𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
@Tetstack
107 subscribers
176 photos
2 videos
4 files
43 links
My Archive? IDK

Owner: https://www.github.com/PicasoTheDeal

Portfolio:
https://isitreallyme.pages.dev

Blog:
https://engineering-logs.pages.dev/
Download Telegram
About
Blog
Apps
Platform
Join
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
107 subscribers
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
I am even using a browser based vscode
51 views
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
This media is not supported in your browser
VIEW IN TELEGRAM
51 views
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
Project needed to be hault dad came home and it's families movie time. I will continue tomorrow morning
49 views
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
Damn 14 followers on github
60 views
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
This media is not supported in your browser
VIEW IN TELEGRAM
51 views
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
Yeah follow me on github, please
51 views
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
Damn 14 followers on github
Suspicious pattern tho, new followers have either forked the same repo or just have same bio.
👀1
59 views
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
Good Morning
47 views
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
This media is not supported in your browser
VIEW IN TELEGRAM
47 views
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
The debug is taking more time than the actual code architecture desing and writing.
555 views
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
picasothedealer_com@cloudshell:~/ZeroShadow$ ./runtime/shadow_stub & sleep 0.5 && sudo ./ZeroShadow $! ./runtime/shadow_stub
[6] 8635

[6]+ Stopped ./runtime/shadow_stub
[*] booting ZeroShadow supervisor...
[+] memory boundaries mapped.
[*] hooking PID: 8635...
[+] connected to prosses: 8635. monitoring loop active.
[*] dynamic ASLR base offset applied to all monitored regions.
[*] draining any leftover signals...
[DEBUG] drain signal: 19
[DEBUG] drain signal: 5
[DEBUG] drained, RIP: 0x5749d70b801f
[+] synchronised and drained. Starting main loop.
[DEBUG] Check RIP: 0x5749d70b8026 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8029 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802c signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802f signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8026 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8029 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802c signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802f signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8026 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8029 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802c signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802f signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8026 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8029 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802c signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802f signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8026 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8029 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802c signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802f signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8026 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8029 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802c signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802f signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8026 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8029 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802c signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802f signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8026 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8029 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802c signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802f signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8026 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8029 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802c signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802f signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8026 signal: 5
region:
49 views
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8029 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802c signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b802f signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b8031 signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b803b signal: 5
region: 0x95974652084224 - 0x95974652088320
[DEBUG] Check RIP: 0x5749d70b803b signal: b
region: 0x95974652084224 - 0x95974652088320
[!] CRITICAL: control flow hijack detected! RIP: 0x5749d70b803b signal: b
Error: supervisor loop drooped or connection lost.
[6]+ Killed ./runtime/shadow_stub
48 views
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8029 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802c signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802f

aight okay, now it's detecting the jump. Just a slight problem the allowed map was corrupted and then the verify_instructur_pointer see's it doesn't make sense and the stop that happened at the end doesn't show what happened.
48 views
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
I don't want to write the offset boundary "by hand" so i will use ai, jk. I will read it from the

exact executable segment boundaries


directly from the process memory map.
46 viewsedited  
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
okay boom, it has detected it correctly.
picasothedealer_com@cloudshell:~/ZeroShadow$ ./runtime/shadow_stub & sleep 0.5 && sudo ./ZeroShadow $! ./runtime/shadow_stub
[6] 11834

[6]+ Stopped ./runtime/shadow_stub
[*] booting ZeroShadow supervisor...
[+] memory boundaries mapped.
[*] hooking PID: 11834...
[+] connected to prosses: 11834. monitoring loop active.
[*] loaded 2 executable segment(s) from maps.
[*] draining any leftover signals...
[DEBUG] drain signal: 19
[DEBUG] drain signal: 5
[DEBUG] drained, RIP: 0x58075f76301f
[+] synchronised and drained. Starting main loop.
[!] SIGSEGV at instruction 0x58075f76303b, fault address = 0x0
[!] CRITICAL: control flow hijack detected! RIP: 0x58075f76303b signal: b
Error: supervisor loop drooped or connection lost.
[6]+ Killed ./runtime/shadow_stub
47 views
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
if (sig != SIGTRAP || !verify_instruction_pointer(regs)) {
std::cerr << "[!] CRITICAL: control flow hijack detected! " << "RIP: 0x" << std::hex << regs.rip << " signal: " << std::dec << sig << "\n";
ptrace(PTRACE_KILL, pid, nullptr, nullptr);
waitpid(pid, &status, 0); // read the killed process
return false;
}


 This logic is a bit greedy it's not differentiating b/n a crash and a hijack on the system. Too greedy it treets a hijack as a crash and a crash as a hijack.
44 viewsedited  
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
Okay some tweaks have been done and the output is amazing, mostly complete it has detected the memory fault by the dummy shadow_stub.s

picasothedealer_com@cloudshell:~/ZeroShadow$ ./runtime/shadow_stub & sleep 0.5 && sudo ./ZeroShadow $! ./runtime/shadow_stub
[6] 12577

[6]+ Stopped ./runtime/shadow_stub
[*] booting ZeroShadow supervisor...
[+] memory boundaries mapped.
[*] hooking PID: 12577...
[+] connected to prosses: 12577. monitoring loop active.
[*] loaded 2 executable segment(s) from maps.
[*] draining any leftover signals...
[DEBUG] drain signal: 19
[DEBUG] drain signal: 5
[DEBUG] drained, RIP: 0x572eb2d8901f
[+] synchronised and drained. Starting main loop.
[!] SIGSEGV at instruction 0x572eb2d8903b, fault address = 0x0
[!] CRITICAL: Memory Fault (SIGSEGV) at 0x572eb2d8903b accessing invalid address 0x0
Error: supervisor loop drooped or connection lost.
[6]+ Killed ./runtime/shadow_stub
66 views
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
now for the stack based buffer overflow test
68 views
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
for real tho i really hate putting the PID every time i am gonna test so yeah i ma add some lines
67 views
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
vuala but i feel like i will need to test it more before launching too,
56 views
𓆣 đ”—Ì¶đ”ąÌ¶đ”±Ì¶đ”°Ì¶đ”±Ì¶đ”žÌ¶đ” Ì¶đ”šÌ¶ 𓆣
I am 19, atlast gotta pack my bag after matrik I guess
👀6
54 viewsedited