Skip to content

Instantly share code, notes, and snippets.

View jun-lsh's full-sized avatar

june jun-lsh

19 followers · 4 following
View GitHub Profile
@jun-lsh
jun-lsh / MagistrPayload.cpp
Created February 20, 2024 14:19
A Naive Implementation of the Magistr/Shoerec Payload
#include <Windows.h>
#include <ExDisp.h>
#include <atlbase.h>
#include <Shlwapi.h>
#include <atlalloc.h>
#include <ShlObj.h>
#include <cmath>
#include <vector>
#include <algorithm>
#include <string>
@jun-lsh
jun-lsh / TEEs_and_the_Blockchain.md
Created July 30, 2024 13:21
A short writeup on what TEEs are and their potential applications (and non-applications) to blockchain projects.

What Exactly Are TEEs?

Before we can discuss the application of TEEs for blockchain related programs, we first have to establish what Trusted Execution Environments (TEEs) are.

At a high level, TEEs can be described as an isolated processing environment found on the CPU, a sort of separate secure area where whatever code and data enters remains confidential, where processes outside of a TEE cannot read or tamper with the data within it. These private regions of memory are known as enclaves.

By running code in this isolated, tamper-resistant processing environment, it "guarantees the authenticity of the executed code", where remote attestation can be provided to prove its trustworthiness to a third-party and untrusted code should not be able to interfere with the execution of a program within the TEE.

Ref: "Trusted Execution Environment: What It is, and What It is Not", Sabt et al.

Remote Attestation

@jun-lsh
jun-lsh / exploit.c
Created January 20, 2026 14:54
UofTCTF 2026 - extended-eBPF exploit
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <fcntl.h>
#include <signal.h>
#include <string.h>
#include <stdint.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <sys/ioctl.h>
@jun-lsh
jun-lsh / voyage.py
Created May 31, 2026 10:59
claire code boat movemint script
"""2bird2can — voyage: wind-pump + leapfrog relay in one process.
The loop (the original strategy, just with correct boat-id tracking):
1. spawn a boat; let it ride the leaked wind until it gets STUCK
2. spawn a NEW boat (BOTH alive now -> the new one anchors to the old frontier,
spawning ~10u away via GetSpawnPositionForJoin)
3. after a short delay (--handoff-ms), during which we LEARN the new boat's id,
kill the old boat (so the new one becomes the oldest and the NEXT spawn
anchors to it -> the frontier walks forward)
4. the new boat is now the frontier; let it ride until it stucks; repeat
@jun-lsh
jun-lsh / solve.py
Created May 31, 2026 12:53
2bird2can solve script
#!/usr/bin/env python3
import argparse
import concurrent.futures
import functools
import hashlib
import math
import os
import re
import struct
import subprocess