interested in rust, malware, hypervisors and deobfuscation https://xitter.cf/t.co/iePUc0Lgtu

Joined September 2018
Made a little experiment of lifting IDA microcode to z3 to automatically resolve opaque predicates. It works quite well on a few malware families I tested on. In the gif you can see Lumma stealer's opaque predicates being solved automatically:
1
25
1
197
12,245
This 1-pager from Xusheng Li on GDB internals of how watchpoints are implemented is a delight to read! (especially that double-write behaviour false positive - I did not know about that)
5
79
2
359
22,202
We probably need to start transitioning to the new name...
186
338
58
7,322
518,989
Ever wanted to draw a triangle with OpenGL as a 2kb position-independent shellcode? No? Me neither. But you can do it anyway: github.com/wbenny/scfw
30
143
10,656
In today's episode of programming horror... In the Python docs of random.seed() def, we're told "If a is an int, it is used directly." [1] But if you seed with 3 or -3, you actually get the exact same rng object, producing the same streams. (TIL). In nanochat I was using the sign as a (what I thought was) clever way to get different rng sequences for train/test splits. Hence gnarly bug because now train=test. I found the CPython code responsible in cpython/Modules/_randommodule.c [2], where on line 321 we see in a comment: "This algorithm relies on the number being unsigned. So: if the arg is a PyLong, use its absolute value." followed by n = PyNumber_Absolute(arg); which explicitly calls abs() on your seed to make it positive, discarding the sign bit. But this comment is actually wrong/misleading too. Under the hood, Python calls the Mersenne Twister MT19937 algorithm, which in the general case has 19937 (non-zero) bits state. Python takes your int (or other objects) and "spreads out" that information across these bits. In principle, the sign bit could have been used to augment the state bits. There is nothing about the algorithm that "relies on the number being unsigned". A decision was made to not incorporate the sign bit (which imo was a mistake). One trivial example could have been to map n -> 2*abs(n) + int(n < 0). Finally this leads us to the contract of Python's random, which is also not fully spelled out in the docs. The contract that is mentioned is that: same seed => same sequence. But no guarantee is made that different seeds produce different sequences. So in principle, Python makes no promises that e.g. seed(5) and seed(6) are different rng streams. (Though this quite commonly implicitly assumed in many applications.) Indeed, we see that seed(5) and seed(-5) are identical streams. And you should probably not use them to separate your train/test behaviors in machine learning. One of the more amusing programming horror footguns I've encountered recently. We'll see you in the next episode. [1] docs.python.org/3/library/ra… [2] github.com/python/cpython/bl…
212
475
66
7,715
772,251
Article très intéressant, surtout quand on a vu ma dernière vidéo sur la panne de l'aspirateur robot Dyson codetiger.github.io/blog/the…
11
42
3
155
12,988
Impressive work from our team today at #Pwn2Own! Mehdi and Matthieu just pulled off an exploit on the Philips Hue Bridge without laying a finger on the device! Great demonstration of Synacktiv’s offensive expertise 👏 Come on 🔥
3
11
89
5,796
Hey @ProtonPrivacy, why are you cancelling journalists and ghosting us. Need help calibrating your moral compass❓ First therapy session is for free 😘 Regarding phrack.org/issues/72/7_md#ar…
58
232
55
1,250
179,871
🔥HeroCTF v7 is back at the end of November! 🚩You can now register your team on CTFtime 🔗 ctftime.org/event/2869 More information to come soon.
1
12
26
1,862
🔐 Data encryption in Laravel environments is based on one secret: the APP_KEY. Our ninja @_remsio_ studied the impact of its leakage on the internet during an entire year. synacktiv.com/en/publication…
2
38
1
89
8,925
I've published my thoughts on part of the anonymization method used in that paper: hackarcana.com/article/anony… TL;DR: yeeeah... I don't think it works well
Anyone has a copy of the zenodo.org/records/15170676 dataset? (that's Discord messages; context: news.ycombinator.com/item?id…) Authors seem to have restricted access, and I wanted to verify sth wrt their anonymization method.
1
10
22
6,583
After 6 years, I made a blog thingy again. This time about MmScrubMemory. An innocuous looking function that has bitten my ass several times in the last several years. And if you're developing a hypervisor, it might've bitten yours, too. wbenny.github.io/2024-11-21-…
4
27
96
10,065
We @binarly_io have just released idalib v0.2.0, an update to our @HexRaysSA IDASDK Rust bindings. It includes many new features: bookmarks, comments, and plugins APIs, hex-rays support, and documentation! github.com/binarly-io/idalib Thanks to our contributors: @yeggorv, @0xdea!
22
1
79
18,304
did someone saw any blog post related to LoopbackLibrary ? I only saw James Forshaw "Elevating Kerberos to the Next Level" but its not so detailed
1
334
New blog entry: C++ Unwind Metadata: A Hidden Reverse Engineering Bonanza msreverseengineering.com/blo…
2
115
5
318
30,405
Bonjour citoyens de l'InfoSec, Je suis très heureux de vous annoncer ma nouvelle aventure : OffenSkill ! offenskill.com/ youtube.com/watch?v=g5KP9CRE… Suite à mon départ de ManoMano (miss you guys 💌), je me mets -enfin ?- à plein temps en tant que travailleur indépendant ! 🥳 Cela veut dire que je suis maintenant ouvert à : - Des missions Pentest, Web / Cloud / devops / Linux / Infra 💥 - Des trainings de sécurité, allant du Novice à l'Expert 💣 - De l'enseignement en école 🎓 - Du mentoring "à la carte" 📜 - Des collaborations en Bug-Bounty 💞 Comme tout nouvel indépendant, tout conseil est bienvenu, que ce soit sur le site, l'offre, l'approche, ou autre ! 👼 Et as always, Like / RT / Share appréciés, voir même plus que d'habiture ! 😉 Au plaisir de vous voir en training ou mission, Laluka
11
34
1
103
10,264