nothing interesting
The year is 2026. The Programming Language Holy Wars are still going, and the much anticipated blog post from Bun (JavaScript runtime) creator Jarred Sumner about using Claude to translate the code from Zig to Rust has sent people into a frenzy. Before continuing any further: if you have a hobby project which you choose to write in $lang because you enjoy it, and are aware it has some sharp edges…
This post is a follow-up to part 1 of my adventure in reverse engineering a unique file format present in early Unreal Engine titles. In particular, it looks at Splinter Cell 1 for the original Xbox and explores my attempts to understand the container format, reverse engineering the binary, and writing custom patches that got the game to spill its secrets. If you've already read that post,…
# Getting Into Security In middle school the gateway drug known as Halo 3 and unapproved mods shared on the game's File Share system got me interested in programming and security. Through these mods and YouTube tutorials I discovered the (long defunct) Xbox-Tampers forum, followed tutorials on how to edit map files in a hex editor and make very basic MSN Messenger nudge bomb applications, and…
Splinter Cell (2002) was one of the first games I had on the original Xbox and still remains one of my favorite games of all time. The game was developed by Ubisoft using Unreal Engine 2 -- licensed from a small indie dev called Epic Games who continues to use and license its game engine technology for contemporary small-budget indie games such as Fortnite and Halo: Campaign Evolved . I got into…
jj (jujutsu) is a newish git-compatible version control system that has some fresh ideas and a pretty great CLI UX (compared to git ). I had a moment recently where I hadn't yet committed my changes and while attempting to format the code I inadvertently made my diff way larger than it should have been. Here's what happened: I made some changes that I was quite happy with and did a quick…
Emma ( @carrot_c4k3 ) is a good friend of mine. We met in 2007 from the Xbox 360 scene and have remained friends ever since. She recently participated in pwn2own in the Windows LPE category and ended up using a great bug for LPE. The bug far exceeded the category though: this vulnerability was also a sandbox escape , i.e. it's in an NT syscall which is reachable from the UWP sandbox. A couple…
In the late 2000s and early 2010s my friends and I were living and breathing Xbox hacking. We were heavily interested in game betas, internal tools, and in general exploring everything the console had to offer. In 2010 -- or maybe 2011? the dates are getting blurry to me -- my friend Emma ( @carrot_c4k3 ) was reverse engineering how the Xbox 360 dashboard worked in order to get Hulu Plus on her…
# Context A couple months back I read "C isn't a Hangover; Rust isn't a Hangover Cure" ( original Medium link ) by John Viega. I responded to the post already on Twitter (sometimes known as X) and in hindsight should have just written a blog post to begin with since the platform is so terrible for longform comment. What follows is hopefully a more organized, digestable, and better…
# Background This blog post is something I'm writing 3 years after my initial research/development, and about 2 years after I stopped actively working on the tool. Some of the details in this blog may not be fully accurate from time slippage and a lot of the initial research notes I made were lost or scattered in Discord conversations. I am only now writing this as the game is somewhat…
# ASAN Primer If you're already an ASAN expert, feel free to skip to the next section. AddressSanitizer (ASAN) is an extremely useful tool in software testing, debugging, and security testing for finding memory safety issues in native applications. It's extremely straightforward to use on most platforms -- all you need to do is pass -fsanitize=address to clang/gcc and run the…
# Background Ham radios are a fun way of learning how the radio spectrum works, and more importantly: they're embedded devices that may run weird chips/firmware! I got curious how easy it'd be to hack my Yaesu FT-70D, so I started doing some research. The only existing resource I could find for Yaesu radios was someone who posted about custom firmware for their Yaesu FT1DR . The…
Last Updated: April 5, 2017 to address some incompleteness and errors. You can view the revision history here . Application Services is a framework in iOS and OS X which provides what's known as the Image I/O framework. ImageIO itself is a collection of utilities and data types for parsing various image formats. It's used in many OS X and iOS applications including: Tweetbot Safari…
The phpBB team released phpBB version 3.1.7-PL1 on Jan 11, 2016 which fixed a CSRF issue I found in the admin control panel BBCode creation form. Since BBCode is basically whitelisted HTML created by admins this CSRF vulnerability could allow an attacker to inject arbitrary HTML or JavaScript into forum posts. This was my first time looking at phpBB and I was very happy with actually being able to…
# Overview Recently the Symfony project published a security advisory to the SecureRandom class in their Security component that affects Symfony versions 2.3.0-2.3.36, 2.6.0-2.6.12, 2.7.0-2.7.8. On most sane systems there is no problem, but in the event that something goes wrong the SecureRandom::nextBytes() falls back to a custom random number generator which creates insecure random numbers. #…