summaryrefslogtreecommitdiff
path: root/haunt/posts
diff options
context:
space:
mode:
authorJakob L. Kreuze <zerodaysfordays@sdf.org>2024-07-13 17:55:47 -0400
committerJakob L. Kreuze <zerodaysfordays@sdf.org>2024-07-13 17:55:47 -0400
commit7f37518e4792f040a753a5d8d68d51e76cc0b2be (patch)
treeaf2c8dc358f97094a6c7e10a0aadcc21ad8a5cc5 /haunt/posts
parent5474f016ddec56542999f8ee6c0d6c887dee75e8 (diff)
Initial migration to org-reader
Long-term I would like to merge the =posts-assets= and =posts= directories but currently Haunt will crash if something exists in the =posts= directory that can't be processed by a reader
Diffstat (limited to 'haunt/posts')
-rw-r--r--haunt/posts/bad-behavior.org4
-rw-r--r--haunt/posts/making-your-own-music-player.org2
-rw-r--r--haunt/posts/reverse-engineering-babbys-first-archive-format.org8
-rw-r--r--haunt/posts/sdl-tutorial-part-0x00.org4
4 files changed, 9 insertions, 9 deletions
diff --git a/haunt/posts/bad-behavior.org b/haunt/posts/bad-behavior.org
index a5c9dbe..a8658ff 100644
--- a/haunt/posts/bad-behavior.org
+++ b/haunt/posts/bad-behavior.org
@@ -157,7 +157,7 @@ about in a little bit. Let's jump in and craft a BEHAVIOR lump which calls
=PUSHBYTE= a bunch of times.
#+CAPTION: A screenshot of my terminal showing an abrupt end to the debug prints I added for inspecting the absolute memory addresses of SStack and VStack.
-[[./debug-prints.png]]
+[[./bad-behavior-debug-prints.png]]
We seem to end prematurely, which is because we hit the stack pointer. We will
have to modify our exploit to step over it somehow, which we can do by
@@ -185,4 +185,4 @@ disclosing this to the development team, we discovered that vanilla Hexen has
this same arbitrary code execution vulnerability. No proof-of-concept yet.
#+CAPTION: One of my posts in an internal discussion on the GZDoom forums regarding the same exploit existing in the vanilla Hexen code.
-[[./vanilla-hexen-vulnerability.png]]
+[[./bad-behavior-vanilla-hexen-vulnerability.png]]
diff --git a/haunt/posts/making-your-own-music-player.org b/haunt/posts/making-your-own-music-player.org
index cf5cbac..f96d4a5 100644
--- a/haunt/posts/making-your-own-music-player.org
+++ b/haunt/posts/making-your-own-music-player.org
@@ -26,7 +26,7 @@ instantaneous representation of the signal some number of times a second. The
image below does a good job of explaining it, I think.
#+CAPTION: Diagram showing the difference between an analog sine wave and a quantization of that wave.
-[[./analog-vs-digital.png]]
+[[./making-your-own-music-player-analog-vs-digital.png]]
The rate at which the signal is sampled or quantized is the *frequency*. 44.1
kHz is typically the standard - meanining that 441,000 samples are taken every
diff --git a/haunt/posts/reverse-engineering-babbys-first-archive-format.org b/haunt/posts/reverse-engineering-babbys-first-archive-format.org
index 1f69b5a..d817e30 100644
--- a/haunt/posts/reverse-engineering-babbys-first-archive-format.org
+++ b/haunt/posts/reverse-engineering-babbys-first-archive-format.org
@@ -24,7 +24,7 @@ editor and went at it, with the [[https://github.com/vn-tools/arc_unpacker/blob/
it.
#+CAPTION: A hex dump of the XP3 header.
-[[./xp3-header.png]]
+[[./reverse-engineering-babbys-first-archive-format-xp3-header.png]]
The first section of the archive is the header. It begins with an 11-byte
"magic number," used by whatever program is opening it as a sanity check. It's
@@ -59,7 +59,7 @@ Huffman Coding, so let's use zlib! I proceeded to inflate the archive contents
according to the header and dumped it so that I could view it in my hex editor.
#+CAPTION: Sections in the hexdump of the decompressed payload with the corresponding constants in the Arc source code.
-[[./binary-dump.png]]
+[[./reverse-engineering-babbys-first-archive-format-binary-dump.png]]
Every entry has a header containing a 32-bit magic number (underlined in red),
followed by a 64-bit unsigned integer representing the size of the entry. It's a
@@ -80,7 +80,7 @@ a compressed and decompressed size, and what seems to be an MD5 hash of the
file.
#+CAPTION: A screenshot of my terminal, showing the output of a bare-bones parser for the format.
-[[./basic-parsing.png]]
+[[./reverse-engineering-babbys-first-archive-format-basic-parsing.png]]
Now we run into the problem of the files' contents being encrypted. I began by
getting a debugger setup going to reverse engineer the binary. x64dbg isn't my
@@ -89,7 +89,7 @@ was really able to get working. Of course, using the debugger alone is a little
primitive. We have other tools to make reverse engineering easier.
#+CAPTION: A screenshot of procmon alongside x32dbg, logging Windows syscalls that read files.
-[[./catching-file-reads.png]]
+[[./reverse-engineering-babbys-first-archive-format-catching-file-reads.png]]
Enter procmon. It's reminiscent of strace, but it's meant for Windows and has a
nice stack trace feature which helps us to locate the code that decrypts the
diff --git a/haunt/posts/sdl-tutorial-part-0x00.org b/haunt/posts/sdl-tutorial-part-0x00.org
index dab5990..83cee0f 100644
--- a/haunt/posts/sdl-tutorial-part-0x00.org
+++ b/haunt/posts/sdl-tutorial-part-0x00.org
@@ -173,7 +173,7 @@ your computer can take a short break. Alright. So when we put that in our code
it, we get this:
#+CAPTION: A screenshot of the window on my system.
-[[./window.png]]
+[[./sdl-tutorial-part-0x00-window.png]]
I'm running i3wm, so it will probably look slightly different for you, but
we've finally got a window! It still sucks, though. It doesn't do anything,
@@ -278,7 +278,7 @@ int main(int argc, char *argv[]) {
Let's run it:
#+CAPTION: A screenshot of the completed window on my system.
-[[./finished-window.png]]
+[[./sdl-tutorial-part-0x00-finished-window.png]]
To recap, we learned about: