diff options
| author | Jakob L. Kreuze <zerodaysfordays@sdf.org> | 2024-07-13 17:55:47 -0400 |
|---|---|---|
| committer | Jakob L. Kreuze <zerodaysfordays@sdf.org> | 2024-07-13 17:55:47 -0400 |
| commit | 7f37518e4792f040a753a5d8d68d51e76cc0b2be (patch) | |
| tree | af2c8dc358f97094a6c7e10a0aadcc21ad8a5cc5 /haunt/posts | |
| parent | 5474f016ddec56542999f8ee6c0d6c887dee75e8 (diff) | |
Initial migration to org-reader
Long-term I would like to merge the =posts-assets= and =posts= directories but
currently Haunt will crash if something exists in the =posts= directory that
can't be processed by a reader
Diffstat (limited to 'haunt/posts')
| -rw-r--r-- | haunt/posts/bad-behavior.org | 4 | ||||
| -rw-r--r-- | haunt/posts/making-your-own-music-player.org | 2 | ||||
| -rw-r--r-- | haunt/posts/reverse-engineering-babbys-first-archive-format.org | 8 | ||||
| -rw-r--r-- | haunt/posts/sdl-tutorial-part-0x00.org | 4 |
4 files changed, 9 insertions, 9 deletions
diff --git a/haunt/posts/bad-behavior.org b/haunt/posts/bad-behavior.org index a5c9dbe..a8658ff 100644 --- a/haunt/posts/bad-behavior.org +++ b/haunt/posts/bad-behavior.org @@ -157,7 +157,7 @@ about in a little bit. Let's jump in and craft a BEHAVIOR lump which calls =PUSHBYTE= a bunch of times. #+CAPTION: A screenshot of my terminal showing an abrupt end to the debug prints I added for inspecting the absolute memory addresses of SStack and VStack. -[[./debug-prints.png]] +[[./bad-behavior-debug-prints.png]] We seem to end prematurely, which is because we hit the stack pointer. We will have to modify our exploit to step over it somehow, which we can do by @@ -185,4 +185,4 @@ disclosing this to the development team, we discovered that vanilla Hexen has this same arbitrary code execution vulnerability. No proof-of-concept yet. #+CAPTION: One of my posts in an internal discussion on the GZDoom forums regarding the same exploit existing in the vanilla Hexen code. -[[./vanilla-hexen-vulnerability.png]] +[[./bad-behavior-vanilla-hexen-vulnerability.png]] diff --git a/haunt/posts/making-your-own-music-player.org b/haunt/posts/making-your-own-music-player.org index cf5cbac..f96d4a5 100644 --- a/haunt/posts/making-your-own-music-player.org +++ b/haunt/posts/making-your-own-music-player.org @@ -26,7 +26,7 @@ instantaneous representation of the signal some number of times a second. The image below does a good job of explaining it, I think. #+CAPTION: Diagram showing the difference between an analog sine wave and a quantization of that wave. -[[./analog-vs-digital.png]] +[[./making-your-own-music-player-analog-vs-digital.png]] The rate at which the signal is sampled or quantized is the *frequency*. 44.1 kHz is typically the standard - meanining that 441,000 samples are taken every diff --git a/haunt/posts/reverse-engineering-babbys-first-archive-format.org b/haunt/posts/reverse-engineering-babbys-first-archive-format.org index 1f69b5a..d817e30 100644 --- a/haunt/posts/reverse-engineering-babbys-first-archive-format.org +++ b/haunt/posts/reverse-engineering-babbys-first-archive-format.org @@ -24,7 +24,7 @@ editor and went at it, with the [[https://github.com/vn-tools/arc_unpacker/blob/ it. #+CAPTION: A hex dump of the XP3 header. -[[./xp3-header.png]] +[[./reverse-engineering-babbys-first-archive-format-xp3-header.png]] The first section of the archive is the header. It begins with an 11-byte "magic number," used by whatever program is opening it as a sanity check. It's @@ -59,7 +59,7 @@ Huffman Coding, so let's use zlib! I proceeded to inflate the archive contents according to the header and dumped it so that I could view it in my hex editor. #+CAPTION: Sections in the hexdump of the decompressed payload with the corresponding constants in the Arc source code. -[[./binary-dump.png]] +[[./reverse-engineering-babbys-first-archive-format-binary-dump.png]] Every entry has a header containing a 32-bit magic number (underlined in red), followed by a 64-bit unsigned integer representing the size of the entry. It's a @@ -80,7 +80,7 @@ a compressed and decompressed size, and what seems to be an MD5 hash of the file. #+CAPTION: A screenshot of my terminal, showing the output of a bare-bones parser for the format. -[[./basic-parsing.png]] +[[./reverse-engineering-babbys-first-archive-format-basic-parsing.png]] Now we run into the problem of the files' contents being encrypted. I began by getting a debugger setup going to reverse engineer the binary. x64dbg isn't my @@ -89,7 +89,7 @@ was really able to get working. Of course, using the debugger alone is a little primitive. We have other tools to make reverse engineering easier. #+CAPTION: A screenshot of procmon alongside x32dbg, logging Windows syscalls that read files. -[[./catching-file-reads.png]] +[[./reverse-engineering-babbys-first-archive-format-catching-file-reads.png]] Enter procmon. It's reminiscent of strace, but it's meant for Windows and has a nice stack trace feature which helps us to locate the code that decrypts the diff --git a/haunt/posts/sdl-tutorial-part-0x00.org b/haunt/posts/sdl-tutorial-part-0x00.org index dab5990..83cee0f 100644 --- a/haunt/posts/sdl-tutorial-part-0x00.org +++ b/haunt/posts/sdl-tutorial-part-0x00.org @@ -173,7 +173,7 @@ your computer can take a short break. Alright. So when we put that in our code it, we get this: #+CAPTION: A screenshot of the window on my system. -[[./window.png]] +[[./sdl-tutorial-part-0x00-window.png]] I'm running i3wm, so it will probably look slightly different for you, but we've finally got a window! It still sucks, though. It doesn't do anything, @@ -278,7 +278,7 @@ int main(int argc, char *argv[]) { Let's run it: #+CAPTION: A screenshot of the completed window on my system. -[[./finished-window.png]] +[[./sdl-tutorial-part-0x00-finished-window.png]] To recap, we learned about: |