Vulnerability Discovery, Mitigation and Exploitation.
ctypes.sh , our quest to build a toolkit for interacting with native code directly from bash scripts, has reached version 1.1. Apart from the standard bug fixes and improvements, the major enhancement in this release is automatic structure support . Wait, what? First some background, ctypes.sh is similar to the python ctypes module , but for bash. If you’ve ever wanted to access native libraries…
I remember being blown away by the QNX 1.44M demo as a teenager, it had a really big impact on me. At one time, I had even configured fvwm to look like QNX Photon. Here is a real screenshot of my desktop from May 2004 (an old configuration file of mine is still on the fvwm site): Curious about what RIM have been doing with QNX since the acquisition, I bought a BlackBerry Q10 . If you connect a…
On most modern Linux systems, /bin/sh is provided by bash, which detects that it's being invoked as sh, and attempts to mimic traditional sh. As everyone who works in security quickly learns, bash will drop privileges very early if uid != euid. 488 489 if (running_setuid && privileged_mode == 0) 490 disable_priv_mode (); 491 Where disable_priv_mode is defined as: 1202 void 1203 disable_priv_mode…
A few months ago, I mentioned a crash I'd encountered under memory pressure on windows. I was hoping sharing a reproducer might stimulate someone who was interested in learning about kernel debugging to investigate, learning some new skills and possibly getting some insight into researching security issues, potentially getting a head start on discovering their own. Sadly, I've yet to hear back…
If you've been programming in C or a similar language for any period of time, you've inevitably had to pick up some of the esoteric intricacies of the underlying hardware. Defined behaviour doesn't always protect you, and can sometimes be surprising. One of my favourite examples is how divide errors work on the Intel architecture, simply because it always surprises developers who've never seen it…
A few years ago while working on Windows sandboxing, I noticed a few relatively minor problems with Job Objects , Desktops and related facilities. I reported them to Microsoft, who said they don't consider these supported security boundaries and declined to fix them, but this was no big deal and I dropped the issue. The chrome security guys developed techniques to workaround some of these bugs in…
Believe it or not, RAR files can contain bytecode for a simple x86-like virtual machine called the RarVM. This is designed to provide filters (preprocessors) to perform some reversible transformation on input data to increase redundancy, and thus improve compression. For example, one filter (likely inspired by LZX , an earlier scheme with a similar feature ) is called "Intel E8 preprocessing",…