PlayBit / luxor2008
Every market has a secondhand tier. PlayBit, tracked under the handles PlayBit and luxor2008, is what it looks like in the Windows LPE business: patch-diff exploits rebuilt from public fixes and resold, competent, kernel-mode where the premium seller stayed in user mode, and caught by the same handwriting study that caught Volodya.
Verdict basis
cited, as of 2026-10-02, to Check Point Research's "Graphology of an Exploit" (2020),
which tracked PlayBit as the comparison author to Volodya. The catalogue below is that
study's; no attribution beyond the handles is claimed.
Who
An exploit seller of the same era and forums as Volodya, catalogued by the same fingerprinting method: five Windows LPE exploits spanning 2013 to 2018, all 1-days, meaning bugs exploited after their patches shipped rather than before. The two sellers never share a customer list in the study, but they do share one bug, which is the most instructive fact on this page.
The signature: the opposite handwriting
Where Volodya's builds minimize moving parts, PlayBit's maximize them, and every difference is a decision:
| Volodya | PlayBit | |
|---|---|---|
| Token elevation | User-mode walk with arbitrary R/W | Kernel-mode Ps* calls via ROP |
| SMEP | Avoided by never executing kernel code | Bypassed explicitly, with ROP chains |
| Version detection | ntdll.dll NT headers |
PEB-based parsing |
| Era span of catalogue | 2015-2019 | 2013-2018 |
| Tier | 0-days sold exclusive, 1-days resold | 1-days only |
The catalogue: CVE-2013-3660, CVE-2015-0057, CVE-2015-1701, CVE-2016-7255, CVE-2018-8453.
That fourth entry is the one to sit with. CVE-2016-7255 appears in both sellers' catalogues: Volodya as the zero-day, PlayBit as a rebuilt 1-day after the patch. The same vulnerability, exploited twice, by two authors whose solutions differ at every fork in the road. It is the cleanest natural experiment in exploitation style this corpus has found: same bug, same platform, same year, two hands, two architectures.
What the recycler tier teaches
The secondhand tier exists because a patch is a specification. Once Microsoft ships the fix, the diff tells any competent author where the bug lives, and the rebuild cost is a fraction of the find cost. PlayBit's five-exploit career is the economics of that: no find, only rebuild, sold to whoever missed the zero-day window.
That is the same economics the CLFS contractor industrialized in 2022, and the same one Microsoft's repeated partial fixes keep re-arming: every insufficient patch is a new specification for the secondhand market. Nightmare-Eclipse's ShieldCrash lineage, on the main profile, is the defensive mirror of this page.
Assessment
PlayBit matters to this series as the control group. Volodya's minimalism only reads as a choice when the alternative is visible, and PlayBit is the alternative: kernel ROP, explicit SMEP bypass, PEB parsing, five years of it. Fingerprinting told them apart where infrastructure analysis had nothing to say, which is the methodological point the original study made and the reason this series profiles actors by how they think.
Sources
Itay Cohen and Eyal Itkin, Check Point Research, "Graphology of an Exploit" (2020): the PlayBit catalogue, the technique comparison, and the shared-bug observation.