Matt Ehrnschwender

459 posts

Matt Ehrnschwender banner
Matt Ehrnschwender

Matt Ehrnschwender

@M_alphaaa

Security person who likes writing code

Katılım Ağustos 2020
208 Takip Edilen924 Takipçiler
Matt Ehrnschwender
Matt Ehrnschwender@M_alphaaa·
@0xTriboulet ifconfig works by parsing /proc and using socket ioctl calls but parsing /proc is slow and there was no way to extend the ioctl structs without breaking ABI. Linux 2.2 released netlink which is a dedicated replacement for the ioctl issues and what the new net tools use
English
1
0
11
296
Matt Ehrnschwender
Matt Ehrnschwender@M_alphaaa·
@NotNordgaren @0xrepnz @0xTriboulet Yeah that is typically the better option. Using globals in a plugin system is way more limiting than allowing the plugin to allocate a user data struct which gets passed in to an unload function at the end
English
0
0
1
29
The Bingus Man
The Bingus Man@NotNordgaren·
@M_alphaaa @0xrepnz @0xTriboulet Like so they can unload the plugin and then rebuild and reload. Every plugin system I have ever used has just had an unload function for this. IDK why they want to rely on global static destructors. Sounds like a nightmare.
English
1
0
1
17
Ori Damari
Ori Damari@0xrepnz·
You thought rust avoids memory leaks? Think again - In rust, global variables are leaked by design. This means that practically there is no 'safe' way to use Rust in a dynamic library that can unload - if some third party crate decides to use a global variable it won't be freed. Maybe someone here has experience dealing with it?
English
2
0
4
1.7K
Matt Ehrnschwender
Matt Ehrnschwender@M_alphaaa·
@0xrepnz @0xTriboulet @NotNordgaren If the library is absolutely needed then I would open up an issue about it. Depending on what is easiest, I would either ask about adding an API which allows freeing up global state or creating an API that does not rely on it
English
1
0
2
28
Matt Ehrnschwender
Matt Ehrnschwender@M_alphaaa·
@0xrepnz @0xTriboulet @NotNordgaren Yes I have experienced this. The ways I have dealt with it are by not using parts of the crate which rely on global state or finding a way to free it from the public API. If that is not possible, I will just not use the library but reimplement the functionality I need
English
2
0
2
40
vaxry
vaxry@vaxryy·
@kqx_io this absolutely falls into the "what the hell even led to this code being needed" territory to me, doing bit operations on pointers, man I'm sure there was some reason but dang this is really "this shit's gonna explode" territory
English
3
1
178
11.7K
kqx
kqx@kqx_io·
How a single typo led to RCE in Firefox Can you spot the bug? Read now at: kqx.io/post/firefox0d…
kqx tweet media
English
6
93
637
147.2K
Matt Ehrnschwender
Matt Ehrnschwender@M_alphaaa·
Still have a lot of things to clean up and many other features to add but the core parts of it are there
English
0
0
3
95
Matt Ehrnschwender retweetledi
Max Harley
Max Harley@0xdab0·
I'm really proud of what Shane and I did here. I'm biased, but from the results I've seen, this is a hugely scalable way to improve offsec models. It took a ton of engineering work to get it working, but the results speak for itself.
dreadnode@dreadnode

We fine-tuned an 8B model to pop a GOAD domain…using only synthetic training data. No real networks. No frontier model distillation. Just a world model that simulates AD environments and generates realistic pentesting trajectories. See how @shncldwll and @0xdab0 did it: dreadnode.io/blog/worlds-a-…

English
6
14
68
8K
Matt Ehrnschwender
Matt Ehrnschwender@M_alphaaa·
@0xTriboulet Based on this "The loop to check the character exits early when the character is correct..." I assume the original implementation wasn't even constant-time at all 💀
English
0
0
1
23
Steve S.
Steve S.@0xTriboulet·
You could pull out the comparison into a function, slap this on, and #ifdef the MSVC equivalent. That’s more readable and makes it portable across all major compilers learn.microsoft.com/en-us/cpp/prep… Volatiles seems like a good idea too, wonder if they tried that instead. Wasn’t clear from the article
English
1
0
1
66
Matt Ehrnschwender retweetledi
Zig
Zig@ziglang·
Bypassing Kernel32.dll for Fun and Nonprofit #2026-02-03" target="_blank" rel="nofollow noopener">ziglang.org/devlog/2026/#2…
English
36
74
865
335.4K
Matt Ehrnschwender retweetledi
Rick de Jager
Rick de Jager@rdjgr·
May I present to you; a full copy of doom, running inside of a Rollercoaster Tycoon 1 save game exploit ✨ Thanks for everyone that came to check out our @DistrictCon Junkyard talk! We had a lot of fun putting it together. (check the thread for slides / exploit)
English
67
753
8.8K
300.1K
Matt Ehrnschwender retweetledi
wallfacer
wallfacer@simplylurking2·
AI-slopped a functional C2 for an app's Lua plugin (no stdlib Lua) in about 24hrs~ had to use the app-specific network libs provided to accomplish a transport. Functions: change sleep, run more Lua in mem, module output, exit/uninstall - most of what u need on a longhaul persist
wallfacer tweet media
English
0
3
16
1.2K
Matt Ehrnschwender
Matt Ehrnschwender@M_alphaaa·
Pushed up a few small fixes for boflink. Currently working on some other improvements which should make writing BOFs in higher level languages like C++/Rust/Zig a lot more feasible without needing to add various different compiler/source code tricks github.com/MEhrn00/boflin…
English
1
2
4
233
Matt Ehrnschwender
Matt Ehrnschwender@M_alphaaa·
@codex_tf2 Btw, you can use `boflink --mingw64 ...` to query MinGW GCC for the list of library search paths instead of hard coding `-L/usr/x86_64-w64-mingw32/lib`. MinGW GCC may install libraries in a different location depending on the platform
English
2
0
2
95
CodeX
CodeX@codex_tf2·
if anyone is too lazy to learn to use @M_alphaaa 's boflink and doesnt want to fight MSVC to stop using funny sections in your bofs, heres a drop in replacement for the TrustedSec BOF template that uses boflink (standalone) in the makefile github.com/CodeXTF2/bof_t…
English
2
16
78
4K
Matt Ehrnschwender
Matt Ehrnschwender@M_alphaaa·
@NotNordgaren Typcial annoying C things. The initialization here would normally set all of the elements to 0 but since this is a VLA, it does other things. I'm not familiar with them so I'm not sure what the rules are with initialization
English
2
0
1
118
The Bingus Man
The Bingus Man@NotNordgaren·
@M_alphaaa Neat. Yea, I didn't know in C const declared variables with constant numbers aren't const.
English
1
0
1
126
The Bingus Man
The Bingus Man@NotNordgaren·
This is probably one of the biggest misunderstood features and source of confirmation bias in the C language. Who can tell my why this does not do what most people think it does?
The Bingus Man tweet media
English
147
20
647
207.7K

Keşfet

@0xTriboulet @NotNordgaren @0xrepnz @vaxryy @kqx_io @elonmusk @BarackObama @taylorswift13