среда, 7 декабря 2022 г.

timers in linux kernel

›
timers are very important artifact for forensics, for example Volatility even has plugin to dump timers from windows kernel. Unfortunatel...
вторник, 29 ноября 2022 г.

linux drivers cross-compilation

›
Just reminder for myself how to build driver for arm64 having x64 based machine with ubuntu Install right gcc for arm64 we need gcc-aarch64...
понедельник, 31 октября 2022 г.

BTI incompatible exported functions in kernel 5.15.0-53

›
if BTI is enabled, the first instruction encountered after an indirect jump must be a special BTI instruction from here I downloaded Ubuntu ...
пятница, 29 июля 2022 г.

dirty secrets of ld.so

›
As you can know you can set library path under linux with several ways: envvar LD_LIBRARY_PATH, but it can be removed somewhere inside progr...
суббота, 9 июля 2022 г.

PoC to blind pamspy

›
Lets disasm jit code from this spyware :  [8] prog 0xffffb02dc0133000 id 160 len 46 jited_len 215 aux 0xffff8ccb58fab400 used_maps 1 used_bt...
четверг, 30 июня 2022 г.

size of ebpf jit code on different processors

›
it doesn't make much sense but bcs I have now several jit compilers - why not compare how much size have jitted code for different proce...
среда, 29 июня 2022 г.

verification of jitted ebpf code

›
There are some projects for ebpf in usermode, but for verification purposes you need the same code which was used in kernel. So I ripped ou...