Max mxms0

randomware

SECCON 2016 quals

description

300 points
My PC suddenly got broken. Could you help me to recover it please?
NOTE: The disk can be virus-infected. DO NOT RUN any programs extracted from the disk outside of sandbox.
disk.qcow2.zip
Challenge files is huge, please download it first. Password will release after 60min.
password: h9nn4c2955kik9qti9xphuxti

XNU syscall path

Chart

             +------------------+
             |These push their  |                                  +-----------------------+
             |respective syscall|                                  |This overwrites the    |
             |dispatch functions|                                  |saved dispatch function|
             |onto the stack    |                                  |with hndl_alltraps     |

These links no longer work. Springer have pulled the free plug.

Graduate texts in mathematics

duplicates = multiple editions

A Classical Introduction to Modern Number Theory, Kenneth Ireland Michael Rosen

	@interface MyStringProxy : NSProxy

	@property (nonatomic) NSString *target;

	@end


	@implementation MyStringProxy

	- (BOOL)respondsToSelector:(SEL)aSelector {

	'''
	IDA plugin to display the calls and strings referenced by a function as hints.

	Installation: put this file in your %IDADIR%/plugins/ directory.
	Author: Willi Ballenthin <[email protected]>
	Licence: Apache 2.0
	'''
	import idc
	import idaapi
	import idautils

	void callEntryPointOfImage(char path, int argc, char *argv)
	{
	void *handle;
	int (binary_main)(int binary_argc, char *binary_argv);
	char *error;
	int err = 0;

	printf("Loading %s…\n", path);

	handle = dlopen (path, RTLD_LAZY);

	/*
	american fuzzy lop - LLVM instrumentation bootstrap
	---------------------------------------------------

	Written by Laszlo Szekeres <[email protected]> and
	Michal Zalewski <[email protected]>

	LLVM integration design comes from Laszlo Szekeres.

	Copyright 2015 Google Inc. All rights reserved.

	-- MarI/O by SethBling
	-- Feel free to use this code, but please do not redistribute it.
	-- Intended for use with the BizHawk emulator and Super Mario World or Super Mario Bros. ROM.

	if gameinfo.getromname() == "Super Mario World (USA)" then
	Filename = "DP1.state"
	ButtonNames = {
	"A",
	"B",
	"X",

	(** Value-Set Analysis / Value-Set Arithmetic

	See Gogul Balakrishnan's thesis at
	http://pages.cs.wisc.edu/~bgogul/Research/Thesis/thesis.html

	TODO:
	* Alternate memstore implementation
	* Add a real interface; automatically call simplify_cond
	* Big int support
	* Idea: Use copy propagation information to maintain equivalence

	main(argc, argv)
	int argc;
	char *argv[];
	{
	int i;

	argc--;
	for(i=1; i<=argc; i++)
	printf("%s%c", argv[i], i==argc? '\n': ' ');
	}