https://zetier.com/speedrunners-are-vulnerability-researchers/ [zetier_FullColor] * Home * Capabilities * Careers * Blog Contact Us Speedrunners are vulnerability researchers, they just don't know it yet * February 26, 2025 * a Senior Cyber Engineer /nl_img1 Thousands of video game enthusiasts are developing experience in the cybersecurity industry by accident. They have a fun hobby, pouring over the details of their favorite games, and they don't know they could be doing something very similar... by becoming a vulnerability researcher. That probably requires some backstory, especially from a cybersecurity company's blog! What's a speedrun? Basically as soon as video games were released, people have been trying to beat them faster than their friends (or enemies) can. Gamers will do this for practically any game on the planet - but the most popular games, or the ones with the most cultural weight and cultish following, naturally end up with the fiercest competition. Speedrunners will run through their favorite game hundreds or thousands of times in order to get to get to the top of community-driven leaderboards for the fastest time... which puts incentives on that video game's community to find the absolute fastest way to clear the game, no matter how strange. "Any percent" speedruns, or "any%" more commonly, are usually one of the most popular categories of speedrun for any given game. In it, all rules are off and no weird behavior is disallowed: intentionally triggering bugs in the game, which the developers never intended for the players to be able to perform, often have the potential to shave double-digit percentages of time off existing routes by cutting out entire swathes of the game from having to be played at all. Why do 1 -> 2 -> 3 if you can do a cool trick and skip from 1 -> 3 directly? A lot of these glitches revolve around extremely precise movement... but for the most dedicated fans, they'll go even further. Glitch hunting is reverse engineering Entire groups will spring up inside a game's speedrunning community dedicated to discovering new glitches, and oftentimes they'll apply engineering to it. These enthusiasts won't just try weird things in the game over and over (although that definitely helps!) - they'll use tools that are standard in the cybersecurity industry to pull apart how software works internally, such as IDA Pro or Ghidra, to discover exactly what makes their target video game tick. On top of static analysis, they'll leverage dynamic analysis as well: glitch hunters will use dynamic introspection and debugging tools, like the Dolphin Emulator's memory viewer or Cheat Engine, to get a GDB-like interface for figuring out the program's internal data structures and how information is recorded. And even further, they'll develop entirely new tooling: I've seen groups like the Paper Mario: The Thousand Year Door community reverse engineer game file formats and create Ghidra program loaders, or other groups completely re-implement Ghidra disassembled code in C so they can stick it under a fuzzer in isolation. Some of the speedrun glitch hunters are incredibly technically competent, using the exact same tooling and techniques that people in the cybersecurity industry use for reverse engineering every day. ...And it's vulnerability research Not only do these groups do reverse engineering, but they also are doing vulnerability research. Remember, they don't only try to figure out how games work, but they try to break the game in any way possible. These glitches end up looking stunningly similar to how memory corruption exploits work for any other computer program: they'll find buffer overflows, use-after-frees, and incorrect state machine transitions in their target games. And perhaps most impressively, they'll productize their exploits, unlike a lot of people in the cybersecurity industry. Some vulnerability researchers will develop a proof-of-concept to demonstrate a bug - but never actually develop the technical chops on how that exploit would need to be developed further for an adversary to use it. They might intellectually know how to weaponize a buffer overflow, or a use-after-free, but speedrunning groups by necessity are actually doing it. Oftentimes, actually using these glitches requires working through extremely restrictive constraints, both for what inputs they have control over and what parts of the program they can influence. Super Mario World runners will place items in extremely precise locations so that the X,Y coordinates form shellcode they can jump to with a dangling reference. Legend of Zelda: Ocarina of Time players will do heap grooming and write a function pointer using the IEEE-754 floating point number bit representation so the game "wrong warps" directly to the end credit sequence... with nothing more than a game controller and a steady hand. [super-mari]Screenshot from an in-depth technical explanation of a Super Mario 64 glitch. Watch on YouTube. Leveling up: tool-assisted speedruns Some of the game communities will even take it a step further! Tool-assisted speedruns, or "TAS" runs, will perform glitches so precise that they can't reliably be performed by human beings at all. They'll leverage frame-by-frame input recordings in order to hit the right angle on a game controller's stick, every time; they'll hit buttons on the exact video game tick, every time. And because they have such precise control over their actions in games, they'll likewise be able to consider game glitches with exacting precision. TAS authors are able to leverage inspecting the video game with memory debuggers to craft a use-after-free with the perfect heap spray, or write multiple stages of shellcode payload in their player inventory with button presses. There's even an entire event at the most popular speedrunning conference, Awesome Games Done Quick/AGDQ, called "TASbot." During it, a robot does all the inputs via a hard-wired controller to perform a tool-assisted speedrun in real time - so it can do things like get arbitrary code execution and use that to replace the video game with an entirely new one, using nothing but controller inputs. An industry exists! The fact these people are so technically competent only throws in stark relief how disconnected some of them are from the larger cybersecurity industry. Speedrun glitch hunters will develop heap use-after-free exploits, with accompanied technical write-ups on the level of Google Project Zero... and in doing so, refer to it as an "item storage" glitch, because they developed the knowledge from first principles without ever reading a Phrack article. They'll re-implement disassembled code from Ghidra in C for automated glitch discovery, but without any exposure to American Fuzzy Lop or the large academic body of work driving fuzzer research. And, critically for us here at Zetier, they don't know you can get paid to do a job very close to finding video game glitches, and so they don't know to apply to our reverse engineering or vulnerability research job postings. A lot of these video game glitch hunters, even the ones writing novel Ghidra loaders or runtime memory analysis scripts, don't think of what they're doing as anything more than a fun hobby; they might go become a normal software engineer, if that. Some of them will look up "IDA Pro" on LinkedIn and see a million malware analysis job postings. No offense to my malware analysis friends, but malware reverse engineering and vulnerability research are two very different roles! Vulnerability research in industry, unlike more "normal" malware analysis jobs, is usually in the form of an engineer spending significant time investigating exactly how a program works. Like video game glitch discovery, they don't just care about what it does, but how it does it - and why the authors implemented it in that way, along with how that behavior may affect other parts of the program. Oftentimes, you end up building up a repertoire of small, innocuous "huh that's weird"-style bugs that are individually useless... until you find some missing piece. And like game glitches, the most satisfying of discoveries on the job are from realizations that there's a fundamental gap in thinking by the authors, where you don't just find one glitch but an entire family of glitches, all from the same root cause. [speedrunne]A glimpse of an arbitrary code execution (ACE) exploit walk-through. See the video. I personally love reading the technical game glitch write-ups that come out of speedrunning communities. Lots of my coworkers, and other people in the industry, likewise enjoy them. I love glitch write-ups because they remind me of the great parts of my job: extremely deep dives into the internals of how programs work, and working around odd constraints. Exploiting vulnerabilities requires performing mental gymnastics in order to chain seemingly innocuous primitives, like walking around out-of-bounds in Pokemon, together to do the thing in a way that allows the author to express their creativity and mastery over a piece of software. Talking to people in speedrunning communities who love pouring over Assembly, or figuring out exactly what the implications are for a 1-byte buffer overflow in a textbox, only for them to shrug and explain they're reluctantly working in a non-technical industry, comes across to me as a shame. If any of these descriptions speak to you, or bring to mind one of your friends, reach out to hello@zetier.com. We'd love to chat. Let the interwebs know that vulnerability researchers exist: Share this on HackerNews - Share On Your Next Read [asic-id-ha] The mystery of $0 HP printers Recently, I picked up a few printers from Craigslist... for the unbeatable price of $0. My goal was to use them for a trade-show simulation network, ... * February 19, 2025 * By a Zetier Cyber Engineer [def-con-20] Making the podium at DEFCON 2024 Editor's Note: This post is written from the first-person perspective of a Zetier team member, reflecting on his experience at the DEFCON 2024 confer... * January 14, 2025 * By a Zetier Cyber Engineer [open-sourc] Our 2024 open-source contributions Open-source contributions play a critical role in advancing technology, and this year, our team caught - and fixed - bugs in a variety of project... * December 19, 2024 * By the Zetier team [porting-fr] Is it hard to port Frida on OpenWRT? Frida "just works" on many common platforms: Windows Linux, glibc-based Android macOS and iOS But what about porting it to your ... * November 26, 2024 * By a Zetier Cyber Engineer [Bungeegum-] Android testing with Bungeegum Comprehensive testing capabilities are vital for building robust and secure Android applications in the world of Android cyber tool development. O... * August 24, 2024 * By a Zetier Cyber Engineer [image4] A small box contains a big surprise While scrolling mischievously at midnight on eBay, I came across an item of interest. It was obviously sealed deliberately, military-related, and fro... * July 12, 2024 * By a Zetier Cyber Engineer [cybersecur] Being a reservist at Zetier Getting a job while in the reserves is pretty easy. Keeping one while being activated and while life is happening is another story. Zetier is a compa... * August 16, 2024 * By a Zetier Cyber Engineer [tshark-lua] Something fishy happens when compiling Tshark with Lua Wireshark has long been a standard tool for engineers across many disciplines. With its rich feature set, protocol support, and outstanding GUI,... * June 12, 2024 * By Mark Santorello, Senior Engineer [flaShMASH] flaShMASH your dumps While inspecting an electrocardiograph (ECG) device from Spacelabs (specifically the 90496 shown in Figure 1) I ran into a little issue. Upon dum... * May 24, 2024 * By a Zetier Cyber Engineer [DALL] Oops, there goes the OPSEC Breadcrumbs are left throughout computer systems that hackers can use to track attribution or recover sensitive information that was unintentionally ... * May 22, 2024 * By the Zetier team [DALL] February 2024 watercooler topics Recent conversations around the Zetier watercooler covered a range of topics in IT, cybersecurity, and technology innovations. Our discussions sp... * March 4, 2024 * By the Zetier team [image1-e17] Meet Snipey: Snipe-IT asset management Introduction Introducing Snipey: The Ultimate Command-Line Companion for Snipe-IT Asset Management Managing IT assets effectively is crucial fo... * March 4, 2024 * By a Zetier Cyber Engineer [watercoole] December 2023 watercooler topics At Zetier, throughout the month we share news and articles of interest over Slack. This serves as a virtual watercooler for us as our team is spread a... * February 5, 2024 * By the Zetier team [JTAG-Blog_] Using JTAG to dump parallel NOR flash Reading Parallel NOR Flash with JTAG Still have that old development kit kicking around from college or high school? Yeah, me too. Don't have a pr... * March 18, 2024 * By a Zetier Cyber Engineer [DALL] Android testing with Lariat Introducing Lariat Howdy partners! At Zetier, we realize Android testing can be difficult, tedious, and less fun than walking 20 miles with a pebb... * February 19, 2024 * By a Zetier Security Researcher [Sharing-Ou] Sharing our knowledge Sharing knowledge is in Zetier's corporate DNA, and this expresses itself in multiple ways. For example, we participate in conferences, we ho... * January 10, 2024 * By Mark Goldenberg, Senior Zetier Technical Writer [image4] Power up your power supplies In cyber vulnerability research and reverse engineering, professionals frequently encounter hardware with specific power requirements not met by ... * February 5, 2024 * By a Zetier Cyber Engineer [image-3-e1] 2023 corporate offsite Zetier's team are scattered across the country in nine states, from New York to California to Florida. We communicate daily on the phone, by ... * January 10, 2024 * By Mark Goldenberg, Senior Zetier Technical Writer [thumbnail] Poor man's 3D tomography Overview Reverse engineering printed circuit boards is generally regarded as a time-intensive and sometimes difficult process as the interconnect ... * January 10, 2024 * By a Zetier Cyber Engineer [DALL] CodeQL for security research What is CodeQL CodeQL is a declarative query language for code, currently maintained by GitHub. GitHub maintains a decently sized set of queries t... * January 10, 2024 * By a Senior Zetier Cyber Engineer x Contact Form [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [Submit] [ ] [ ] [ ] [ ] [ ] [ ] [ ] D[ ] x Request Our Products Catalog [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [Submit] [ ] [ ] [ ] [ ] [ ] [ ] [ ] D[ ] [zetier_FullColor-1] Type your email... [ ] Subscribe Quick Links * Home * Capabilities * Careers * Blog Get In Touch * hello@zetier.com * +1 (877) 603-1337 * 4200 Wilson Boulevard (Suite 460) Arlington, Virginia 22203 (c) 2025 Zetier, Inc. | All Rights Reserved * [LI-In-Bug] * [github-mar] x Read Zetier's blog posts Enter your email address to subscribe to this blog and receive notifications of new posts by email. Email Address [ ] Subscribe Join 12 other subscribers Discover more from Zetier Subscribe now to keep reading and get access to the full archive. Type your email... [ ] Subscribe Continue reading