Humbled to share I will be keynoting at LangSec 2025. I am thankful for such a unique honor, at one of the most prestigious security venues in the world.

huge news, dream job unlocked: I started my PhD in CS at @dartmouth last week, where I’m working with @sergeybratus & Christophe Hauser in the Trust Lab. happy&proud to step into this new era, work on my most ambitious UEFI research projects yet, collab w my incredible lab cohort

Just do it. Ask for it. It just works. Beautifully. As usual, the difference lies in if you're looking for a result or an understanding. And that difference only matters when you're failing at glitching your target :)

For over three years, @LennertWo and I have worked on improving fault injection attacks against STM32F2 and STM32F4 devices to make them more repeatable and reliable. It's been a roller coaster of late nights, bricked chips, and questioning our life choices, resulting in over 100 million total glitches, a new attack strategy, and flash memory recovery from dozens of locked targets with a 100% success rate. I'm super proud of what we've done and happy to officially share it with the world! grandideastudio.com/portfoli… github.com/joegrand/stm32-fa… piped.video/watch?v=4LahQG09…

In Richard Feynman's words: "I often liked to play tricks on people when I was at MIT. One time, in mechanical drawing class, some joker picked up a French curve (a piece of plastic for drawing smooth curves - a curly, funny-looking thing) and said, "I wonder if the curves on this things have some special formula?" I thought for a moment and said, "Sure they do. The curves are very special curves. Lemme show ya," and I picked up my French curve and began to turn it slowly. "The French curve is made so that at the lowest point on each curve, no matter how you turn it, the tangent is horizontal." All the guys in the class were holding their French curve up at different angles, holding their pencil up to it at the lowest point and laying it along, and discovering that, sure enough, the tangent is horizontal. They were all excited by this "discovery" - even though they had already gone through a certain amount of calculus and had already "learned" that the derivative (tangent) of the minimum (lowest point) of any curve is zero (horizontal). They didn't put two and two together. They didn't even know what they "knew". I don't know what's the matter with people: they don't learn by understanding; they learn by some other way - by rote, or something. Their knowledge is so fragile!"

Exploiting QSEE Vulnerabilities in Google's Wifi Pro (slide deck) raelize.com/upload/research/… Credits @tieknimmers and @pulsoid #infosec

That class I can highly recommend. One of the best I took!

Project Zero is hiring! google.com/about/careers/app… Please share with anyone you think would be great for the role. DMs are open for questions.

Slides from #Offensivecon2026 have been released! You may want to peek into our use of secure ranges and XPUs to pwn QSEE on Google Wifi Pro. EL3 privesc with 2 single writes. --> TEE writable from NS-EL0. Writing TEE memory with bash scripts...is quite cool ;)

Happy to share that #TEEPwn is back! We will be touching upon those software/hardware boundaries that make TEE exploitation unique. See you in Canada!

Our @offensive_con 2026 slides are now publicly available: raelize.com/upload/research/… We got the highest privileges (EL3) on QSEE's Google's Wifi Pro, dumped the ROM and broke the /data partition encryption. Our technique may be applicable to other TrustZone TEEs as well. Enjoy!

Hall of shame: mtkclient.com/ and mtkclient.org/ claim to be developers of mtkclient. They are not and are also not authorized to use my software or my logo. Always get my software from github.com/bkerler/mtkclient. Such guys are the reason why I do not push regular updates anymore.

Secure Boot is designed to keep attackers out. This training shows you how attackers get in. 👀 Learn to identify weaknesses in Secure Boot implementations with @pulsoid at Hardwear.io Netherlands 2026. 🎟️ Register now: hardwear.io/trainings/nl-202… #HardwearNL2026

Sometimes, all it takes is a perfectly timed glitch. ⚡ Join @tieknimmers at Hardwear.io Netherlands 2026 to learn advanced fault injection techniques through hands-on labs and real-world attack scenarios. 🎟️ Register now: hardwear.io/trainings/nl-202… #HardwearNL2026

Submit your research to the room that actually knows what an EMFI probe is-before the CFP window slams shut on 22nd July. 🛠️Submit here: hardwear.io/nl-2026/cfp/ @hardwear_io #Hardweario #HardwareHacking #ReverseEngineering #InfoSec #FaultInjection #SideChannel

Massive respect to our @hardwear_io review panel @aseemjakhar, @pulsoid, @yossioren, @jzvw, @LennertWo, @XenoKovah who officially starts evaluating incoming research in a few days. Make their jobs harder with your best research.

Great bit of research this. Well done

One EM pulse flips a single instruction inside __sys_setresuid, and an unprivileged adb shell becomes uid 0 on Google's TV Streamer 4K (@raelizecom) raelize.com/blog/setresuid-g… #infosec

Slides for our OffensiveCon talk (by me and @jmartijnb) androidoffsec.withgoogle.com…: A tiny mistake in a render config ➡️ corrupt a special GPU stack pointer register ➡️ GPU hardware “renders” pixels to the AP kernel directly ➡️ pwned More presentations: androidoffsec.withgoogle.com… :)

Oh boy, it's been a while. Now with AI all the exploiteers are half-a-sleep as AI is doing all the work. But wait ! Here's some food for your brain: github.com/bkerler/exploit_m… I've added a bit more vulnerabilities (29 in total). Have fun !