Disconnect3d disconnect3d

Course name: Cryptography 1 URL: https://class.coursera.org/crypto-007/class

Lectures

Week 1

Course Overview (11 min)

HTTPS is actually not a protocol of its own. It’s simply regular HTTP on top of SSL/TLS.

Container security notes

Internet references

Kernel and architecture

namespaces - overview of Linux namespaces http://man7.org/linux/man-pages/man7/namespaces.7.html
mount_namespaces - overview of Linux mount namespaces

Goals

This documents tries to address some concerns with enabling PIE.

Argument 1

One of the criticism of "Using PIE by default on AMD64" is,

32-bit ELF binary

how to assemble and link:

nasm -f elf32 -o <filename>.o <filename>.asm
ld -m elf_i386 -o <filename> <filename>.o

template code (hello world):

section .text
global _start

How to make a Release Android App debuggable

Let's say you want to access the application shared preferences in /data/data/com.mypackage.
You could try to run adb shell and then run-as com.mypackage ( or adb shell run-as com.mypackge ls /data/data/com.mypackage/shared_prefs), but on a production release app downloaded from an app store you're most likely to see:

run-as: Package 'com.mypackage' is not debuggable

Debug with GDB on macOS 11

The big reason to do this is that LLDB has no ability to "follow-fork-mode child", in other words, a multi-process target that doesn't have a single-process mode (or, a bug that only manifests when in multi-process mode) is going to be difficult or impossible to debug, especially if you have to run the target over and over in order to make the bug manifest. If you have a repeatable bug, no big deal, break on the fork from the parent process and attach to the child in a second lldb instance. Otherwise, read on.

Install GDB

Don't make the mistake of thinking you can just brew install gdb. Currently this is version 10.2 and it's mostly broken, with at least two annoying bugs as of April 29th 2021, but the big one is https://sourceware.org/bugzilla/show_bug.cgi?id=24069

$ xcode-select install  # install the XCode command-line tools

	#!/usr/bin/env python2
	# -- coding: utf-8 --

	# The 300 challenge was a heap challenge that allowed you to make allocations of size 0x300.
	# You could free allocations and read/write to them even after they got freed.
	# The tricky part about the challenge was that you don't control the size and can't for example use the usual fastbin techniques.

	# This exploit overwrites the check_action variable so that the libc doesn't abort on errors anymore.
	# Afterwards we can get a write-what-where primitive using unsafe unlink.

	from subprocess import Popen, PIPE
	import pty
	import os
	from select import select
	import sys
	import tty

	master, slave = pty.openpty()
	p = Popen(['python'], stdin=slave, stdout=PIPE, stderr=PIPE)
	pin = os.fdopen(master, 'w')