This study focuses on the strategies used by the "xz backdoor", an extremely
complex piece of malware that contains its own x64 disassembler inside of it
to find critical locations in your code and hijacks it by swapping out your
code with its own as it runs. Because this a machine-code based attack,
all code written in any program language can be attacked and is vulnerable.
Instead of targeting sshd directly, the xz
backdoor injects itself in the parent systemd process then hijacks the
GNU Dynamic Linker (ld), before sshd is even started or libcrypto.so is
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
package main | |
import ( | |
"fmt" | |
) | |
type content struct { | |
children []content | |
id int | |
} |
TLDR version: People who were obsessed*
about simplifying things created a coding pattern that is overtly complex to do a chore that is brain-dead simple.
* Developers drowning in object taxonomies, mainly.
So, anyway...
One thing that really grinds my gears while writing safexz is the ByteReader antipattern. Consider this:
IIRC this pattern first appeared in Smalltalk or Objective-C then found its way over to Java into (what I call) a Nastypattern™:
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
package archive | |
import ( | |
"errors" | |
"strings" | |
"time" | |
) | |
// ArchiveRecord is a struct that represents a header record in the archive file | |
// The archive file is a binary file that contains multiple ArchiveRecords, |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
package archive | |
import ( | |
"os" | |
"testing" | |
"time" | |
) | |
func TestNewArchiveRecordWithData(t *testing.T) { | |
// Create an archive record with data |