Youfu Zhang zhangyoufu

Go (Golang) GOOS and GOARCH

All of the following information is based on go version go1.17.1 darwin/amd64.

GOOS Values

GOOS	Out of the Box
`aix`	✅
`android`	✅

Dumping the flash of the Syscan 2015 badge

The badge of the Syscan 2015 conference included an ARM-based STM32F030R8 processor running some challenges. Although SWD pins are accessible on the badge, some have noted that the STM32 is readout-protected, meaning that it will refuse to dump its flash memory.

Fortunately, two researchers (Johannes Obermaier and Stefan Tatschner) recently published a paper at the WOOT '17 conference, in which they reveal a vulnerability allowing to bypass the readout protection. Their technique allows to dump the flash one DWORD at a time, rebooting the CPU between each access.

I implemented this attack using a BusPirate and the PySWD module. Here is a quick'n dirty PoC to

LD_PRELOAD this as a library to output a binary's output from syslog() on stderr as well as any syslog daemon that's listening (useful for Docker, if you want all log output to be collected by Docker's standard output handling.) Beware though, if the program changes its stderr file descriptor (closes it, points it at /dev/null, pipes it out to a socket), this can have surprising results. For example, when I tried this with cyrus-imapd, I was getting syslog output sent to remote clients because stderr and stdout were remapped that way (not maintaing the original fd that Docker set up.)

Example Docker implementation

COPY syslog2stderr.c /build
RUN gcc -fPIC -shared /build/syslog2stderr.c -o /usr/local/lib/syslog2stderr.so
RUN echo /usr/local/lib/syslog2stderr.so &gt;&gt; /etc/ld.so.preload

	# Information in this script was obtained from public sources, and not under NDA with NXP.

	# GPShell style APDU commands, but you should be able to adapt it to anything that can send raw APDU's to the card
	# Our TK Key
	00A4040010C238E449F725B1510EAA699550CABA16

	# Reset card to factory defaults - THIS WILL WIPE OUT ALL APPLETS INSTALLED
	00F00000

	# Set the Card to use T=1 transmission mode

	import ida_netnode

	"""
	You can also switch the shell into IDC mode and enter del_user_info().
	You can also edit your `~/ida-x/cfg/ida.cfg` and set `STORE_USER_INFO` to `NO`.
	"""


	# This will replace the original user blob with the evaluation version blob.
	ORIGINAL_USER = \

	#!/usr/bin/env bash

	# Скрипт по загрузке публичных файлов с Облака mail.ru. Поддерживается докачка.
	# v1.0.5 от 2022-05-30
	#
	# ЕСЛИ СКРИПТ НЕ РАБОТАЕТ
	#
	# 1. Убедитесь, что файл доступен публично. Возможна загрузка только публичных файлов.
	# 2. Mail.ru время от времени меняет внутрянку, не очень сильно, но требуется адаптация скрипта.
	# Если скрипт не работает, просьба сделать работающий форк и скинуть ссылку в комментарии.

	== Visual Studio .NET 2003 (DO NOT COPY THIS LINE) ==
	Microsoft Visual Studio Solution File, Format Version 8.00
	# Visual Studio .NET 2003
	VisualStudioVersion = 7.1


	== Visual Studio 2005 (DO NOT COPY THIS LINE) ==
	Microsoft Visual Studio Solution File, Format Version 9.00
	# Visual Studio 2005
	VisualStudioVersion = 8.0

	Permission is hereby granted, free of charge, to any person obtaining a copy
	of this software and associated documentation files (the "Software"), to deal
	in the Software without restriction, including without limitation the rights
	to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
	copies of the Software, and to permit persons to whom the Software is
	furnished to do so, subject to the following conditions:

	The above copyright notice and this permission notice shall be included in all
	copies or substantial portions of the Software.

	/*
	* Copyright (c) 1996, 1998, Oracle and/or its affiliates. All rights reserved.
	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	*
	* This code is free software; you can redistribute it and/or modify it
	* under the terms of the GNU General Public License version 2 only, as
	* published by the Free Software Foundation. Oracle designates this
	* particular file as subject to the "Classpath" exception as provided
	* by Oracle in the LICENSE file that accompanied this code.
	*