The goal of this blag post is to get a legacy software used by teachers to run under Linux. The software is used to put grades of pupils into a database.
Would you like to know more?
Would you like to know more?
Would you like to know more?
1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f and the task is:
> Create a static C2 extractor that uses abstract syntax tree transformations with Babel. You can use astexplorer.net as helper tool.
I was particularly intrigued because I've recently seen other people be extremely successful leveraging "normal dev tooling" in the JavaScript ecosystem to tackle challenges with JavaScript-based malware.
Would you like to know more?
chkdsk, sfc /scannow, safe mode with networking, and probably some more), but none of these resolved the issue.
tldr: Delete or rename C:\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini after removing the system encryption.
A few more words about this:
There's a file C:\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini (documentation) which VeraCrypt creates when encrypting the system partition, with the following content (for me at least):
[SetupConfig]
ReflectDrivers="C:\Program Files\VeraCrypt"
PostOOBE=C:\ProgramData\VeraCrypt\SetupComplete.cmd
After removing system encryption, the file only contains
[SetupConfig]
but still exists.
Removing or renaming this file allowed me to upgrade and re-enable system encryption without further problems. I've tried it on another (desktop) machine to verify - ran into the exact same problem, which went away after removing that file.
Edit: I've opened a bug report at VeraCrypt's repo.
Outbound which represents the VPN connection, and an interface named Gateway which represents the connection that is shared with the host. I use Windows Internet Connection Sharing (ICS) to provide routing to the Gateway interface via Outbound. For reasons unknown to me, however, this sometimes just breaks and the only way to get it running again is to simply disable ICS on the Outbound interface and re-enable it. Doing this through the UI every time became annoying, so I researched how to do it programmatically. There is [a great superuser answer](https://superuser.com/a/649183/222330) which provides _almost_ all the details you need, but not quite.
Do you want to know more?
ast module to add a bitmask to each arithmetic operation that occurs in the code of a decorated function. Here's the code:
import ast
import functools
import inspect
def masked(mask: int):
'''
Convert arithmetic operations that occur within the decorated function body in such a way that
the result is reduced using the given bitmask. All additions, subtractions, multiplications,
left shifts, and taking powers is augmented by introducing a bitwise and with the given mask.
'''
def decorator(function):
code = inspect.getsource(function)
tree = ast.parse(code, mode='exec')
class Postprocessor(ast.NodeTransformer):
name = None
def visit_BinOp(self, node: ast.BinOp):
node = self.generic_visit(node)
if not isinstance(node.op, (ast.Add, ast.Mult, ast.Sub, ast.LShift, ast.Pow)):
return node
return ast.BinOp(node, ast.BitAnd(), ast.Constant(mask))
def visit_FunctionDef(self, node: ast.FunctionDef):
node = self.generic_visit(node)
if self.name is None:
node.name = self.name = F'__wrapped_{node.name}'
for k in range(len(node.decorator_list)):
if node.decorator_list[k].func.id == masked.__name__:
del node.decorator_list[:k + 1]
break
return node
pp = Postprocessor()
fixed = ast.fix_missing_locations(pp.visit(tree))
eval(compile(fixed, function.__code__.co_filename, 'exec'))
return functools.wraps(function)(eval(pp.name))
return decorator
With this decorator, you can now write:
@masked(0xFFFF)
def test(x: int) -> int:
return x * 0xBAAD
This will leave all code exactly as it is except for the binary operations involving addition, multiplication, subtraction, left shift, and computing powers - all of these are converted to having one additional bitwise and operation on top.
launch.properties file, which is normally located in the support directory within your Ghidra directory (C:\Users\born\Programs\ghidra_11.0.1_PUBLIC\support\launch.properties on my machine). Just add the following somewhere in the file to adjust the font size to 23:
VMARGS=-Dfont.size.override=23
# Components
In order to adjust the font size in dialogs, I recommend searching the settings dialog ("Edit" -> "Tool Options") for "font". By the time of writing this involved the following entries (I use 12 for small and 18 for presentations):
* Byte Viewer
* Console
* Decompiler -> Display
* Graph -> Program Graph Display Options -> Miscellaneous
* Listing Display
COMPOSER_NO_DEV and NODE_ENV are set correctly without getting the double negatives confused. And you execute composer, yarn, and whatnot with all the good switches like --no-dev, --frozen-lockfile, and --production. But you still get the following error message:
Attempted to load class "WebProfilerBundle" from namespace "Symfony\Bundle\WebProfilerBundle".
Did you forget a "use" statement for another namespace?
Then you _might_ have forgotten to set APP_ENV="prod" on the **production system**. It of course makes sense when you think about it. But it always does, once you figured out. Anyway: I hope this helps a fellow traveler at some point in the future! ❤️