samy kamkar samyk

4 Steps in Running LLaMA-7B on a M1 MacBook

The large language models usability

The problem with large language models is that you can’t run these locally on your laptop. Thanks to Georgi Gerganov and his llama.cpp project, it is now possible to run Meta’s LLaMA on a single computer without a dedicated GPU.

Running LLaMA

There are multiple steps involved in running LLaMA locally on a M1 Mac after downloading the model weights.

Chat GPT "DAN" (and other "Jailbreaks")

Twitter allows users to download parts of their data, see How to download your Twitter archive.

But what's not included in that data dump is the usernames/handles of the people that you follow or are following you. All you get is account IDs which is just an internal number and so a bit useless when it comes to archival.

Here's a way to get that data (you need to know how to run stuff in the terminal):

Go to your Twitter profile in a desktop browser (Firefox or Chrome)
Right click on page → Inspect → Network tab
Click on the Following link (e.g. https://twitter.com/{yourusername}/following)

Postviewer - writeup

Challenge's overview

The rumor tells that adm1n stores their secret split into multiple documents. Can you catch 'em all? https://postviewer-web.2022.ctfcompetition.com

The challenge consisted of an all client-side simple page, i.e. no backend code was involved. A user can upload any file which will be then locally stored in indexedDB. They can preview their files by either clicking on the title or by visiting file's URL, for example https://postviewer-web.2022.ctfcompetition.com/#file-01d6039e3e157ebcbbf6b2f7cb2dc678f3b9214d. The preview of the file is rendered inside a blob created from data: URL. The rendering occurs by sending file's contents to the iframe via postMessage({ body, mimeType }, '*')

Additionally, there is a /bot endpoint which lets players send URLs to an xss-bot imitating another user. The goal is to steal their documents.

What's nonce entanglement?

Beginning with devices using an A12 SoC or higher, Apple introduced nonce entangling.

This meant that, when saving SHSH blobs, a nonce generator would generate a different ApNonce for each device.
When saving SHSH blobs for an A12+ device, you now must find a generator-ApNonce pair for your device, then use that generator-ApNonce pair when saving SHSH blobs.
After you have found a generator-ApNonce pair for your device, you can save it and re-use it whenever you save SHSH blobs again.

Getting a generator-ApNonce pair (jailbroken)

(iOS 14+ only) Install an iOS kernel r/w library.
- On Taurine, install libkernrw.

On unc0ver, install libkrw.

	#define _WIN32_WINNT 0x0502
	#define WINVER 0x0502
	#include <windows.h>
	#include <errhandlingapi.h>
	#include <process.h>
	#include "beacon.h"

	WINBASEAPI PVOID WINAPI KERNEL32$AddVectoredExceptionHandler (ULONG First, PVECTORED_EXCEPTION_HANDLER Handler);
	DECLSPEC_IMPORT uintptr_t __cdecl MSVCRT$_beginthreadex(void _Security,unsigned _StackSize,_beginthreadex_proc_type _StartAddress,void _ArgList,unsigned _InitFlag,unsigned *_ThrdAddr);
	DECLSPEC_IMPORT void __cdecl MSVCRT$_endthreadex(unsigned _Retval);

	/*
	BPG-400 gauge reader

	Copyright 2022 Andrey T.

	Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
	The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWAR

	/**
	* Color conversion algorithms (RGB, HSL, XYZ, LAB, LCH)
	* Derived from jQuery Color Picker Sliders by István Ujj-Mészáros
	* Licensed under the Apache License 2.0
	* https://github.com/istvan-ujjmeszaros/jquery-colorpickersliders
	*/

	export function rgbToHsl(rgb) {
	const r = rgb.r / 255
	const g = rgb.g / 255

	import Foundation
	import NearbyInteraction
	import MultipeerConnectivity
	import Combine

	var numberFormatter: NumberFormatter {
	let numberFormatter = NumberFormatter()
	numberFormatter.roundingMode = .halfEven
	numberFormatter.maximumFractionDigits = 3
	numberFormatter.minimumFractionDigits = 3