pankkor

macOS input monitoring aka spyware.

Inspect UI elements under the mouse.

Examples

UIElementInspector sample from 2010

https://developer.apple.com/library/archive/samplecode/UIElementInspector/Introduction/Intro.html Provides information of AXUIElements under the cursor via Accessibility API introduced in Mac OS X version 10.2.

Acessibility Inspector

pankkor

Snippets

Quickly limit resources for the process with ulimit

LIMIT_MB=50
(ulimit -Sv $((LIMIT_MB << 10)); /path/to/binary)

On OpenBSD use

pankkor

Linux Perf Tools

Materials used to write this gist.

• Linux Performance Analysis by Brendan Gregg
• perf tutorial
• perf examples

TL;DR

uptime

pankkor

i64 syscall1(i64 sys_num, i64 a0) {
  i64 ret;
  __asm__ volatile (
    "mov x16, %[sys_num]\n"
    "mov x0, %[a0]\n"
    "svc 0x80\n"
    "mov %0, x0\n"
    : "=r" (ret)
    : [sys_num] "r" (sys_num), [a0] "r" (a0)
    : "x16", "x0"

pankkor

// Counting sort algorithm
// https://en.m.wikipedia.org/wiki/Counting_sort
//
// Build clang:
//   clang -Wall -Wextra -Wpedantic -g counting_sort.c -o counting_sort
//
// Build gcc:
//   gcc -Wall -Wextra -Wpedantic -g counting_sort.c -o counting_sort

typedef int i32;

pankkor

static void test_asm(u8 *data, u64 bytes) {
#if defined(__aarch64__)
  __asm__ volatile (
      "cbz %[bytes], 1f\n\t"
      "mov x9, #0\n\t"
      "0: strb w9, [%[data], x9]\n\t"
      "add x9, x9, #1\n\t"
      "cmp %[bytes], x9\n\t"
      "b.ne 0b\n\t"
      "1:\n\t"

pankkor

#include <stdio.h>

#define STR1(s) # s
#define STR(s) STR1(s)

#define TEST_EXPECT(condition) test_expect(!!(condition), __FILE__ ":" STR(__LINE__) ": (" STR(condition) ") expected to be true\n")

static inline void test_expect(int condition, const char *msg) {
  if (!condition) {
    fputs(msg, stderr);

pankkor

#include <immintrin.h>

typedef unsigned int u32;
typedef unsigned char u8;

char check_grade(u8 score) {
  score = score > 100 ? 100 : score;

  __m128i scores = _mm_set1_epi8(score);
  __m128i brackets = _mm_set_epi8(89, 79, 69, 59, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F);

pankkor

Large, Huge, Super Pages

Linux Huge Pages

Transparent Huge Pages (THP) via madvice

Not covered here, see https://www.kernel.org/doc/Documentation/vm/transhuge.txt

Allocating huge pages using mmap

See https://www.kernel.org/doc/Documentation/vm/hugetlbpage.txt

Huge pages cannot be swapped out under memory pressure.

pankkor

# Check what ASLR protection do you have (typically 2)
cat /proc/sys/kernel/randomize_va_space

# Disable ASLR global
sysctl -w kernel.randomize_va_space=0

# Revert ASLR global
sysctl -w kernel.randomize_va_space=2

# Run <my_binary> with ASLR disabled (-R option)