ker2x

ker2x

echo "--- TZDATA ---"
echo "tzdata tzdata/Areas select Europe" > /tmp/preseed.txt
echo "tzdata tzdata/Zones/Europe select Paris" >> /tmp/preseed.txt
debconf-set-selections /tmp/preseed.txt
rm /etc/timezone
rm /etc/localtime
apt-get install -y tzdata
rm /tmp/preseed.txt

ker2x

/*************************************************

        4Display Shield Library Example
        Code: Oscar Gonzalez December 2010
        www.BricoGeek.com
  
	Copyright(c) December 2010 Oscar Gonzalez - www.BricoGeek.com

	http://code.google.com/p/displayshield4d/

ker2x

using System.Collections;
using System.Collections.Generic;
using UnityEngine;

public class MainScript : MonoBehaviour
{
    Terrain terrain;
    TerrainData terrainData;
    GameObject terrainObject;
    Material terrainMaterial;

ker2x

#include "Game.h"

    /// <summary>
    /// init, loop, quit. easy.
    /// </summary>
    void Game::run() {
        std::cout << "Game run()\n";

        initWindow();   // Init some GLFW stuff and other misc
        initVulkan();   // The important part, Vulkan

ker2x

#include <iostream>
#include <d3d12.h>
#include <dxgi1_4.h>
#include <tchar.h>

LRESULT WINAPI WndProc(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam)
{
    return ::DefWindowProc(hWnd, msg, wParam, lParam);
}

ker2x

		private static void RenderFunc(int y, int w, int h, int nbSamples,
			                           Vector3 eye, Vector3 gaze,
									   Vector3 cx,  Vector3 cy,
									   IList<Vector3> vList, Rng rng) {

			var luminance = new Vector3();
			for (var x = 0; x < w; ++x) {									// row
				for (int sy = 0, i = (h - 1 - y) * w + x; sy < 2; ++sy) {	//column
					for (var sx = 0; sx < 2; ++sx) {						//subpixel row
						luminance.Zero();

ker2x

(Extracted from my main diary)

Exploring CVE-2021-3156 @ home

This is what i understood :

• You can use multiple line in argument by escaping with \
• Sudo ignore the character following \
• what if \ is the last character ? it ignores \0 (NULL) and read stuff it shouldn't read because the null terminator is ignored.

ker2x

(extracted from the main diary)

Playing with PMA Labs

• Let's start with Lab01-01.exe.
• i'm even using IDE Free 70 instead of my licensed version.
• According to "detect it easy" it's a 32bits PE executable, unpacked, compiled with MSVC 6.0
• Opening it in IDA with default option
• Only the EntryPoint is exported, it import kernel32 and msvcrt
• Some usefull strings

ker2x

(extracted from main diary)

2021/11/10 : Exploring emotet

• SHA256 : 878d5137e0c9a072c83c596b4e80f2aa52a8580ef214e5ba0d59daa5036a92f8
• Probably the scariest trojan of the current days. Let's explore it. I using ghidra again.
• According to ghidra, the only import is KERNEL32.DLL::WTSGetActiveConsoleSessionId
• I wonder what it can possibly be with so little and i'll have to find out.
• The obvious step for now is to find out how it load other functions to be able to do anything.