👇 "I Write The Songs" I've been alive FOREVER And I wrote the very first song I put the words and the melodies together I am music And I write the songs I write the songs that make the whole world sing I write the songs of love and special things I write the songs that make the young girls cry I write the songs, I write the songs My home lies deep within you And I've got my own place in your soul Now when I look out through your eyes I'm young again, even tho' I'm very old I write the songs that make the whole world sing I write the songs of love and special things I write the songs that make the young girls cry I write the songs, I write the songs Oh, my music makes you dance and gives you SPIRIT to take a chance And I wrote some rock 'n roll so you can move Music fills your heart, well that's a real fine place to start It's from me, it's for you It's from you, it's for me It's a worldwide symphony I write the songs that make the whole world sing I write the songs of love and special things I write the songs that make the young girls cry I write the songs, I write the songs I write the songs that make the whole world sing I write the songs of love and special things I write the songs that make the young girls cry I write the songs, I write the songs I am music and I write the songs

Wow! 😮 They always tell us the truth. 👇 "I Write The Songs" I've been alive FOREVER And I wrote the very first song I put the words and the melodies together I am music And I write the songs I write the songs that make the whole world sing I write the songs of love and special things I write the songs that make the young girls cry I write the songs, I write the songs My home lies deep within you And I've got my own place in your soul Now when I look out through your eyes I'm young again, even tho' I'm very old I write the songs that make the whole world sing I write the songs of love and special things I write the songs that make the young girls cry I write the songs, I write the songs Oh, my music makes you dance and gives you SPIRIT to take a chance And I wrote some rock 'n roll so you can move Music fills your heart, well that's a real fine place to start It's from me, it's for you It's from you, it's for me It's a worldwide symphony I write the songs that make the whole world sing I write the songs of love and special things I write the songs that make the young girls cry I write the songs, I write the songs I write the songs that make the whole world sing I write the songs of love and special things I write the songs that make the young girls cry I write the songs, I write the songs I am music and I write the songs

Diana ❤️🇺🇸🙏🐸

76,773 views • 1 month ago

Vinoj P Selvam – an impressive young politician and a future lawmaker! I have been wanting to write on a young politician I admire a lot - Vinoj P Selvam. Vinoj is young but not very many people know that he the State President of Bharatiya Janata Yuva Morcha, Tamil Nadu from the year 2016. Vinoj is educated, can rake up important issues and present them in an absolutely lucid manner to the public and most importantly he is on the ground meeting people and being part of the common man fraternity. All the best Brother Vinoj P Selvam. Would love you see you as an MLA in the next assembly and a Minister in 2026 coalition government.

Vinoj P Selvam – an impressive young politician and a future lawmaker! I have been wanting to write on a young politician I admire a lot - Vinoj P Selvam. Vinoj is young but not very many people know that he the State President of Bharatiya Janata Yuva Morcha, Tamil Nadu from the year 2016. Vinoj is educated, can rake up important issues and present them in an absolutely lucid manner to the public and most importantly he is on the ground meeting people and being part of the common man fraternity. All the best Brother Vinoj P Selvam. Would love you see you as an MLA in the next assembly and a Minister in 2026 coalition government.

Dr. Praveen Vijaykumar

26,769 views • 1 year ago