Recent content on rink.nu
I think my first introduction to Codeberg was about 1.5 years ago, when it was mentioned by a CCC talk. If I remember correctly, the presenter was mainly concerned with Microsoft ’s acquisiting and involvement of GitHub . Having used GitHub since 2015, before it became part of Microsoft, I did not see an immediate need to act: it suited my purposes just fine and I did not feel that strongly…
Introduction A few weeks ago, I was replaying an old ‘90-ies adventure game and… I got stuck. I decided to look up online hints, and remembered the https://www.uhs-hints.com website (back in the early 2000s, this used to be a very relevant resource). Unfortunately, the game I was playing didn’t have the hints available online.
Why? This is a let’s turn my notes into a post writing. I like to pick up NetWare-related reverse engineering endeavors every now and then, and most of these involve having a NetWare 3.12 server available somewhere. In current day and age, that means a VM or emulator. I like to use QEMU, so I’ll be using that.
Note: this is a contributed post by Jens Heine binbash@gmx.net – please reach out to him if there any questions or comments! And a big “thank you” from me (Rink) for your contribution! This firmware modification is mainly inspired from another HOWTO from Rink’s blog where he hacked a FI9853EP . First get access to a TTY console on the mainboard of the cam. There are 4 contacts in…
Previously, we’ve made our version of std::move_only_function<> generic so that it can be used to store any function signature, regardless of the number of parameters or return type. The implementation we’ve ended up with is the following: cpp 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 template < typename…
Introduction Previously, we’ve seen a way to implement our own version of std::move_only_function<> . The implementation we ended up with is as follows:
Introduction Recently, a chat with a friend peeked my interested: how would you store an arbitrary function and call it, similar to std::function<> . It turned out a plain C function pointer would suffice for this specific use-case, but I got triggered: let’s implement a generic, move-only function wrapper in C++!
In my last post , I examined how to get U-Boot access and obtain the flash data from a Foscam FI9853EP camera. Whereas this data is very useful for offline analysis, I wanted to get a root shell so I can poke around in the system and run commands manually. Extracting the root filesystem Last time, we extracted a file called kernel.mtd , which contains an U-Boot uImage with the kernel itself. There…
I have a Foscam FI9853EP, which was introduced in 2014 and has long since been obsoleted. One of the things that stands out, is that all firmware is encrypted: sh 1 2 $ file FosIPC_B_patch_ver2.x.2.31_3_20190718_150013.bin FosIPC_B_patch_ver2.x.2.31_3_20190718_150013.bin: openssl enc ' d data with salted password 1 2 $ file FosIPC_B_patch_ver2.x.2.31_3_20190718_150013.bin…
Recently, a coworker pointed me towards a C++17 library to convert enumeration values to strings and vice versa. The library called (magic_enum)[https://github.com/Neargye/magic_enum] and it indeed feels like magic. I was immediately curious: how did they pull this off? The code I am presenting here can be seen as a massively down-scaled version of magic_enum : the approach taken is exactly the…
Way back when, I was involved in trying to obtain passwords for a Novell NetWare 3.12 server. I won’t go into details here, suffice to say that the topic has always interested me – sufficiently to return to it 30-ish years later and write down an algorithm description. The research presented here is based on my independent disassembly of the embedded server.nlm in NetWare 3.12. I have…
I decided to take a look into the NetWare 386 filesystem, which was used in NetWare 3.x and 4.x and perhaps later versions as well. This post serves to give a high-level background on the design and layout. Tools to analyze and extract content from such a filesystem can be found at https://github.com/zhmu/nwfs386 If you have any corrections, additional information or questions, please reach out to…
I wanted to update the binutils/gcc-based compiler toolchain of my Dogfood operating system. This entry describes some concepts and the changes that needed to be made in order to add this target to binutils 2.39 and gcc 12.2.0. Configuration targets Most of the GNU autotools work with configuration targets, which have the form <cpu>-<vendor>-<os> , where <os> can be <system> or <kernel>-<system> .…
Hello world! Hi, I’m Rink and I like to tinker with technology in my spare time. Feel free to check out my Codeberg repositories where I publish most of my work these days.