amfi@amfi_d

19 y.o vulnerability researcher

github.com/csrXamfi
Joined December 2025
25 Photos and videos
Pinned Tweet
amfi@amfi_d
Aug 15
If you have received a notification from Apple Threat, please contact me.
9
1,148
amfi retweeted
Guilherme Rambo@_inside
9h
Emulating the firmware for Apple’s Lightning Digital AV Adapter (dongle that runs a stripped-down version of XNU)
4
8
152
8,267
#PHTalks Goa: CVE-2026-113915, Racing the Media Daemon to Steal Your Hidden Photos on iOS 27.2. @andrd3v and @amfi_d: a 200-microsecond race in mediaanalysisd lets any app swap in a symlink and read your hidden photos. No prompt. Dec 10 - Goa - Free phtalks.pt.community/goa
2
4
537
amfi retweeted
Ilya Andr@andrd3v
Oct 27
6 of my CVEs fixed: CVE-2026-86925 - leak all cached thumbnails CVE-2026-113915 - photo lib leak CVE-2026-112616 - read/delete any browser history CVE-2026-86989 - device fingerprinting CVE-2026-86948 - macOS sandbox escape CVE-2026-86949 - macOS sandbox escape
3
3
51
3,156
CVE-2026-50494 ntfs!AnalysisPass RCA ptesc.tech/en/heap-based-buf…

Heap-based buffer overflow in ntfs!AnalysisPass

A heap buffer overflow exists in the ntfs!AnalysisPass functionality of Microsoft Windows NTFS driver. During recovery of a specially crafted NTFS $LogFile…

ptesc.tech
7
22
1,715
Tiny root cause analysis for one of the vulnerabilities (CVE-2026-20840) that I have found in ntfs ptesc.tech/en/out-of-bounds-… enjoy
1
17
41
4,111
Finally got around to writing up CVE-2026-84530, which was fixed in the iOS 27 security release This one is a kernel address leak in AIO subsystem - aio_workq_entry pointer gets left in kqueue metadata and can be read back from userspace More details: github.com/vschko/CaseStudie…
4
26
162
14,314
amfi retweeted
Steve Weis@sweis
Sep 20
636606729769440499166579950236036751749912014371509557713570027508971809534551913252252094954941974952859310861988904737359709200557919 is a factor of RSA-896 saweis.net/posts/rsa-896.htm…
222
987
9,471
3,919,968
hello, diag shell! 🏆
15
1,970
Thanks @nyan_satan for polinaserial. I decrypted the logs in ibss (vma2)
23
2,194
🤯
3
1
47
5,615
amfi retweeted
matteyeux@matteyeux
Sep 13
Debug iBoot for studio display running in QEMU
3
9
138
7,206
amfi retweeted
matteyeux@matteyeux
Sep 11
"Revisiting SecureROM Adventures". Talk is about the SecureROM and an usbliter8 variant by iH8sn0w hexacon.fr/conference/speake…

Hexacon - Conference – Speakers

Discover the accepted talks for this edition!

hexacon.fr
2
20
140
8,484
My first CVE. For some reason, Apple didn't list me in credits.
10
147
9,559
Slides and whitepaper of Gone in 60 Frames – USB Video Exploitation by @robHerrera_ and myself seem to be on the #defcon34 media server now! Slides - media.defcon.org/DEF%20CON%2… Whitepaper - media.defcon.org/DEF%20CON%2…
4
51
164
15,236
We built an IDA plugin using an LLM; now I’m going to test it on large files. Thanks for the idea, @matteyeux
2
4
92
7,047
amfi retweeted
matteyeux@matteyeux
Jul 31
I built a Binary Ninja diffing tool that lets you visualize differences directly in Binary Ninja, with support for multiple Intermediate Languages (ILs). It uses Quarkslab's QBinDiff for the diffing engine, and getting started is as simple as dragging and dropping two binaries.
12
68
507
22,676
Also added details about kernel VA leak via IOService::updateConsoleUsers: github.com/vschko/CaseStudie…
1
18
1,631
While waiting for Apple’s next security release announce, I’m publishing the details and PoC for CVE-2026-39868, a kernel memory corruption issue fixed in macOS 26.5.2: github.com/vschko/CaseStudie…
2
16
144
10,297
I also developed a PFA file that triggers the CVE-2025-43400 vulnerability. you can find it on my GitHub.
6
68
8,609
Load more