code is not considered to be a weapon by law in most countries. As soon as their country rules this, it's easy enough just to migrate to a region who doest care. This wont be stopped any time soon since all countries would need to adpot these laws in one go for it to be effective... yay interwebz :)

On another note i think it's silly ppl try to exploit apps on phone when it's well known how to access any device via simcard and/or lte chips >.> can just take screenshots of conversations, no need for decryption. >.> guess they like flushing money through the toilet lol.

You can just as easily claim you bought an exploit for non directly offensive purposes.

Such as ?

Red team training, developing countermeasures and signatures, researching attack heuristics, and if "counter hacking" will ever be legalized (which there is some push to do so) then in the same manner as owning a gun legally shooting back.

Fair enough.

Also FYI probably the first large scale broker of exploits was TippingPoint/HP (i don't remember if this thing started before or after HP acquired TippingPoint), they would buy exploits develop signatures for their IPS products then notify the vendors of the affected products and later disclose the vulnerability to the public. http://www.zerodayinitiative.com