Jan 31, 2015
JavRE-0.2 [sig]
JavRE-0.1.1 [sig]
Git repository: git clone https://www.altsci.com/repo/javre.git
JavRE project page
Reverse Engineering is an interesting and useful task which allows a person to gain knowledge about the software they use or that other people use. This basic tutorial for those who have had trouble getting started shows the methods on a file for which we have source code. It's a linux binary which is part of foo2zjs, an open source printer driver for HP printers. Like many Linux drivers, foo2zjs is made up of simple command-line executables which follow the Unix philosophy, do one thing and do it well. Of course there are exceptions to this, but the program we're reversing today was picked by me because it's important and small. Isn't that a nice combination? How small is /bin/usb_printerid? It's 8.4kB not stripped, 6.2kB stripped when compiled 64-bit. It is very similar in size to the simple 13 line program if2, which is 7.9kB unstripped, 6.1kB stripped. So what does usb_printerid do? Let's assume that we didn't have a name. Let's call it black for a few minutes.
Since black came from an untrusted source and was not signed by the author anyway, we consider it untrustworthy. Even if it came from a trusted source, we couldn't verify it, so we have to explicitly not trust it. How do we run something without trusting it? The Android model for running untrusted apps is to give the app a user and don't give that user access to the rest of the system. How difficult is that? Very difficult. For one, the kernel needs to not have any exploitable local root vulnerabilities. For two, no suid executables available to the user can have local code execution vulnerabilities before they drop privileges. Let's try to do that. You might think it's easiest to just run a virtual machine. Feel free to do that. I am going to recommend a different method similar to Android's security model. There are other ways to run code without trusting it, but they trade privacy for security. If you have root access on your local system, you can create a new user. Let's name that user oooooo after the program we're going to be running, black. Shadow has a program called useradd which I'll be using. If you're familiar with adding users, I'll leave it up to you.
Read more »Previous Issue (Nov 2008):
Shellcode Development in C
Reverse Engineering Binary Kernel Modules
Feb 4, 2015
Before I get started, if you're a programmer or hacker make sure you've downloaded my Reverse Engineering tool, JavRE and read the tutorial on how to use it.
Before you write a letter accusing me of class warfare and petty bourgeoisie anti-intellectual navel-gazing, read on. The title is misleading. No, I'm not going to make the opposite case either. Let's talk for a moment about happiness and money. A windfall of a small amount can make a poor person unimaginably happy. Gifts that make it easier for you to buy something you need or want are a big deal. A gamer who wins a challenging game becomes elated and euphoric. Some have called it the "epic" emotion. A gamer needs extra money to buy games and so without money they are usually unable to play very many games. For many gamers, their happiness subsides over time playing the same game. This is known as replayability and is very important for MMORPGs, online games, and even single player games. But the epic emotion is just one tiny sliver of happiness.
Happiness is the emotion that accompanies goodness. But does goodness equal happiness? In my opinion, no. I have for years attempted to argue that hedonism is a bankrupt philosophy and that doing something because it makes you happy is not the same as only doing things because they make you happy. Purpose comes not from happiness in my opinion, the reverse is not exactly true either. Purpose is often thought of as an old puritanical value that doesn't fit in with post-modern philosophy of life. But wait, why do we care about post-modernism? Because life matters. It takes almost no effort on the part of a philosopher to come to the conclusion that nihilism is incorrect despite the important lessons it teaches us. But post-modern philosophy goes much further than nihilism. Existentialism is a much more complex philosophy that post-modernism uses to deal with the major questions of life. Its opposition to positivism and rationalism in my opinion makes it unable to explain purpose that is ingrained into our soul, but I can understand how they would come to their conclusions. So how does this fit in with happiness? It is my belief that happiness comes from more than one thing. This makes it elusive. When you chase it, you lose it. When you have it you don't know that you have it, you just are. But that doesn't mean that you have to just be happy with your lot and not strive to make yourself happier. In fact, it's quite the opposite. Strive, knock, ask and don't stop until you look back and say that you were happy. Don't worry that you aren't currently happy, as Winston Churchill said, "If you're going through hell, keep going." What makes this so important is that you don't really know if you're happy now if you are happy. So you have to try to figure out what will make yourself happy and do that. But like I said before, happiness isn't everything.
Read more »
