Having H26Fun with H26Forge: Vulnerability Hunting, Datamoshing, and More!
summary
A reusable toolkit called H26Forge parses and rewrites H.264 syntax elements (30k lines of Rust plus small Python transforms) to generate syntactically valid but semantically out‑of‑bounds streams. It produces proof‑of‑concept files that trigger kernel memory corruption and other faults across devices, yields multiple CVEs acknowledged by Apple Mozilla and FFmpeg, and even recovers image data in a case dubbed lumac chroma thief, so the tool demonstrably finds and reproduces real issues.
AI-written summary · about
chapters (11)
- 0:00H26Forge introduction
- 1:08H264 syntax elements
- 2:10Modify H264 syntax elements
- 3:15Manual H264 bitstream challenges
- 4:37What is H26Forge and how it works
- 6:04Vulnerability hunting with H26Forge
- 7:30Lumac Chroma Thief demo
- 8:53Generating Lumac Chroma Thief
- 9:36Data moshing with H26Forge
- 10:42Other H26Forge use cases
- 11:23Conclusion & Q&A
related talks
27mThe Most Dangerous Codec in the World: Finding and Exploiting Vulnerabilities in H.264 Decoders
01h 16mClassic Vulnerabilities
01h 05mClassic Vulnerabilities
34mViral Video - Exploiting SSRF in Video Converters
29mBuilding a Hackbot: How Ethiack's Hackian Finds Real Vulnerabilities
51mExploiting Hardware Glitches And Side Channels In Perfect Software
55mHow hacking works
28mFuzzing Malware for Fun & Profit