- cypherpunks - lists.cpunks.org

Re: [spam][crazy] bomb malware
by Karl 15 Dec '21

15 Dec '21

making sure I share these relations On Tue, Dec 14, 2021, 8:09 AM Karl <gmkarl(a)gmail.com> wrote: > I'm looking at these binaries! > > https://bafybeibfppl57sszyk733lswextgmkbu2aaysboldqtibu5capjxgwrw7y.ipfs.dw… > and elsewhere. I don't really know what they do. > > I've reversed a little code before but nothing complex like packed > malware, and only from one or two compilers and loaders. > > I imagine there are plugins and other tools out there somewhere that > would help a lot. > > I really need a task to work on. > > What's your experience? > > K >

1 0

Re: [spam][crazy] bomb malware
by Karl 15 Dec '21

15 Dec '21

making sure I share these relations On Tue, Dec 14, 2021, 7:59 AM wrote: > Hi K, > > do I understand it correctly that you are trying to reverse engineer > some malware? Did you have experience with it before starting to work on > this particular malware? > I find the topic quite interesting... > > Best regards, > > > On 12/14/2021 1:42 PM, Karl wrote: > > The first thing I notice here is that the function takes a _lot_ of > > parameters. This is more poignant because it makes the assembly > > complex, but back in the entrypoint we saw what values were passed for > > each one of these parameters. > > > > > > ************************************************************** > > * > > * > > * FUNCTION > > * > > > > ************************************************************** > > int __cdecl FUN_0804d23f(undefined * > > param_1, int param_ > > int EAX:4 <RETURN> > > undefined * Stack[0x4]:4 param_1 > > XREF[1]: 0804d3e9(R) > > int Stack[0x8]:4 param_2 > > XREF[2]: 0804d268(R), > > > > 0804d3e2(R) > > uint * * Stack[0xc]:4 param_3 > > XREF[1]: 0804d250(R) > > undefined * Stack[0x10]:4 param_4 > > XREF[1]: 0804d26f(R) > > undefined4 Stack[0x14]:4 param_5 > > XREF[1]: 0804d372(R) > > undefined4 Stack[0x18]:4 param_6 > > XREF[1]: 0804d25c(R) > > undefined4 Stack[0x1c]:4 param_7 > > XREF[1]: 0804d249(R) > > undefined4 Stack[-0x14]:4 local_14 > > XREF[1]: 0804d32a(R) > > undefined4 Stack[-0x1c]:4 local_1c > > XREF[1]: 0804d323(R) > > undefined4 Stack[-0x24]:4 local_24 > > XREF[1]: 0804d31d(R) > > undefined4 Stack[-0x2c]:4 local_2c > > XREF[2]: 0804d2ed(R), > > > > 0804d314(R) > > undefined4 Stack[-0x54]:4 local_54 > > XREF[1]: 0804d2dc(R) > > undefined1 Stack[-0x88]:1 local_88 > > XREF[2]: 0804d290(*), > > > > 0804d2ce(*) > > undefined4 Stack[-0xac]:4 local_ac > > XREF[1]: 0804d3f0(*) > > FUN_0804d23f > > XREF[1]: entry:08048180(c) > > 0804d23f 55 PUSH EBP > > 0804d240 57 PUSH EDI > > 0804d241 56 PUSH ESI > > 0804d242 53 PUSH EBX > > 0804d243 81 ec 8c SUB ESP,0x8c > > 00 00 00 > > 0804d249 8b 84 24 MOV EAX,dword ptr [ESP + > param_7] > > b8 00 00 00 > > 0804d250 8b bc 24 MOV EDI,dword ptr [ESP + > param_3] > > a8 00 00 00 > > 0804d257 a3 b8 e0 MOV [DAT_0804e0b8],EAX > > = ?? > > 04 08 > > 0804d25c 8b 84 24 MOV EAX,dword ptr [ESP + > param_6] > > b4 00 00 00 > > 0804d263 a3 c8 e0 MOV [DAT_0804e0c8],EAX > > = ?? > > 04 08 > > 0804d268 8b 84 24 MOV EAX,dword ptr [ESP + > param_2] > > a4 00 00 00 > > 0804d26f 8b ac 24 MOV EBP,dword ptr [ESP + > param_4] > > ac 00 00 00 > > 0804d276 8d 14 87 LEA EDX,[EDI + EAX*0x4] > > 0804d279 8d 42 04 LEA EAX,[EDX + 0x4] > > 0804d27c a3 bc e0 MOV [DAT_0804e0bc],EAX > > = ?? > > 04 08 > > 0804d281 3b 07 CMP EAX,dword ptr [EDI] > > 0804d283 75 06 JNZ LAB_0804d28b > > 0804d285 89 15 bc MOV dword ptr > > [DAT_0804e0bc],EDX = ?? > > e0 04 08 > > LAB_0804d28b > > XREF[1]: 0804d283(j) > > 0804d28b 51 PUSH ECX > > >

1 0

USA v Assange Judgement
by Digitalfolklore 15 Dec '21

15 Dec '21

clean copy of USA v Assange https://archive.org/details/usa-v-assange-judgment-101221 Interesting to note the UK Judiciary site is a Wordpress.. V Hesse

1 0

Re: [tor-relays] Responding to Tor censorship in Russia
by grarpamp 15 Dec '21

15 Dec '21

On 12/9/21, abuse department <abuse(a)relayon.org> wrote: > So we want bridges without contact info and from unknown persons / state > agencies? > > I am sure there is nothing with this excellent plan that could possible go > wrong. How can you know the extent of possibilities, the wrongness of plans, when you cannot see, read, discuss or post such things, because this list is censored, not least from embarassing topics, just like Russia does. Shame. "Tor Stinks -- NSA"

1 1

GRAMPS garbage scow deliveries - he's like the Sean Hannity of cypherpunks
by professor rat 15 Dec '21

15 Dec '21

Fox News’ Sean Hannity Lands Interview With WikiLeaks Founder Julian Assange https://variety.com/2017/tv/news/sean-hannity-julian-assange-fox-news-inter… Jesus Fucking Christie - what a smell!

1 0

I looked up Zeynep Aydogan and it said " See Laura Ingraham " .
by professor rat 15 Dec '21

15 Dec '21

LAURA INGRAHAM (HOST): So getting back to Seth Rich. Julian Assange suggested in a sit-down interview, remember Assange is -- he's basically on the run. He's living in an embassy because he can't -- they'll throw him in jail if he -- with an interview with this Dutch television reporter in this program called Nieuwsuur. https://www.mediamatters.org/laura-ingraham/laura-ingraham-pushes-conspirac…

1 0

Re: Turkish nationalist hates Arabs, Jews & women
by professor rat 15 Dec '21

15 Dec '21

Don't sweat the coder-morons - like Karl - and the ratfuckers, Z https://www.google.com/search?q=roger+stone+London&client=opera&hs=oG6&sour…

1 0

ASSMANGE was cosy as lice with Hannity, Ingraham and Don Jnr
by professor rat 15 Dec '21

15 Dec '21

Maybe his supporters here can explain how it was that these FOX hosts and a relative directly linked to their hero thought they had a direct line to advise POTUS Dumbfuck? Once is accident - twice is coincidence - THREE TIMES IS ENEMY ACTION!

1 0

Turkish nationalist hates Arabs, Jews & women
by professor rat 15 Dec '21

15 Dec '21

Zeynep Aydogan is a tiresome Wikileaks deadender who now lies through her rotten teeth about the Arab Spring. Such depraved fascist scumbags are the enemies of all anarchists. But you knew that.

3 2

" I love Wikileaks! " Donald Dumbfuck is well on his way to Club Fed
by professor rat 15 Dec '21

15 Dec '21

Belmarsh Donny for the Graybar Hotel Donald Trump is already under state-level criminal investigation in three jurisdictions (Manhattan, Fulton County, Westchester), two of which have already reached the grand jury stage, one of which has already begun indicting Trump’s company and underlings. So it’s been reasonable to say that Trump is on a path to prison https://www.palmerreport.com/analysis/the-january-6th-committee-appeared-to…

2 1