richinseattle

Patching the IDA Pro 9.0 BETA

Note

Obligatory disclaimer: this is for educational purposes only. I am not responsible for any damages caused by following this guide, or using any of the script(s) herein.

This guide prioritizes arm64 macOS, but may also work for other platforms.

---

Step 1 - Patching dylibs

richinseattle

Original report

• Affected Vendor: OpenPrinting
• Affected Product: Several components of the CUPS printing system: cups-browsed, libppd, libcupsfilters and cups-filters.
• Affected Version: All versions <= 2.0.1 (latest release) and master.
• Significant ICS/OT impact? no
• Reporter: Simone Margaritelli [[email protected]]
• Vendor contacted? yes The vendor has been notified trough Github Advisories and all bugs have been confirmed:

• https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8

richinseattle

https://twitter.com/ShinyQuagsire/status/1536432635643211777 12:37 PM · Jun 13, 2022
-----
I figured out how to enable USB device mode on my XPS 13 (9350) 🎉

Though for some ungodly reason, it uses the right-side full USB port. So a crossover cable is required.
-----


https://twitter.com/ShinyQuagsire/status/1536434057671716864 12:43 PM · Jun 13, 2022
-----

richinseattle

base_model: meta-llama/Meta-Llama-3-70B
model_type: LlamaForCausalLM
tokenizer_type: AutoTokenizer

load_in_8bit: false
load_in_4bit: true
strict: false

datasets:
  - path: /home/migel/ai_datasets/tess-v1.5b-chatml.jsonl

richinseattle

rem USE AT OWN RISK AS IS WITHOUT WARRANTY OF ANY KIND !!!!!
rem https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/set-mppreference
rem To also disable Windows Defender Security Center include this
rem reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
rem 1 - Disable Real-time protection
reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

richinseattle

'''
IDA plugin to display the calls and strings referenced by a function as hints.

Installation: put this file in your %IDADIR%/plugins/ directory.
Author: Willi Ballenthin <[email protected]>
Licence: Apache 2.0
'''
import idc
import idaapi
import idautils

richinseattle

REM buffer overflows

REM call to unbounded copy functions (CWE-120, CWE-242, CWE-676)

weggli.exe -R "func=^gets$" "{$func();}" .
weggli.exe -R "func=st(r|p)(cpy|cat)$" "{$func();}" .
weggli.exe -R "func=wc(s|p)(cpy|cat)$" "{$func();}" .
weggli.exe -R "func=sprintf$" "{$func();}" .
weggli.exe -R "func=scanf$" "{$func();}" .

richinseattle

Semgrep

Semgrep default rulesets https://semgrep.dev/r

semgrep --config "p/c" <path/to/code>

raptor's Semgrep rules and blog

• https://security.humanativaspa.it/semgrep-ruleset-for-c-c-vulnerability-research

richinseattle

#!/bin/bash

# bashGPT - [email protected]

[ "${OPENAI_API_KEY}" == "" ] && echo "Please set OPENAI_API_KEY env variable" && exit
[ "$(which jq)" == "" ] && echo "Please install the jq program" && exit
[ "$(which curl)" == "" ] && echo "Please install the curl program" && exit
PROMPT="$1"

while true

richinseattle

// memdjpeg - A super simple example of how to decode a jpeg in memory
// Kenneth Finnegan, 2012
// blog.thelifeofkenneth.com
//
// After installing jpeglib, compile with:
// cc memdjpeg.c -ljpeg -o memdjpeg
//
// Run with:
// ./memdjpeg filename.jpg
//