born – nullteilerfrei

Ghidra Font Size for Presentations

born malware-analysis 2024-05-08

I'm known for my Ghidra stand-up comedy routines. In order to make them enjoyable for everyone in the room, the font size better be not as tiny as it normally is when you do your day-to-day reverse engineering. There are two places to consider: 1. menus, dialogs, etc. 2. specialized components like the assembly listing view and the decompiler # Font Size Override The first can be adjusted by editing the launch.properties file, which is normally located in the support directory within your Ghidra directory (C:\Users\born\Programs\ghidra_11.0.1_PUBLIC\support\launch.properties on my machine). Just add the following somewhere in the file to adjust the font size to 23:

VMARGS=-Dfont.size.override=23

# Components In order to adjust the font size in dialogs, I recommend searching the settings dialog ("Edit" -> "Tool Options") for "font". By the time of writing this involved the following entries (I use 12 for small and 18 for presentations): * Byte Viewer * Console * Decompiler -> Display * Graph -> Program Graph Display Options -> Miscellaneous * Listing Display

Ghidra: YARA scanning

born code, malware-analysis, technology 2023-10-21

This blag post covers scanning the Ghidra virtual memory with YARA. Do you want to know more?

Advertisement for the EU Keyboard Layout

born technology 2023-10-19

This is a quick one: If you are living in Germany but enjoy using a US keyboard layout — for one reason or another — I recommend using the EU keyboard layout instead. Do you want to know more?

Install NSQ on Debian with init.d and NGINX

born technology, web 2023-10-13

NSQ is an awesome and extremely simple distributed message queue. You can simply use it by publishing messages — that is arbitrary text, I often use JSON — on a so called "topic". A second process can than attach to a topic to consume messages on a so called "channel". Each messages is forwarded into each channel (at least once). This blag post covers deployment of NSQ in the simplest scenario: one box running everything. Do you want to know more?

Symfony Production Server Deployment Gotcha

born technology 2023-04-22

Assume you did all the proper and mature building steps for your Symfony application. You have a build environment independent of your development environment. You really made sure all the environment variables like COMPOSER_NO_DEV and NODE_ENV are set correctly without getting the double negatives confused. And you execute composer, yarn, and whatnot with all the good switches like --no-dev, --frozen-lockfile, and --production. But you still get the following error message:

Attempted to load class "WebProfilerBundle" from namespace "Symfony\Bundle\WebProfilerBundle".
Did you forget a "use" statement for another namespace?

Then you _might_ have forgotten to set APP_ENV="prod" on the **production system**. It of course makes sense when you think about it. But it always does, once you figured out. Anyway: I hope this helps a fellow traveler at some point in the future! ❤️

FILTER for entry in list of objects in AQL (ArangoDB)

born technology 2023-04-14

Just a quick blag for my future self:

FOR row IN coll
   FOR entry in doc.array
      FILTER entry.field_name != @field_name
   LIMIT @limit
   RETURN DISTINCT doc

Didn't give me what I wanted. While slapping DISTINCT on the RETURN fixed the problem of "I'm getting the same document over and over again" it now doesn't return @limit many documents but seemingly a random — but lower — number. What's actually happening here is, that the indentation is deceiving: the last two lines should be indented one more.

FOR row IN coll
    FILTER POSITION(doc.array[*].field_name , @field_name) == false
    LIMIT @limit
    RETURN doc

Is what I _actually_ wanted. Edit (2023-04-18): And _now_ I learned that you should actually do this:

FOR row IN coll
    FILTER @field_name NOT IN doc.array[*].field_name
    LIMIT @limit
    RETURN doc

Use ArangoDB in Symfony without an external bundle

born code, technology, web 2023-04-04

The official documentation on ArangoDB usage in Symfony is [literally from 2013](https://www.arangodb.com/2013/03/getting-started-with-arangodb-and-symfony-part1/) and hence targeting a pretty old Symfony version. This blag post will cover adding minimal ArangoDB support by hand. The actual database protocol and interacting will be handled by [ArangoDBClient](https://github.com/arangodb/arangodb-php). Show me what you've got!

Mysql SOUNDEX function in Symfony with Doctrine

born technology 2023-01-14

If you want to perform SOUNDEX similarity searches with Doctrine in Symfony, you first need to define it as a so called "DQL User Defined Functions". Resources online are a bit dated so I decided to publish this quick blag post. That _sounds_ nice, show me more!

Use Python to Generate Discord Invite ULRs en masse

born technology 2022-11-01

When creating invitations to Discord servers – or "guilds" how they seem to called internally – you can configure some limits. For example, you can limit the number of times a link can be used to join a server or you can configure an expiry date. The default setting for the time limit is 7 days btw, which is why most links are expired when you come back to them after some time. I was in the situation that I wanted to invite a limited number of people to a Discord server and each should only receive a link that can only be used once. So in some sense, I wanted to create personalized invite links, which doesn't seem to be a use case that's supported out of the box. So let's use Python!

Machine Learning for Language Detection in Python with scikit-learn

born code, technology 2022-09-03

I recently played around with scraping public Telegram channels and finally want to do something with the data. In particular, I wanted to play around with Named Entity Recognition (NER) and Sentiment Analysis on the content of the Telegram posts. I think this will probably work much better when you do it for each language separately. So before we answer the question "what's this post about?" or "how angry is the person in the post?", let's answer the question "what language is the post in?" first. And we'll do it while warming up with that hole machine learning (ML) topic. Be aware: I have no idea what I'm doing. Do you want to know more?

VoiceMeeter for Audio Routing on Windows

born technology 2022-07-10

This blog post will cover my audio setup on Windows. It's core component is called VoiceMeeter which is a virtual audio mixer for Windows developed by Vincent Burel under the company label "VB-Audio". This blog post will focus on the fact that it makes virtual microphones and virtual speakers available which in turn can be used by all program running on your computer. Do you want to know more?

FrOSCon 2021 Vortrag – Der Cyber-Bankraub von Bangladesch

born technology 2021-08-21

(English-only readers can safely ignore this post) I'll be talking at FrOSCon this year again and try to take a stab at a topic that does not _only_ involve technical topics but will also tell the story of a bank heist. This heist wasn't supported by getaway cars and pistols but was solely carried out through cyber-means. The talk is in German though. * Source Code of LaTex Presentation: https://github.com/larsborn/FrOSCon2021-Ghidra-Bangladesh-Talk * Handout PDF: FrOSConTalk2021-Ghidra-Bangladesh * FrOSCon schedule entry: https://programm.froscon.de/2021/events/2670.html * Recording on media.ccc: https://media.ccc.de/v/froscon2021-2670-der_cyber-bankraub_von_bangladesch

Install Ghidra 10.0.1 on Ubuntu 20

born technology 2021-07-17

I idly googled for the title and couldn't find code that I can insipidly paste into a console window. So I prepared it here for fellow travelers (and my future self):

wget 'https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_10.0.1_build/ghidra_10.0.1_PUBLIC_20210708.zip'
unzip ghidra_10.0.1_PUBLIC_20210708.zip
sudo apt install default-jdk
./ghidra/ghidraRun