David Cannings

Cyber defence, reverse engineering and network geekery. Christian, husband & father of three. All views my own.

[David Cannings @edeca]

Day 9 of #adventofcode2024 - accidentally left my test output enabled 🙈

[David Cannings @edeca]

@saidelike The last time (many years ago) I used VMware and serial from Windbg. I expect things have come on a long way 😃

[David Cannings @edeca]

@pitlane_girl @SkySportsF1 I wonder if it was showing incorrect data because there were two formation laps. The first racing lap showed 1/23 which should have been 2/23.

[David Cannings @edeca]

This is a neat way of signaturing PDF samples, provided you carefully manage performance.

I wrote a short post explaining how it works and a few suggestions for enhancements: https://t.co/tqJIbfybQX

[Félix Aimé @felixaime]

import "hash"

rule Calisto_PDF_streams {
strings:
$s1 = { 0A 73 74 72 65 61 6D 0A }
$s2 = { 0A 65 6E 64 73 74 72 65 61 6D 0A }
condition:
uint32be(0) == 0x25504446 and
for any i in (0..#s1) : (
hash.md5(@s1[i]+8, @s2[i]-@s1[i]-8) == "b9950253cf88305a57cb350deb31c07e"
)
}

[David Cannings @edeca]

@felixaime @s1 @s2 A fun technique. I explain how this works in the following blog post, and provide a few suggestions for potential improvements: https://t.co/tqJIbfyJGv (thanks also to @wxs)

[David Cannings @edeca]

@wxs @r0ny_123 @travisgoodspeed You’d need to be careful about the overall file size and test the last 1..3 bytes separately I assume. I didn’t try this.

[David Cannings @edeca]

@wxs @r0ny_123 @travisgoodspeed I am using logical OR to ignore the even addresses. I think this is correct based on my limited testing. I haven’t seen test data related to the original question.

[David Cannings @edeca]

@hydahy Now now, locals like Frodo and Bilbo from The Shire don’t want Londoners dictating their breakfast routines 🥐

[David Cannings @edeca]

I asked #ChatGPT to generate 10 silly policy examples for the upcoming UK election campaign. I think it aced the question on the first try #generalelectionuk

[David Cannings @edeca]

@travisgoodspeed Here's a simple rule that seems to work: https://t.co/rWFuXKodXn

Any solution will need to scan every byte, so the only potential performance improvement I see would be to scan 32 bit integers and handle the remaining 1..3 bytes separately.

[David Cannings @edeca]

@drfootleg @emfcamp @adafruit @pimoroni Gosh, they are cheap. Very cool!

[David Cannings @edeca]

@drfootleg @emfcamp Looks great! What are the panels you are using for this?

[David Cannings @edeca]

@AzakaSekai_ If it uses a funky multi-stage process with a fifty byte XOR loop then I suspect it is related. Your screenshots from IDA look familiar.

[David Cannings @edeca]

@hmm261120 @ItsKylra @endermanch ASLR is supported on both 32-bit and 64-bit platforms, fastcall is available on x86 (for two registers) and MMX was introduced in 1997 on the Pentium P5.

[David Cannings @edeca]

@ShawnHymel I have seen it twice, including in the West End in London. A fabulous play and a great performance. Glad you enjoyed!

[David Cannings @edeca]

@Sk1d4ddlez @Rothmus Funny, but legally nonsense.

[David Cannings @edeca]

@RvLeshrac @DeathsPirate You are not allowed to disturb bats, including the places where they are nesting or breeding. But that doesn’t magically make any wooden box protected unless it is being used.

[David Cannings @edeca]

@matrosov @daveaitel And there is likely enough to reuse that could be deniable - not definitively linked back to the same individual(s) or group that were responsible for this incident. The wonders of open source!

[David Cannings @edeca]

@mr__catmann @endless_sine I find @GoHugoIO works very well. It does need more technical skill than tools like Wordpress but there are plenty of free templates.

[David Cannings @edeca]

@RvLeshrac @DeathsPirate If this tactic worked then climate campaigners would only need to string bat boxes across a road, or cover the gates to an oil refinery with bat boxes 🦇.

Bats are protected species - not bat boxes.

[David Cannings @edeca]

@RvLeshrac @DeathsPirate You are not allowed to disturb bats, including the places where they are nesting or breeding. But that doesn’t magically make any wooden box protected unless it is being used.