CTurt

@CTurtE

Security Engineer at Google

cturt.github.io
Joined October 2013
14 Photos and videos Photos and videos

Tweets

You blocked @CTurtE

Are you sure you want to view these Tweets? Viewing Tweets won't unblock @CTurtE

  1. Pinned Tweet
    3 Aug 2020

    I’m thrilled to announce that I’ve joined Google on the ISE Cloud team! I’m starting remotely here in the UK for now, but I’ll be moving to Switzerland before the end of this year.

    37 replies 8 retweets 345 likes
    Undo
  2. Sep 10

    An update: they’re also sending me a PS5 console, which is great because I don’t actually have one yet. Thanks again to the PlayStation security team :)

    Just heard from PlayStation that I’ve been awarded a $10k bounty, thanks! 👀
    41 replies 25 retweets 394 likes
    Undo
  3. Aug 19

    Although PS2 is explicitly out of scope in their bounty program, if you did have an exploit for a PS2 game, I wonder if you could still convince them to payout under the rationale that for PS2 streaming in PS Now it would be RCE on their servers.

    Replying to @CTurtE
    Please tell me it’s for the PS2 hax 😂
    7 replies 3 retweets 72 likes
    Undo
  4. Aug 19

    Just heard from PlayStation that I’ve been awarded a $10k bounty, thanks! 👀

    54 replies 55 retweets 559 likes
    Undo
  5. Jun 8

    Path traversals are still alive in file sharing enabled chat apps. Thanks to Dino for the speedy fix :)

    15 likes
    Undo
  6. May 3

    And here's the previous upload from 2006 that I'm comparing it to. Applying old YouTube compression to VHS tapes is frustratingly bad, so I'm super excited by these new remasters :)

    1 reply 9 likes
    Show this thread
    Show this thread
    Undo
  7. May 3

    This is really cool! Someone has remastered a bunch of the old instructional guitar VHS tapes in 1080p 60 FPS, using some machine learning software. Here's Yngwie Malmsteen 'Hot Licks' from 1991... You can actually see the frets he's playing, finally!

    6 replies 11 retweets 71 likes
    Show this thread
    Show this thread
    Undo
  8. Apr 18

    Many instructions calculate and set multiple flags, when only one is actually needed in the context; in these cases we could emit a more optimised handler alongside the original ROM, essentially converting the game to use a finer-grained instruction set, without fully recompiling

    3 likes
    Show this thread
    Show this thread
    Undo
  9. Apr 18

    A less extreme idea: decoding which registers each instruction in ROM writes to, and tracking whether they actually get read by subsequent instructions, or just overwritten (up until say an indirect jump).

    1 reply 3 likes
    Show this thread
    Show this thread
    Undo
  10. Apr 18

    For the remaining games, some additional static optimisations could be done. For instance, on the extreme side, people have completely recompiled games statically:

    1 reply 4 likes
    Show this thread
    Show this thread
    Undo
  11. Apr 18

    Along with hand tuned assembly, this trick of cutting out the overhead of the main loop by using a “weird machine” allows many games to run full speed!

    1 reply 3 likes
    Show this thread
    Show this thread
    Undo
  12. Apr 18

    To speed up the instruction cycle of a traditional interpreter: loop { call opcode_handler[x]; check_timings_for_interrupts(); } Instead of returning back to the main loop, each opcode handler inlines the timing checks and jumps directly to the next one:

    1 reply 3 likes
    Show this thread
    Show this thread
    Undo
  13. Apr 18

    The GBA’s 32KB of fast RAM isn’t enough to dynamically load a GBC ROM, which could be up to 8MB. Instead, the GBC ROM gets added to the emulator’s ROM file. The whole ROM can be accessed, but there isn’t space to largely JIT new code, aside from a few game-specific “speed hacks”

    2 replies 3 likes
    Show this thread
    Show this thread
    Undo
  14. Apr 18

    This technique is really cool! I saw a similar thing used in the GameBoy Color emulator for the GameBoy Advance, goombacolor.

    This is an incredibly creative project. Here a thread to explain how it works for the unintroduced to weird machines. QEMU translates binaries to an intermediate representation called tiny code. Then it has 2 ways of executing it. (1/7)
    Show this thread
    1 reply 1 retweet 19 likes
    Show this thread
    Show this thread
    Undo
  15. Mar 12

    If you give buffer overflow this opposite definition (preventing buffer overflow), it becomes completely meaningless to say “this software has buffer overflows”.

    1 retweet 6 likes
    Show this thread
    Show this thread
    Undo
  16. Mar 12

    Pet peeve: when software returns an error on insufficient space and calls it a buffer overflow error... no, that would be if the scenario _wasn’t_ handled and the buffer actually overflowed, not when you explicitly prevent it by returning an error to indicate insufficient space

    2 replies 2 retweets 18 likes
    Show this thread
    Show this thread
    Undo
  17. Feb 27

    The elusive PlayStation 2 security coprocessor, 'Mechacon', has finally been dumped for the first time!

    ac4685b16373e98728c035b786a6f2ab7f31b1207108ae0381bbb9a8ce9c753b
    Show this thread
    15 replies 136 retweets 655 likes
    Undo
  18. Retweeted
    Feb 23
    Replying to

    More legit Rust 0day I’ve wanted fixed for 2 years now: You can hide unsafe code without your own unsafe block by abusing other people’s macros. It even bypasses #![forbid(unsafe_code)]

    2 replies 4 retweets 12 likes
    Undo
  19. Jan 27

    So many people talking about GME... They all went from “security researcher” to “securities researcher” real quick! 😂

    1 reply 4 retweets 53 likes
    Undo
  20. Jan 26

    Compliment the strategy by also generating and spamming fake job applications to impede the security team’s hiring.

    7 likes
    Show this thread
    Show this thread
    Undo
  21. Jan 26

    The cost of buying a 0day RCE and sandbox escape is so high that it seems like anything you could do to delay security teams and increase the exploit’s life would make sense for an APT to invest in... I wonder if we will ever see something like this.

    3 replies 16 likes
    Show this thread
    Show this thread
    Undo

@CTurtE hasn't Tweeted yet.

Loading seems to be taking a while.

Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

    You may also like

    ·