smx-smx

XZ Backdoor symbol deobfuscation. Updated as i make progress

thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Update: I've disabled comments as of 2025-01-26 to avoid everyone having notifications for something a year on if someone wants to suggest a correction. Folks are free to email to suggest corrections still, of course.

Background

MrEnder0

// Code written by Mr.Ender for educational purposes only, version 2

use std::{process::Command, io};

fn main() {
    let host_name = Command::new("sh")
        .arg("-c")
        .arg("hostname")
        .output()
        .expect("failed to get host name");

idleberg

Open in Visual Studio Code

• Open Automator
• Create a new document
• Select Quick Action
• Set “Service receives selected” to files or folders in any application
• Add a Run Shell Script action
  • your default shell should already be selected, otherwise use /bin/zsh for macOS 10.15 (”Catalina”) or later
  • older versions of macOS use /bin/bash
• if you're using something else, you probably know what to do 😉

WesleyAC

#!/usr/bin/env bash

cd $(dirname $0)

docker run --rm -it -v "$(pwd)":/home/rust/src -v cargo-git:/home/rust/.cargo/git -v cargo-registry:/home/rust/.cargo/registry -v "$(pwd)/target/":/home/rust/src/target ekidd/rust-musl-builder:nightly-2021-01-01 sudo chown -R rust:rust /home/rust/.cargo/git /home/rust/.cargo/registry /home/rust/src/target

docker run --rm -it -v "$(pwd)":/home/rust/src -v cargo-git:/home/rust/.cargo/git -v cargo-registry:/home/rust/.cargo/registry -v "$(pwd)/target/":/home/rust/src/target ekidd/rust-musl-builder:nightly-2021-01-01 cargo build --release

MaskRay

Introduced in musl v1.2.1. Design goal: "Strong hardening against memory usage errors by the caller, including detection of overflows, double-free, and use-after-free, and does not admit corruption of allocator state via these errors."

context

// Singleton: ctx
struct malloc_context {
  uint64_t secret;
#ifndef PAGESIZE
  size_t pagesize;

ih2502mk

Lecture 1: Introduction to Research — [📝Lecture Notebooks] [▶️Video]
Lecture 2: Introduction to Python — [📝Lecture Notebooks] [▶️Video]
Lecture 3: Introduction to NumPy — [📝Lecture Notebooks] [▶️Video]
Lecture 4: Introduction to pandas — [📝Lecture Notebooks] [▶️Video]
Lecture 5: Plotting Data — [📝Lecture Notebooks] [[▶️Vide

changhuixu

public async Task<string> DownloadFile(string guid)
{
    // validation
    _logger.LogInformation($"Downloading File with GUID=[{guid}].");
    var fileInfo = new FileInfo($"{guid}.txt");

    var response = await _httpClient.GetAsync($"{_url}/api/files?guid={guid}");
    response.EnsureSuccessStatusCode();
    await using var ms = await response.Content.ReadAsStreamAsync();
    await using var fs = File.Create(fileInfo.FullName);

bonniss

Github Search Cheat Sheet

GitHub’s search supports a variety of different operations. Here’s a quick cheat sheet for some of the common searches.

For more information, visit our search help section.

Basic search

louis-e

using System;
using System.Net;
using System.Net.Sockets;
using System.Text;

namespace UDP
{
    public class UDPSocket
    {
        public Socket _socket;