Cryptogenic

'''
IDA AMD PSP/ASP binary loader
@SpecterDev
'''
import binascii
import ida_idp
import idaapi
import idc
import struct

Cryptogenic

#!/usr/bin/env python3

'''
Script to parse an MSR protection map from a binary dump
@SpecterDev
'''
import argparse
import os

# Support hex int args

Cryptogenic

Note: unprotected MSRs are marked as "is NOT protected"
-
MSR 00000000 protected: READ & WRITE
MSR 00000001 protected: READ & WRITE
MSR 00000002 protected: READ & WRITE
MSR 00000003 protected: READ & WRITE
MSR 00000004 protected: READ & WRITE
MSR 00000005 protected: READ & WRITE
MSR 00000006 protected: READ & WRITE
MSR 00000007 protected: READ & WRITE

Cryptogenic

/*
 * IP6_EXTHDR_CHECK Double Free (CVE-2020-9892) Exploit PoC for FreeBSD 9.0
 * https://github.com/google/security-research/security/advisories/GHSA-gxcr-cw4q-9q78
 * -
 * Bug credit: Andy Nguyen (@theflow0)
 * Exploit credit: @SpecterDev, @tihmstar
 * Thanks: @sleirsgoevy, @littlelailo, flatz (@flat_z), @balika011
 * -    
 * Build: gcc -o expl ip6_expl_poc.c -pthread
 * -

Cryptogenic

Keybase proof

I hereby claim:

• I am cryptogenic on github.
• I am specterdev (https://keybase.io/specterdev) on keybase.
• I have a public key ASD9F865WA_doc1a6dFzkxNBC7xlFJBXEApkAQc2jGt8hQo

To claim this, I am signing this object:

Cryptogenic

Packet Listing

Packets are used to communicate between the HTML5 client and the Golang server. The official listing for these packets can be found below. For non-login (L) packets - a token is required which is received when logging in. This token not only ensures that the user is authenticated, but it also ensures that players cannot send packets to the server on behalf of other players without their token.

It should be noted that sometimes packets will be received without an initial request. These have specific listeners setup on the client side. It should also be noted that an E packet can be sent in replace of the typical response for any request if an error occured while processing the request on the server.

Finally, the original sender's ID in both the client -> server and server -> client case pass the ID in the header - therefore it is not needed in the data parameters (with the exception of the server sending the ID in the login response packet).

E Packet (Error)

Cryptogenic

#!/usr/bin/python

import sys
import struct
import argparse

def swap32(i):
  return struct.unpack("<I", struct.pack(">I", i))[0]

filename = None

Cryptogenic

Keybase proof

I hereby claim:

• I am Cryptogenic on github.
• I am specterdev (https://keybase.io/specterdev) on keybase.
• I have a public key whose fingerprint is 42D4 2D2B 692B 4272 7278 82AC EA69 985A 957B 3AA2

To claim this, I am signing this object: