Nofix

160 posts

Nofix banner
Nofix

Nofix

@N0Fix

interested in rust, malware, hypervisors and deobfuscation https://t.co/iePUc0Lgtu

Katılım Eylül 2018
388 Takip Edilen643 Takipçiler
Sabitlenmiş Tweet
Nofix
Nofix@N0Fix·
Hello twitter, made an IDA script/plugin to comment your decompiled Rust code with... Rust source code ! It fetches panic information and reads fetch the associated source code to print it to you in the form of a comment. github.com/N0fix/IDA_rust…
Nofix tweet media
English
0
5
18
1K
Nofix retweetledi
Conar.app
Conar.app@conar_app·
We probably need to start transitioning to the new name...
Conar.app tweet media
English
190
357
7.5K
506.5K
Nofix retweetledi
Petr Beneš
Petr Beneš@PetrBenes·
Ever wanted to draw a triangle with OpenGL as a 2kb position-independent shellcode? No? Me neither. But you can do it anyway: github.com/wbenny/scfw
English
0
31
148
10.2K
Nofix retweetledi
Andrej Karpathy
Andrej Karpathy@karpathy·
In today's episode of programming horror... In the Python docs of random.seed() def, we're told "If a is an int, it is used directly." [1] But if you seed with 3 or -3, you actually get the exact same rng object, producing the same streams. (TIL). In nanochat I was using the sign as a (what I thought was) clever way to get different rng sequences for train/test splits. Hence gnarly bug because now train=test. I found the CPython code responsible in cpython/Modules/_randommodule.c [2], where on line 321 we see in a comment: "This algorithm relies on the number being unsigned. So: if the arg is a PyLong, use its absolute value." followed by n = PyNumber_Absolute(arg); which explicitly calls abs() on your seed to make it positive, discarding the sign bit. But this comment is actually wrong/misleading too. Under the hood, Python calls the Mersenne Twister MT19937 algorithm, which in the general case has 19937 (non-zero) bits state. Python takes your int (or other objects) and "spreads out" that information across these bits. In principle, the sign bit could have been used to augment the state bits. There is nothing about the algorithm that "relies on the number being unsigned". A decision was made to not incorporate the sign bit (which imo was a mistake). One trivial example could have been to map n -> 2*abs(n) + int(n < 0). Finally this leads us to the contract of Python's random, which is also not fully spelled out in the docs. The contract that is mentioned is that: same seed => same sequence. But no guarantee is made that different seeds produce different sequences. So in principle, Python makes no promises that e.g. seed(5) and seed(6) are different rng streams. (Though this quite commonly implicitly assumed in many applications.) Indeed, we see that seed(5) and seed(-5) are identical streams. And you should probably not use them to separate your train/test behaviors in machine learning. One of the more amusing programming horror footguns I've encountered recently. We'll see you in the next episode. [1] docs.python.org/3/library/rand… [2] #L321C13-L321C30" target="_blank" rel="nofollow noopener">github.com/python/cpython…
Andrej Karpathy tweet media
English
216
493
7.9K
763.2K
Hex-Rays SA
Hex-Rays SA@HexRaysSA·
🔌 Allow us to introduce the new IDA Plugin Manager. Now, with a few simple commands, you can access a modern, self-service plugin ecosystem. Discover and get discovered more easily. hex-rays.com/blog/introduci…
Hex-Rays SA tweet media
English
1
25
114
13.7K
Nofix retweetledi
Synacktiv
Synacktiv@Synacktiv·
Impressive work from our team today at #Pwn2Own! Mehdi and Matthieu just pulled off an exploit on the Philips Hue Bridge without laying a finger on the device! Great demonstration of Synacktiv’s offensive expertise 👏 Come on 🔥
Synacktiv tweet media
English
3
11
91
5.7K
Nofix
Nofix@N0Fix·
What's a good reason to put relevant information of your file format at the end of the file ? It makes it so hard to find if anything goes wrong or if the file gets concatenated somehow
English
0
0
1
106
Nofix retweetledi
Phrack Zine
Phrack Zine@phrack·
Hey @ProtonPrivacy, why are you cancelling journalists and ghosting us. Need help calibrating your moral compass❓ First therapy session is for free 😘 Regarding #article" target="_blank" rel="nofollow noopener">phrack.org/issues/72/7_md…
Phrack Zine tweet media
English
59
250
1.3K
177.9K
HeroCTF
HeroCTF@HeroCTF·
🔥HeroCTF v7 is back at the end of November! 🚩You can now register your team on CTFtime 🔗 ctftime.org/event/2869 More information to come soon.
GIF
English
1
12
26
1.8K
Nofix retweetledi
Synacktiv
Synacktiv@Synacktiv·
🔐 Data encryption in Laravel environments is based on one secret: the APP_KEY. Our ninja @_remsio_ studied the impact of its leakage on the internet during an entire year. synacktiv.com/en/publication…
English
2
38
90
8.8K
Nofix
Nofix@N0Fix·
@JershMagersh Eh, I guess they have enough manpower to create code that belongs to them Sad they do not contribute to open source !
English
0
0
1
175
Nofix
Nofix@N0Fix·
Ah, yes, "rendezvoused"
Nofix tweet media
English
1
0
4
323
Nofix
Nofix@N0Fix·
I got a new small blog post about oddities I encountered while working on rustbinsign: reproducing builds of old Tokio crate fails ! You can read more about why this happens and how to work around that here: nofix.re/posts/2025-08-…
English
0
5
11
781
Nofix retweetledi
Petr Beneš
Petr Beneš@PetrBenes·
After 6 years, I made a blog thingy again. This time about MmScrubMemory. An innocuous looking function that has bitten my ass several times in the last several years. And if you're developing a hypervisor, it might've bitten yours, too. wbenny.github.io/2024-11-21-mms…
English
4
27
97
10K