Foreword

I’ve been building a little tool for assisting with the reverse-engineering of compressed archive files, primarily for game hacking: Refriender

This blog post is a stream-of-consciousness look at how I actually went about reverse-engineering a file format (the BSA archives used in Skyrim Special Edition, specifically, though it’s used in lots of Bethesda titles). I make mistakes, I make bad assumptions, and I don’t complete the entire reverse-engineering process, though I do cover the majority of it! This format is well-documented (by modders), but I intentionally didn’t look at any of that until after I completed this. This is my honest, raw approach to analyzing the file I picked.

Process

Pick the smallest BSA file (‘Skyrim - Textures8.bsa’ from Skyrim Special Edition, md5sum 3ca6cbfcfca7b41f3939352d4cb27717 if you want to follow along! Also, a hexdump of the first 0xf20...

Originally published 2014-10-27

He steps into a classroom. He steps into his lab. He steps into an airport. He steps into the future, each step happening beside each step. But the question remains: who is he?

When the second ‘he’ came into the picture, morning rituals were the first to have to change; he figured that he could get away with one toothbrush, as long as all of him didn’t use it at once. Parallel lives increased productivity, but scheduling resources became more complex with each new ‘him’. After all, once you’ve had a taste of the future, it’s hard to stop.

Three bodies, three locations, all capable of independent thought and with their own working memory. This wasn’t terribly out of the ordinary – most companies had been paying for body doubles for years, to aid in productivity. What he had over the other phyclones was a simple – and yet essential – modification: a...

I often find myself needing good random numbers in shaders, but this gets messy when you want to generate a bunch of different ones for each pixel. To get around this, I’m using a genuinely awful hack in DaeForth.

Implementation

:m rand-given-seed (| seed |)
        [ seed seed 1141 * sin ]
        [ 12.9898 78.233 ]
    dot sin 43758.5453 * fract
;
@float global =pixel-seed
real-position /rand-given-seed \+ =pixel-seed
:m seed .7 rand-given-seed ;
:m gen-seed
    seed =>cur-seed
    cur-seed rand-given-seed =>next-seed
    [ next-seed ] &seed def-macro
    cur-seed
;
:m next-random gen-seed pixel-seed * store rand-given-seed ;

Each time you call next-random it generates a new, high-quality random number for the given pixel. Importantly, it does so with low overhead at runtime!

Example

For instance, this generates two random colors and then mixes them randomly (for a total of 7...

The Android Debug Bridge, ADB, contains a long-standing vulnerability. It can have a rather severe impact, but only under some pretty unusual circumstances. Tl;dr: Executing an adb pull command against a malicious Android device or ADB daemon can lead to arbitrary file writes, pretty easily escalating to code execution.

ADB Architecture

There are three notable pieces worth discussing, when it comes to ADB:

• Device-side ADB server (this runs on your Android device and facilitates debugging, running shells, etc)
• ADB daemon (this runs on your machine on port 5037 and talks to the device side, acting as a dumb proxy)
• ADB client (this talks to the ADB daemon)

Pull process

We’re going to examine what happens if you run a simple pull command: adb pull /foo

1. The ADB client (hereafter just referred to as ADB) attempts to connect to localhost:5037
   • If it fails to connect, the ADB daemon...

I’m frequently asked how I go about building a successful CTF and while I’ve tried to answer this in the past (generally on Twitter), I’ve never actually gone in-depth on it. So today we’re going to talk about what makes a CTF successful.

A word of warning: I’m writing this entirely from my own experience as a CTF builder, not as much of a CTF player. While I’ve participated in a couple over the years, I’m actually quite bad at them in most cases and need significantly more practice (… and free time) to change that. Additionally, I’m only going to be talking about “jeopardy-style” CTFs (a term I absolutely despise!) wherein tasks are laid out and the players win by completing those tasks. With that warning out of the way…

So You Want To Build A CTF

Before you write a single line of code or start designing challenges, you need to ask yourself one question: when the players are done...

I have a few goals for my bug bounty work in 2019:

• $50k in total bounties/bonuses
• (ACHIEVED!) At least one $5k bounty (for reference, current best is $4802)
• At least half my reports rated high/critical (CVSS 7+)
• Blog about my progress monthly, with a continuously updated entry for each month

Update

I’ve really had a hard time with this lately. I burnt out pretty bad in May and took some time off from bug bounty and didn’t really get started again until hacker summer camp, back in August. I’ll try to update more frequently.

Goal Health

Current total earnings for the year: $48679

This is 97.358% of my goal for the year. By the end of September I should be at $37500 to be on track, putting me $11179 ahead as of 2019-09-21

Lifetime Stats

• 29 bounties paid
• 6 bonuses paid
• $59641 total earned
• $1970 average bounty

Bugs

• CRITICAL Discovered 2019-08, Paid 2019-09 by Verizon Media –...

For the past few years, I’ve been working on an intermittent research project. My hypothesis is this: it’s possible to create a CPU description from which you can generate disassemblers, decompilers, interpreters, recompilers, and more. A single CPU description could be used for any number of independent projects, without all the bullshit that typically comes with working with machine code; you just get to write the part that makes your project different.

I started off with extremely high-level, generic code (something usable by many different architectures), and eventually decided to specialize things. The first fruits of this were a fork of the Beetle/Mednafen PSX core from Retroarch, which autogenerated an interpreter and recompiler (using libjit) from a single file description of the MIPS core. This used LLVM Tablegen with a custom language embedded within it, and a giant (very...

I’ve been asked by many people how I got to where I am today. I’ve given the tl;dr version for years and have meant to write the long version for a while. This will include a lot of details that aren’t just about my tech experience, because they shaped me in ways more fundamental than, say, learning C++ did. If you only want to know my tech journey, the first section will cover that.

Small warning: I try to be as accurate as I can with when things happened but, well, it’s been a long time now. I’ll do my best to be truthful and accurate despite that!

TW for those who want it: mental illness, self-harm, drug use.

TL;DR

I grew up in a household that always had a computer, so they were always around. In kindergarten there was an Apple //e and I started learning BASIC, thanks to a book discovered in the library. I spent years writing apps in Apple BASIC and later QBASIC on my DOS PC at...

I have a few goals for my bug bounty work in 2019:

• $50k in total bounties/bonuses
• At least one $5k bounty (for reference, current best is $4802)
• At least half my reports rated high/critical (CVSS 7+)
• Blog about my progress monthly, with a continuously updated entry for each month

Goal Health

Current total earnings for the year: $25329

This is 50.65% of my goal for the year. By the end of April I should be at $16666 to be on track, putting me $8663 ahead as of 2019-04-30

Lifetime Stats

• 22 bounties paid
• 2 bonuses paid
• $36291 total earned
• $1533 average bounty

Bugs

• CRITICAL Discovered 2019-03-17, Paid 2019-04-01 by private – $3000
• CRITICAL Discovered 2019-03-17, Paid 2019-04-01 by private – $3000
• CRITICAL Discovered 2019-04-13, Paid 2019-04-18 by private – $2200 (Plus $300 for the original bug, rated medium)
• CRITICAL Discovered 2019-04-07, Paid 2019-04-03 by undisclosed –...