Aleksei Kulaev flatz

Starting

Command	WinDbg	LLDB
Start	`windbg {executable} [{args}]`	`lldb {executable} [--args]`
Attach	`windbg -p {pid}`	`lldb --attach-pid {pid}`

Symbols and modules

Command	WinDbg	LLDB
(Re)load symbols	`lb {module-name}`	`target symbols add {symbol-file-path}`

Use previous/older SDKs with Xcode

Since monterey update does not allow us to use Xcode previous than 13, let's show how to "install previous SDKs"

Needed

Swift toolchains, from https://swift.org/download/

Previous Xcode.xip, from the https://developer.apple.com

MS-MSDT 0-day Office RCE

MS Office docx files may contain external OLE Object references as HTML files. There is an HTML sceme "ms-msdt:" which invokes the msdt diagnostic tool, what is capable of executing arbitrary code (specified in parameters).

The result is a terrifying attack vector for getting RCE through opening malicious docx files (without using macros).

Here are the steps to build a Proof-of-Concept docx:

Open Word (used up-to-date 2019 Pro, 16.0.10386.20017), create a dummy document, insert an (OLE) object (as a Bitmap Image), save it in docx.

Checking your Raspberry Pi's view of its power supply

Sometimes it seems like the first (and sometimes only) advice you get offered for almost any problem with a Raspberry Pi is "check your power supply". You think something like:

"hey, I'm using an official power supply sold as being matched with my Pi so how can there be any problem?"

You look up the specs then stick a controlled load across your supply and confirm that it can deliver the required number of Watts.

Yet your problems persist…

Here, I'll show you how to compile Frida for both rootfull and rootless jailbreaks.

TL;DR

~~On Dopamine/Fugu15 Max or palera1n you can add my repo (open the link in your favorite browser on your jailbroken iDevice).~~

~~The DEBs you will install are build using the following instructions.~~

Update 2024-02-29

Chat GPT "DAN" (and other "Jailbreaks")

How to Use

In Ghidra's Project Tool, Go to Tools -> Import Tool..., select mistyCodeBrowser.tool
Dragging file onto the new CodeBrowser_1 in ToolChest

	import requests
	import time
	import sys
	from base64 import b64encode
	from requests_ntlm2 import HttpNtlmAuth
	from urllib3.exceptions import InsecureRequestWarning
	from urllib import quote_plus

	requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

	function sleep( sleepDuration ){
	var now = new Date().getTime();
	while(new Date().getTime() < now + sleepDuration){ /* do nothing */ }
	}
	function gc() {
	for (let i = 0; i < 0x10; i++) {
	new ArrayBuffer(0x1000000);
	}
	}
	let data_view = new DataView(new ArrayBuffer(8));

	// To compile: clang++ -arch x86_64 -arch arm64 -std=c++20 library_injector.cpp -lbsm -lEndpointSecurity -o library_injector,
	// then codesign with com.apple.developer.endpoint-security.client and run the
	// program as root.

	#include <EndpointSecurity/EndpointSecurity.h>
	#include <algorithm>
	#include <array>
	#include <bsm/libbsm.h>
	#include <cstddef>
	#include <cstdint>