Recent content on HEV
Enable middle-click paste (primary selection) behavior in GNOME: 
 gsettings set org.gnome.desktop.interface gtk-enable-primary-paste true
 Reference: 
 https://gitlab.gnome.org/GNOME/gsettings-desktop-schemas/-/merge_requests/119
HevSocks5Tunnel 是一个高性能、低开销的 tun2socks 开源实现，从2.13.0版本开始支持Mapped DNS功能。 
 项目地址: https://github.com/heiher/hev-socks5-tunnel 
 Mapped DNS 
 在使用基于Tun的透明代理工具时，Mapped DNS是一个相当有用的功能，用于解决应用程序无法直接传递域名信息给代理的问题。 
 传统的Tun模式下，应用程序通常只会看到IP地址，而非原始的域名。这会导致代理工具无法根据域名进行规则匹配、分流或访问控制。为了弥补这一缺陷，HevSocks5Tunnel提供了Mapped DNS功能，结合Fake IP机制来实现“IP 与域名的映射还原”。 
 Mapped DNS的工作机制如下： 
 
…
When dealing with unstable systems, one often overlooked culprit is faulty RAM.
Faulty memory can cause random crashes, corrupted files, and a myriad of hard-to
-trace issues. While replacing bad RAM is the ideal solution, sometimes it’s not
immediately possible. In such cases, you can identify the defective memory regions
and prevent the operating system from using them by…
Btrfs backing filesystem 
 In host 
 systemd-nspawn --system-call-filter = '@keyring bpf' --network-bridge = br0 -b -D /path/to/container
 In container 
 /etc/docker/daemon.json 
 {
 'storage-driver' : 'btrfs' 
 }
 Any backing filesystem 
 In host 
 systemd-nspawn --system-call-filter = '@keyring bpf' --bind = /dev/fuse --network-bridge = br0 -b -D…
mkdir workspace; cd workspace
 
 wget https://github.com/cross-tools/musl-cross/releases/latest/download/loongarch64-unknown-linux-musl.tar.xz
 tar xf loongarch64-unknown-linux-musl.tar.xz
 
 git clone --recursive https://github.com/tianocore/edk2.git
 
 export PATH = ${ PWD } /loongarch64-unknown-linux-musl/bin: ${ PATH } 
 export PACKAGES_PATH = ${ PWD }…
cross-tools is a simple, lightweight project for making cross-compilation toolchain with {gnu, musl, mingw} libc. 
 GNU Cross 
 Project home 
 https://github.com/cross-tools/gnu-cross 
 Supported targets 
 
 
 
 Target 
 Kernel 
 Binutils 
 GCC 
 Glibc 
 
 
 
 
 aarch64-unknown-linux-gnu 
 5.4.293 
 2.45 
 15.1.0 
…
Add a TCP port forwarded from host 2200 to guest 22 : 
 virsh qemu-monitor-command Ubuntu --hmp --cmd 'hostfwd_add tcp::2200-:22' 

Hardware 
 
 CPU: AMD Ryzen 7950x 
 Motherboard: Gigabyte B650 Gaming X 1.0 
 RAM:
 
 Slot 0: 32GB DDR5-5200 XMP - Corsair CMK5X32G2B52C40A2 (2023-W29) 
 Slot 1: 32GB DDR5-5200 XMP - Corsair CMK5X32G2B52C40A2 (2022-W44) 
 Slot 2: 32GB DDR5-5200 XMP - Corsair CMK5X32G2B52C40A2 (2023-W29) 
 Slot 3: 32GB DDR5-5200 XMP - Corsair CMK5X32G2B52C40A2 (2022-W44) 
…
~/.cargo/config 
 [http]
proxy = 'socks5h://localhost:1080'
[https]
proxy = 'socks5h://localhost:1080'

SocksTun 是一个简单、轻量的Android VPN应用，它基于我之前开源的一个高性能、低开销的tun2socks项目实现，用于将手机端的TCP、UDP流量通过Socks5服务器转发。 
 
 特性支持 
 
 支持重定向 TCP 连接。 
 支持重定向 UDP 报文。(Fullcone NAT，UDP in UDP/TCP) 
 支持简单用户名/密码认证。 
 支持使用服务端DNS或指定DNS地址。 
 IPv4/IPv6双栈。 
 全局/按应用双重模式。 
 
 使用方法 
 服务端 
 HevSocks5Server服务端支持运行在Linux/BSD和macOS系统上，目前仅支持UDP in TCP。 
 git clone --recursive…
Welcome to HEV’s Blog! 
 Hello, I’m Hev! You might know me from my blog, where I share my thoughts, experiences, and projects related to technology, programming, and everything in between. I have a strong passion for creating lightweight, efficient, and open-source software solutions. Let me tell you a bit more about myself. 
 Who Am I? 
 I am a software developer and…
在RK3399低性能设备上对比了几款开源的tun2socks实现的最大传输性能和对应的CPU资源消耗情况，软件配置与 项目Benchmarks 相同。硬件配置为 
 
 绑定在两个大核上运行 
 物理网卡限速为1Gbps 
 
 结论是只有HevSocks5Tunnel可以几乎跑满物理网卡的最大带宽，并且对应的CPU资源使用最少。那么，基于它实现的Android VPN应该具有相对较好的节能效果吧。 
 Speed 
 
 CPU Usage 


 E-mail: aUBoZXYuY2M= 
 GitLab: https://gitlab.com/hev 
 GitHub: https://github.com/heiher 
 PGP: 0xDE8BBEBCEBBBDB92 ( ↷ ) 

HevSocks5Tunnel 是一个高性能、低开销的 tun2socks 开源实现，采用C语言编写、基于知名的轻量级用户态网络协议栈LwIP以及协程化IO调度处理技术。当前支持 Linux、Android、FreeBSD、Windows、macOS和iOS系统。与其它开源的tun2socks实现比较，目前的结果是传输速度更快，同时CPU、内存资源使用也比较少，运行稳定、可靠。 
 项目地址: https://github.com/heiher/hev-socks5-tunnel 
 功能 
 
 IPv4/IPv6 双栈。 
 支持重定向 TCP 连接。 
 支持重定向 UDP 报文。(Fullcone NAT，UDP over TCP/UDP) 
 
 性能 
 详细信息 
 传输速率 
…
Issue 
 The dnsmasq can’t start to running. 
 Why? The ujail is enabled by default on OpenWrt 22.03, and no privilege to do some jail operation in systemd-nspawn container. e.g. mount /tmp/xxx to /dev/log 
 How to fix 
 Uninstall procd-ujail. 
 opkg remove procd-ujail

What is stack clash style attacks? 
 计算机上运行的程序都需要一块特殊的内存区域称为“栈”，栈空间通常是动态单向增长的，以Linux内核为例，操作系统为了防止栈空间过早分配产生的内存浪费，采用了栈延迟分配策略，按Page粒度逐步向低地址扩展增长。栈可用空间最低地址位置上有个特殊的页称为Stack Guard Page，当访问到达该页时，将触发严重错误，使程序终止执行。 
 攻击者故意分配较大的栈空间，但不触发访问，可有可能跳过对Stack Guard Page的访问，如果精心安排，或运气较好，就有可能将低地址方向的其它内存区域作为栈来使用，从而有机会突破栈不可执行保护。 
 How to prevent? 
 GCC编译器实现了stack clash…

 
 
 From: https://www.cnblogs.com/codestack/p/14890786.html
Control-flow graph 
 
 
 (a) an if-then-else 
 (b) a while loop 
 (c) a natural loop with two exits, e.g. while with an if…break in the middle; non-structured but reducible 
 (d) an irreducible CFG: a loop with two entry points, e.g. goto into a while or for loop 
 
 Java case 
 IrreducibleLoop.java 
 public class IrreducibleLoop {
 public static void…
function put_route () { 
 ip route del default dev pppoe-wanct proto static table 100 
 ip route add default dev pppoe-wanct proto static table 100 
 ip rule del pref 32760 
 ip rule add pref 32760 from ${ 1 } lookup 100 
 } 
 
 put_route ${ ip } 

Issue 
 /usr/libexec/sftp-server: not found
 Fix 
 -O Use the legacy SCP protocol for file transfers instead of the SFTP
 protocol. Forcing the use of the SCP protocol may be necessary for
 servers that do not implement SFTP, for backwards-compatibility for
 particular filename wildcard patterns and for expanding paths with
 a ‘~’ prefix for older SFTP servers.

Issue 
 usb 1-3.4: USB disconnect, device number 18
usb 1-3.1: new full-speed USB device number 19 using xhci_hcd
usb 1-3.1: New USB device found, idVendor=1a86, idProduct=7523, bcdDevice= 2.54
usb 1-3.1: New USB device strings: Mfr=0, Product=2, SerialNumber=0
usb 1-3.1: Product: USB2.0-Ser!
ch341 1-3.1:1.0: ch341-uart converter detected
ch341-uart ttyUSB0: break…
nftables 
 udp dport { 80, 443 } reject with icmpx port-unreachable
 iptables 
 -p udp --match multiport --dports 80,443 -j REJECT

Show-how 
 
 From: https://www.scss.tcd.ie/Jeremy.Jones/VivioJS/caches/MESI.htm
src/hotspot/share/runtime/init.cpp: 
 jint init_globals ();
 void exit_globals ();

-XX:StartFlightRecording=dumponexit=true,disk=false,filename=dump.jfr

systemd-nspawn --tmpfs = /tmp:nosuid,size = 256M

The faccessat2 system call is denied by old systemd container, this is a workaround to make it works again and without re-build from source code. 
 faccessat function is a known way to use the faccessat2 system call in glibc, editing libc.so binary to fallback to the user-space implementation. 
 00000000000de3e0 <faccessat>:
 .....
 de448:	7100989f 	cmp	w4, #0x26
…
/etc/systemd/network/eth0.network: 
 [Match] 
 Name = eth0 
 
 [Network] 
 DHCP = yes 
 
 [Address] 
 Address = 104.21.64.95/32 
 
 [Address] 
 Address = 2606:4700:3037::ac43::1/64 

Socket options 
 IPv6 support some protocol-specific socket options that can be set with setsockopt and read with getsockopt. The socket option level for IPv6 is IPPROTO_IPV6. A boolean integer flag is zero with it is false, otherwise true. 
 IPV6_V6ONLY 
 If this flag is set to true (nonzero), then the socket is restricted to sending and receiving IPv6 packets only. In this case, an…
AA64: fmadd d, n, m, a: d = a + n * m
LA64: fmadd d, j, k, a: d = a + j * k

AA64: fmsub d, n, m, a: d = a + (-n) * m
 d = a - n * m
 d = - (n * m - a)
LA64: fnmsub d, j, k, a: d = - (j * k - a)
 d = a - j * k
 d = a + (-j) * k

AA64: fnmadd d, n, m, a: d = (-a) + (-n) * m
 d = - (n * m + a)
LA64: fnmadd d, j, k, a: d = - (j * k + a)
 d = (-a) +…
This is an example shows how to make IP address label persistent by systemd-networkd. 
 /etc/systemd/network/eth0.network: 
 [Match] 
 Name = eth0 
 
 [Network] 
 Address = 192.168.0.1/24 
 Gateway = 192.168.0.254 
 DNS = 192.168.0.254 
 
 [IPv6AddressLabel] 
 Label = 100 
 Prefix = 2409::/16 
 
 [IPv6AddressLabel] 
 Label = 100 
…
SafepointALot: Generate a lot of safepoints. This works with GuaranteedSafepointInterval. 
 HandshakeALot: Generate a lot of handshakes. This works with GuaranteedSafepointInterval. 
 DeoptimizeALot: Deoptimize at every exit from the runtime system. 
 ZombieALot: Create zombies (non-entrant) at exit from the runtime system. 
 WalkStackALot: Trace stack (no print) at every exit from…
The dnsmasq is enables rebind protection by default, this reject DNS records that contains reserved address (RFC1918). 
 Remove argument to disable it: 
 --stop-dns-rebind
 OpenWrt 
 Luci: 
 Menu: Network->DHCP and DNS 
 Unchecked Rebind protection.
The 64-bit ARM (AArch64) calling convention allocates the 31 general-purpose registers as:[2] 
 x31 (SP): Stack pointer or a zero register, depending on context.
x30 (LR): Procedure link register, used to return from subroutines.
x29 (FP): Frame pointer.
x19 to x29: Callee-saved.
x18 (PR): Platform register. Used for some operating-system-specific special purpose, or an…
make test JTREG = 'VERBOSE=all' ...
 make run-test JTREG = 'VERBOSE=all' 

~/.config/gtk-3.0/gtk.css: 
 /* Decrease the tabs bar height in gnome-terminal
 * See:
 * https://stackoverflow.com/questions/36869701/decrease-the-tabs-bar-height-in-gnome-terminal
 */ 
 
 terminal-window notebook > header . top button {
 padding : 0 0 0 0 ;
 background-image : none ;
 border : 0 ;
 margin-right : 10 px ;
 }
 
 terminal-window…
Handle interrupts of ethernet device on high performance cpus. 
 /etc/systemd/system/irq-eth0.service: 
 [Unit] 
 Description = IRQ SMP Affinity 
 After = network.target 
 
 [Service] 
 Type = oneshot 
 ExecStart = /usr/bin/bash -c 'echo 4-5 > /proc/irq/31/smp_affinity_list' 
 
 [Install] 
 WantedBy = multi-user.target 

Unable to negotiate with 192.168.0.1 port 22: no matching host key type found. Their offer: ssh-rsa
 Workaround: 
 Host 192.168.0.1
 HostkeyAlgorithms +ssh-rsa
 PubkeyAcceptedAlgorithms +ssh-rsa

‘Across the Great Wall, we can reach every corner in the world’
前段时间，在研究HLS的AES加密，由于一个地方电视台的HLS流有AES加密，在查看了相关的加解密方案后发现使用的是简单的AES的CBC模式，在CBC的模式下，会设置一个IV，初始化向量。但是我在解密的时候，使用了一个由于理解错误而产生的一个错误IV居然也能解密视频并进行播放，于是就有了这篇张文章。 
 AES五种加密模式（CBC、ECB、CTR、OCF、CFB） 
 虽然有五种加密，但是常用的还是CBC，CBC的全称Cipher Block Chaining ，有点类似于区块链哈，我们先来看下加密方式 
 CBC加密 
 
 上面的图片从左往右看，初始化IV只有在第一个块加密的时候才会用到，而第N个块的加密IV则是用的N-1(N>1)个加密后的二进制数组。 
 CBC解密 
 
…
sudo fallocate -l 100G /path/to/swap.img
 sudo chmod 0600 /path/to/swap.img
 sudo mkswap /path/to/swap.img


 
 Refer: https://wiki.nftables.org/wiki-nftables/index.php/Netfilter_hooks
This is an example of configuring transparent proxy(tproxy) with nftables. The tproxy application is hev-socks5-tproxy 
 Netfilter rules 
 DON’T FORGOT TO ADD UPSTREAM ADDRESS TO BYPASS IPSET!!
Or use nftables skuid/skgid match to exclude proxy process. 
 table inet mangle {
 set byp4 {
 typeof ip daddr
 flags interval
 elements = { 0.0.0.0/8, 10.0.0.0/8,
…
Enable bold font for GNOME Terminal: 
 0x01 
 # Get profile id 
 dconf dump /org/gnome/terminal/legacy/
 
 # Set bold font 
 dconf write /org/gnome/terminal/legacy/profiles:/:b1dcc9dd-5262-4d8d-a863-c897e6d979b9/font ''Monospace Bold 14'' 
 0x02 
 Preferences->Profiles->->Colors:
Select “Show bold text in bright colors”

 Open Settings. 
 Click Keyboard Shortcuts. 
 Click Alternate Characters Key. 
 Select Right Supter. 


 
 From: https://www.thomas-krenn.com/en/wiki/Linux_Storage_Stack_Diagram
IPv4 
 0.0.0.0/8
10.0.0.0/8
100.64.0.0/10
127.0.0.0/8
169.254.0.0/16
172.16.0.0/12
192.0.0.0/24
192.0.2.0/24
192.88.99.0/24
192.168.0.0/16
198.18.0.0/15
198.51.100.0/24
203.0.113.0/24
224.0.0.0/4
240.0.0.0/4
 IPv6 
…
By default an exception can only occur during a function call or a throw. If we needs to catch excpetions thrown from trapping instructions, using the -fnon-call-exceptions . 
 Docs 
 
 -fnon-call-exceptions 
 Generate code that allows trapping instructions to throw exceptions. Note that this requires platform-specific runtime support that does not exist everywhere. Moreover, it…