Zhang M1suzu

How to Build a Successful Information Security Career (Daniel Miessler)
- https://danielmiessler.com/blog/build-successful-infosec-career/#gs.DtVCbbw
The First Steps to a Career in Information Security (Errata Security - Marisa Fagan)
- http://blog.erratasec.com/2010/04/first-steps-to-career-in-information.html#.WFrbofkrIuU
Hiring your first Security Professional (Peerlyst - Dawid Balut)
- https://www.peerlyst.com/posts/hiring-your-first-security-professional-dawid-balut
How to Start a Career in Cyber security
- https://www.concise-courses.com/security/how-to-start-your-career/
How to Get Into Information Security (ISC^2)
https://www.isc2.org/how-to-get-into-information-security.aspx

Xiaomi's locked bootloader is insecure and useless

Your phone should have a locked bootloader, as it ensures the integrity of the software running on the device. This is especially relevant for Xiaomi phones, which are often loaded with all sorts of crapware by shady merchants. These vendor ROM's are a serious security risk. You really don't want to run that shit, so do your research very carefully when importing a Xiaomi device to ensure it hasn't been tampered with.

So, Xiaomi makes these nice phones and those vendors just ruin it all. They do the logical thing and start locking devices. But even today, vendor ROM's are still a thing! Even the brand new edgeless Mi Mix isn't safe.

How is this possible?

Through a wide open back door called EDL mode. To flash anything you want, all you need is a "deep flash cable" from [Aliexpress](https://www.aliexpress.com/wholesale?catId=0&SearchText=xiaomi+deep+fl

	0xfe82801c: addr = 0xfe84804b, type = 0x3d, id = 0x0805, args = 2, name = tzbsp_pil_init_image_ns
	0xfe828038: addr = 0xfe8482c1, type = 0x3d, id = 0x0802, args = 1, name = tzbsp_pil_auth_reset_ns
	0xfe828050: addr = 0xfe847c85, type = 0x0d, id = 0x0806, args = 3, name = tzbsp_pil_mem_area
	0xfe828070: addr = 0xfe847ce7, type = 0x0d, id = 0x0807, args = 1, name = tzbsp_pil_unlock_area
	0xfe828088: addr = 0xfe84831b, type = 0x0f, id = 0x0808, args = 1, name = tzbsp_pil_is_subsystem_supported
	0xfe8280a0: addr = 0xfe84835f, type = 0x0f, id = 0x0c01, args = 1, name = tzbsp_pil_is_subsystem_mandated
	0xfe8280b8: addr = 0xfe84c7d9, type = 0x0d, id = 0x0c02, args = 1, name = tzbsp_write_lpass_qdsp6_nmi
	0xfe8280d0: addr = 0xfe8079bd, type = 0x0d, id = 0x0c04, args = 2, name = tzbsp_set_cpu_ctx_buf
	0xfe8280ec: addr = 0xfe80972b, type = 0x0d, id = 0x0c06, args = 2, name = tzbsp_set_l1_dump_buf
	0xfe828108: addr = 0xfe8097e5, type = 0x0f, id = 0x0c07, args = 1, name = tzbsp_query_l1_dump_buf_size

	<?xml version="1.0" encoding="UTF-8"?>
	<Annotations start="0" num="171" total="171">
	<Annotation about="www.bussink.net/*" timestamp="0x0005d7bc4022b026" href="ChF3d3cuYnVzc2luay5uZXQvKhCm4IqBxPf1Ag">
	<Label name="_cse_turlh5vi4xc"/>
	<AdditionalData attribute="original_url" value="https://www.bussink.net/"/>
	</Annotation>
	<Annotation about=".thedfirreport.com/" timestamp="0x0005d76dd5f8679d" href="ChUqLnRoZWRmaXJyZXBvcnQuY29tLyoQnc_hr93t9QI">
	<Label name="_cse_turlh5vi4xc"/>
	<AdditionalData attribute="original_url" value="https://thedfirreport.com/"/>
	</Annotation>

	'''
	example of:
	- using ctypes with the IDA SDK
	- providing custom UI hints with dynamic data from Python

	in this silly example, we display UI hints with the current timestamp.
	a more useful plugin might inspect the hovered line, and display some documentation.

	Author: Willi Ballenthin <[email protected]>
	Licence: Apache 2.0

	'''
	split the line returned by `get_custom_viewer_curline` into symbols.
	it pulls out the strings, color directives, and escaped characters.
	this hex-rays blog post describes how ida uses the special color tags
	to describe syntax highlighting:

	http://www.hexblog.com/?p=119

	for example, here's a line that we see in IDA Pro:

	<?php
	/*
	Updated version, 2016-12-02: fixed shellcode so it actually works on QEMU
	usermode emulation (seems I pushed an old version), and removed debug output.

	-------------------------

	NB: THIS PoC ONLY WORKS IN QEMU USERMODE EMULATION!
	If anyone wants to fix this, go ahead (no pun intended).
	However, I don't have a vulnerable product and am unwilling to acquire one.

	#!/usr/bin/env python2
	'''
	some documentation
	author: Willi Ballenthin
	email: [email protected]
	website: https://gist.github.com/williballenthin/d43cbc98fa127211c9099f46d2e73d2c
	'''
	import sys
	import logging
	from collections import namedtuple

	'''
	IDA plugin to display the calls and strings referenced by a function as hints.

	Installation: put this file in your %IDADIR%/plugins/ directory.
	Author: Willi Ballenthin <[email protected]>
	Licence: Apache 2.0
	'''
	import idc
	import idaapi
	import idautils

	struct termios tty;
	memset (&tty, 0, sizeof tty);

	if (tcgetattr (serial_fd, &tty) != 0)
	return -1;

	// set speed
	cfsetospeed (&tty, B115200);

	// set control options