- cypherpunks - lists.cpunks.org

Funeral in Berlin
by professor rat 15 Dec '21

15 Dec '21

nakashimae ·3h German court convicts Russian in brazen Berlin assassination, hands down life sentence for Vadim Krasikov, said to be a former FSB colonel. Federal prosecutors called it a political murder ordered by Russia.

1 0

Re: [spam][crazy] bomb malware
by Karl 15 Dec '21

15 Dec '21

making sure to share these relations On Tue, Dec 14, 2021, 9:16 AM Karl <gmkarl(a)gmail.com> wrote: > On 12/14/21, wrote: > > > >> What brought you to message me? have you received other posts i've > made? > > > > I am getting your messages through the cypherpunk email list. I think > > they are pretty entertaining to read so I thought I would message you. > > Huh :-) > > >> Exploits were a closekept secret found by experienced in-depth > >> analysis of systems and specific-purpose tools that can be hard to > >> share and find. > >> > >> I'm guessing that pentesting and anti- intrusion systems are pretty > >> helpful, covering similar ground. > >> > >> It's important work, especially in this day and age. > > Yeah. It's also fascinating that companies leave back doors open to give > > governments and agencies the possibility for hacking civilians and other > > governments... I read about it recently. > > Below two paragraphs could be inaccurate, i'm pretty confused. > > It's unfortunate to learn that goes down to the chip level, for me. > In AOL Instant Messenger, AOL was found to be using a bug in their own > code to access people's systems. > > I heard it was kind of a fun thing system engineer-administrators > could do long ago. Nobody understood anything but them, and > technology wasn't used for anything important, and leaving a way to > access systems made it much easier to fix bugs. > > Seems there's a scary element I never learned about. >

1 0

Re: [spam][crazy] bomb malware
by Karl 15 Dec '21

15 Dec '21

making sure to share these relations On Tue, Dec 14, 2021, 9:12 AM wrote: > > > What brought you to message me? have you received other posts i've made? > > I am getting your messages through the cypherpunk email list. I think > they are pretty entertaining to read so I thought I would message you. > > > > Exploits were a closekept secret found by experienced in-depth > > analysis of systems and specific-purpose tools that can be hard to > > share and find. > > > > I'm guessing that pentesting and anti- intrusion systems are pretty > > helpful, covering similar ground. > > > > It's important work, especially in this day and age. > Yeah. It's also fascinating that companies leave back doors open to give > governments and agencies the possibility for hacking civilians and other > governments... I read about it recently. >

1 0

Re: [spam][crazy] bomb malware
by Karl 15 Dec '21

15 Dec '21

making sure I share these relations On Tue, Dec 14, 2021, 8:59 AM Karl <gmkarl(a)gmail.com> wrote: > > Sorry to hear that. I'm sure you're gonna make it nonetheless! > > What brought you to message me? have you received other posts i've made? > > >> Long ago, security was all about reverse engineering. > > > > That's true. Which was a way of finding back doors... > > Exploits were a closekept secret found by experienced in-depth > analysis of systems and specific-purpose tools that can be hard to > share and find. > > I'm guessing that pentesting and anti- intrusion systems are pretty > helpful, covering similar ground. > > It's important work, especially in this day and age. >

1 0

Re: [spam][crazy] bomb malware
by Karl 15 Dec '21

15 Dec '21

making sure I share these relations On Tue, Dec 14, 2021, 8:45 AM wrote: > On 12/14/2021 2:19 PM, Karl wrote: > > I've been homeless and crazy for years, spasms and visions rather than > > doing things I desire to do. When I saw this malware and started > > posting looking at it from my mobile phone, I felt energised as I > > rarely am. It is always a gift and a gamble, to be able to work on > > something, for me. > > Sorry to hear that. I'm sure you're gonna make it nonetheless! > > > > Long ago, security was all about reverse engineering. > > That's true. Which was a way of finding back doors... > > >

1 0

Re: [spam][crazy] bomb malware
by Karl 15 Dec '21

15 Dec '21

making sure I share these relations On Tue, Dec 14, 2021, 8:19 AM Karl <gmkarl(a)gmail.com> wrote: > On 12/14/21, wrote: > > Thanks for the information! > > I'm sure there are communities and tools for reverse engineering > > programs (i.e. malware). > > Why do you need a task to work on? Reverse engineering malware sounds > > like a good task to me. > > I've been homeless and crazy for years, spasms and visions rather than > doing things I desire to do. When I saw this malware and started > posting looking at it from my mobile phone, I felt energised as I > rarely am. It is always a gift and a gamble, to be able to work on > something, for me. > > > I don't have any experience in that field, however, I'm very interested > > in cyber security, exploits, etc. So I might look into it in the future. > > Long ago, security was all about reverse engineering. > > > Good luck with your project! > > > > Best regards, > > > > > > On 12/14/2021 2:09 PM, Karl wrote: > >> > >> I'm looking at these binaries! > >> > https://bafybeibfppl57sszyk733lswextgmkbu2aaysboldqtibu5capjxgwrw7y.ipfs.dw… > >> and elsewhere. I don't really know what they do. > >> > >> I've reversed a little code before but nothing complex like packed > >> malware, and only from one or two compilers and loaders. > >> > >> I imagine there are plugins and other tools out there somewhere that > >> would help a lot. > >> > >> I really need a task to work on. > >> > >> What's your experience? > >> > >> K > > > > > > >

1 0

Re: [spam][crazy] bomb malware
by Karl 15 Dec '21

15 Dec '21

making sure I share these relations On Tue, Dec 14, 2021, 8:14 AM wrote: > Thanks for the information! > I'm sure there are communities and tools for reverse engineering > programs (i.e. malware). > Why do you need a task to work on? Reverse engineering malware sounds > like a good task to me. > I don't have any experience in that field, however, I'm very interested > in cyber security, exploits, etc. So I might look into it in the future. > Good luck with your project! > > Best regards, > > > On 12/14/2021 2:09 PM, Karl wrote: > > > > I'm looking at these binaries! > > > https://bafybeibfppl57sszyk733lswextgmkbu2aaysboldqtibu5capjxgwrw7y.ipfs.dw… > > and elsewhere. I don't really know what they do. > > > > I've reversed a little code before but nothing complex like packed > > malware, and only from one or two compilers and loaders. > > > > I imagine there are plugins and other tools out there somewhere that > > would help a lot. > > > > I really need a task to work on. > > > > What's your experience? > > > > K > > >

1 0

Re: [spam][crazy] bomb malware
by Karl 15 Dec '21

15 Dec '21

making sure I share these relations On Tue, Dec 14, 2021, 8:09 AM Karl <gmkarl(a)gmail.com> wrote: > I'm looking at these binaries! > > https://bafybeibfppl57sszyk733lswextgmkbu2aaysboldqtibu5capjxgwrw7y.ipfs.dw… > and elsewhere. I don't really know what they do. > > I've reversed a little code before but nothing complex like packed > malware, and only from one or two compilers and loaders. > > I imagine there are plugins and other tools out there somewhere that > would help a lot. > > I really need a task to work on. > > What's your experience? > > K >

1 0

Re: [spam][crazy] bomb malware
by Karl 15 Dec '21

15 Dec '21

making sure I share these relations On Tue, Dec 14, 2021, 7:59 AM wrote: > Hi K, > > do I understand it correctly that you are trying to reverse engineer > some malware? Did you have experience with it before starting to work on > this particular malware? > I find the topic quite interesting... > > Best regards, > > > On 12/14/2021 1:42 PM, Karl wrote: > > The first thing I notice here is that the function takes a _lot_ of > > parameters. This is more poignant because it makes the assembly > > complex, but back in the entrypoint we saw what values were passed for > > each one of these parameters. > > > > > > ************************************************************** > > * > > * > > * FUNCTION > > * > > > > ************************************************************** > > int __cdecl FUN_0804d23f(undefined * > > param_1, int param_ > > int EAX:4 <RETURN> > > undefined * Stack[0x4]:4 param_1 > > XREF[1]: 0804d3e9(R) > > int Stack[0x8]:4 param_2 > > XREF[2]: 0804d268(R), > > > > 0804d3e2(R) > > uint * * Stack[0xc]:4 param_3 > > XREF[1]: 0804d250(R) > > undefined * Stack[0x10]:4 param_4 > > XREF[1]: 0804d26f(R) > > undefined4 Stack[0x14]:4 param_5 > > XREF[1]: 0804d372(R) > > undefined4 Stack[0x18]:4 param_6 > > XREF[1]: 0804d25c(R) > > undefined4 Stack[0x1c]:4 param_7 > > XREF[1]: 0804d249(R) > > undefined4 Stack[-0x14]:4 local_14 > > XREF[1]: 0804d32a(R) > > undefined4 Stack[-0x1c]:4 local_1c > > XREF[1]: 0804d323(R) > > undefined4 Stack[-0x24]:4 local_24 > > XREF[1]: 0804d31d(R) > > undefined4 Stack[-0x2c]:4 local_2c > > XREF[2]: 0804d2ed(R), > > > > 0804d314(R) > > undefined4 Stack[-0x54]:4 local_54 > > XREF[1]: 0804d2dc(R) > > undefined1 Stack[-0x88]:1 local_88 > > XREF[2]: 0804d290(*), > > > > 0804d2ce(*) > > undefined4 Stack[-0xac]:4 local_ac > > XREF[1]: 0804d3f0(*) > > FUN_0804d23f > > XREF[1]: entry:08048180(c) > > 0804d23f 55 PUSH EBP > > 0804d240 57 PUSH EDI > > 0804d241 56 PUSH ESI > > 0804d242 53 PUSH EBX > > 0804d243 81 ec 8c SUB ESP,0x8c > > 00 00 00 > > 0804d249 8b 84 24 MOV EAX,dword ptr [ESP + > param_7] > > b8 00 00 00 > > 0804d250 8b bc 24 MOV EDI,dword ptr [ESP + > param_3] > > a8 00 00 00 > > 0804d257 a3 b8 e0 MOV [DAT_0804e0b8],EAX > > = ?? > > 04 08 > > 0804d25c 8b 84 24 MOV EAX,dword ptr [ESP + > param_6] > > b4 00 00 00 > > 0804d263 a3 c8 e0 MOV [DAT_0804e0c8],EAX > > = ?? > > 04 08 > > 0804d268 8b 84 24 MOV EAX,dword ptr [ESP + > param_2] > > a4 00 00 00 > > 0804d26f 8b ac 24 MOV EBP,dword ptr [ESP + > param_4] > > ac 00 00 00 > > 0804d276 8d 14 87 LEA EDX,[EDI + EAX*0x4] > > 0804d279 8d 42 04 LEA EAX,[EDX + 0x4] > > 0804d27c a3 bc e0 MOV [DAT_0804e0bc],EAX > > = ?? > > 04 08 > > 0804d281 3b 07 CMP EAX,dword ptr [EDI] > > 0804d283 75 06 JNZ LAB_0804d28b > > 0804d285 89 15 bc MOV dword ptr > > [DAT_0804e0bc],EDX = ?? > > e0 04 08 > > LAB_0804d28b > > XREF[1]: 0804d283(j) > > 0804d28b 51 PUSH ECX > > >

1 0

USA v Assange Judgement
by Digitalfolklore 15 Dec '21

15 Dec '21

clean copy of USA v Assange https://archive.org/details/usa-v-assange-judgment-101221 Interesting to note the UK Judiciary site is a Wordpress.. V Hesse

1 0