{"version": "https://jsonfeed.org/version/1", "title": "/dev/posts/ - Tag index - computer", "home_page_url": "https://www.gabriel.urdhr.fr", "feed_url": "/tags/computer/feed.json", "items": [{"id": "http://www.gabriel.urdhr.fr/2025/12/08/asymmetric-keys-and-siths/", "title": "Asymmetric keys and Siths", "url": "https://www.gabriel.urdhr.fr/2025/12/08/asymmetric-keys-and-siths/", "date_published": "2025-12-08T00:00:00+01:00", "date_modified": "2025-12-08T00:00:00+01:00", "tags": ["computer", "cryptography", "star-wars"], "content_html": "<p>Some (not so serious) cryptographic wisdom\nfrom a long time ago\u2026</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/09/22/reinforcement-learning-formulas/", "title": "Reinforcement Learning formulas cheat sheet", "url": "https://www.gabriel.urdhr.fr/2025/09/22/reinforcement-learning-formulas/", "date_published": "2025-09-22T00:00:00+02:00", "date_modified": "2025-09-22T00:00:00+02:00", "tags": ["computer", "machine-learning", "reinforcement-learning", "neural-networks"], "content_html": "<p>Cheat sheet for (some) reinforcement learning mathematical formulas and algorithms.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/08/22/concealing-xss-payload/", "title": "Concealing XSS payloads", "url": "https://www.gabriel.urdhr.fr/2025/08/22/concealing-xss-payload/", "date_published": "2025-08-22T00:09:04+02:00", "date_modified": "2025-08-22T00:09:04+02:00", "tags": ["computer", "security", "xss", "waf"], "content_html": "<p>PortSwigger <a href=\"https://portswigger.net/research/concealing-payloads-in-url-credentials\">\u201cConcealing payloads in URL credentials\u201d</a>\ntalks about concealing XSS payloads in URL credentials.\nThe nice thing is that this makes the payload invisible to WAFs and other server-side XSS filters.\nYou can actually conceal the payloads in other places</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/08/22/codingame-spring-challenge-2025/", "title": "Codingame Spring Challenge 2025", "url": "https://www.gabriel.urdhr.fr/2025/08/22/codingame-spring-challenge-2025/", "date_published": "2025-08-22T00:00:00+02:00", "date_modified": "2025-08-22T00:00:00+02:00", "tags": ["computer", "rust", "optimisation", "profiling", "flamegraph"], "content_html": "<p>My experience from the <a href=\"https://www.codingame.com/contests/spring-challenge-2025/\">Codingame Spring Challenge 2025</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/08/20/unicode-tag-smuggling/", "title": "Testing Unicode Tag Smuggling in chatbots", "url": "https://www.gabriel.urdhr.fr/2025/08/20/unicode-tag-smuggling/", "date_published": "2025-08-20T00:00:00+02:00", "date_modified": "2026-01-16T01:06:36+01:00", "tags": ["computer", "security", "language-model", "LLM"], "content_html": "<p>Testing <a href=\"https://embracethered.com/blog/posts/2024/hiding-and-finding-text-with-unicode-tags\">ASCII smuggling</a>\nusing <a href=\"https://en.wikipedia.org/wiki/Tags_(Unicode_block)\">Unicode Tags</a>\non LLMs/chatbots.\nNothing new here.\nJust a short summary.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/07/08/keycloak-uma-vulnerabilities/", "title": "Keycloak UMA vulnerabilities", "url": "https://www.gabriel.urdhr.fr/2025/07/08/keycloak-uma-vulnerabilities/", "date_published": "2025-07-08T00:00:00+02:00", "date_modified": "2025-07-08T00:00:00+02:00", "tags": ["computer", "protocol", "web", "security", "oauth", "keycloak", "security", "uma", "openid-connect"], "content_html": "<p>Keycloak's UMA implementation seems tricky to me.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/05/14/llama.cpp-quickstart/", "title": "llama.cpp quickstart", "url": "https://www.gabriel.urdhr.fr/2025/05/14/llama.cpp-quickstart/", "date_published": "2025-05-14T23:12:16+02:00", "date_modified": "2025-05-14T23:12:16+02:00", "tags": ["computer", "machine-learning", "deep-learning", "language-model", "neural-networks", "LLM"], "content_html": "<p>How to quickly use llama.cpp for LLM inference (no GPU needed).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/05/14/vllm-quickstart/", "title": "vLLM quickstart", "url": "https://www.gabriel.urdhr.fr/2025/05/14/vllm-quickstart/", "date_published": "2025-05-14T23:11:38+02:00", "date_modified": "2025-05-14T23:11:38+02:00", "tags": ["computer", "machine-learning", "deep-learning", "language-model", "neural-networks", "LLM"], "content_html": "<p>How to quickly use <a href=\"https://docs.vllm.ai/en/stable/\">vLLM</a> for LLM inference using CPU.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/03/18/uma-malicious-as/", "title": "Malicious authorization server attack in UMA\u00a02.0", "url": "https://www.gabriel.urdhr.fr/2025/03/18/uma-malicious-as/", "date_published": "2025-03-18T21:23:51+01:00", "date_modified": "2025-03-18T21:23:51+01:00", "tags": ["computer", "protocol", "web", "security", "oauth", "uma"], "content_html": "<p>In a <a href=\"https://www.gabriel.urdhr.fr/2025/03/18/uma-pass-the-permission-token/\">previous post</a>,\nI described a pass-the-permission-ticket vulnerability in UMA\u00a02.0\nin which a malicious UMA resource server\ncould kindly ask a UMA client\nto give it access tokens actually intended for another UMA resource server.\nIn this post,\nI am describing a similar attack when the authorization server is malicious.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/03/18/uma-pass-the-permission-token/", "title": "Pass-the-permission-ticket vulnerability in UMA\u00a02.0", "url": "https://www.gabriel.urdhr.fr/2025/03/18/uma-pass-the-permission-token/", "date_published": "2025-03-18T21:23:50+01:00", "date_modified": "2025-03-18T21:23:50+01:00", "tags": ["computer", "protocol", "web", "security", "oauth", "uma"], "content_html": "<p>In the <a href=\"https://docs.kantarainitiative.org/uma/wg/rec-oauth-uma-grant-2.0.html\">User-Managed Access</a> (UMA) 2.0 protocol,\na malicious resource server (or a malicious server acting as a resource server)\ncan obtain a requesting party (access) token (RPT)\nintended for another UMA resource server\nfrom a UMA client\nby passing a permission ticket obtained from the target resource server to the UMA client.\nThis can compromise the privacy (confidentiality)\nand integrity of UMA protected resources.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/01/30/distillation/", "title": "Neural Network Distillation", "url": "https://www.gabriel.urdhr.fr/2025/01/30/distillation/", "date_published": "2025-01-30T00:00:00+01:00", "date_modified": "2025-01-30T00:00:00+01:00", "tags": ["computer", "machine-learning", "deep-learning", "neural-networks"], "content_html": "<p>Overview of neural network distillation\nas done in\n<a href=\"https://arxiv.org/abs/1503.02531\">\u201cDistilling the Knowledge in a Neural Network\u201d</a>\n(Hinton et al, 2014).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/01/27/exposing-services-podman/", "title": "Exposing services in/out Podman containers", "url": "https://www.gabriel.urdhr.fr/2025/01/27/exposing-services-podman/", "date_published": "2025-01-27T00:00:00+01:00", "date_modified": "2025-01-27T00:00:00+01:00", "tags": ["computer", "linux", "system", "podman", "container", "security"], "content_html": "<p>Some more tips for interacting\nwith the <a href=\"https://man7.org/linux/man-pages/man7/namespaces.7.html\">namespaces</a>\nof <a href=\"https://podman.io/\">Podman</a> containers.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/01/07/transformer-decoder-language-models/", "title": "Transformer-decoder language models", "url": "https://www.gabriel.urdhr.fr/2025/01/07/transformer-decoder-language-models/", "date_published": "2025-01-07T00:00:00+01:00", "date_modified": "2025-09-23T22:22:00+02:00", "tags": ["computer", "machine-learning", "deep-learning", "language-model", "neural-networks", "reinforcement-learning", "LLM"], "content_html": "<p>Some notes on how <a href=\"https://arxiv.org/abs/1801.10198\">transformer-decoder</a> language models work,\ntaking GPT-2 as an example,\nand with lots references in order to dig deeper.\nThis is intended both as a a roadmap for understanding on how LLMs work\n(especially the ones using a transformer-decoder architecture)\nand a a summary/recap on the topic.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2024/12/26/github-copilot-prompt/", "title": "GitHub Copilot instructions", "url": "https://www.gabriel.urdhr.fr/2024/12/26/github-copilot-prompt/", "date_published": "2024-12-26T00:00:00+01:00", "date_modified": "2024-12-26T00:00:00+01:00", "tags": ["computer", "machine-learning", "deep-learning", "language-model", "security", "LLM"], "content_html": "<p>Extracting the system prompt from GitHub CoPilot.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2024/11/20/xss-bypass/", "title": "Bypassing XSS filters", "url": "https://www.gabriel.urdhr.fr/2024/11/20/xss-bypass/", "date_published": "2024-11-20T00:00:00+01:00", "date_modified": "2024-11-20T00:00:00+01:00", "tags": ["computer", "security", "xss", "waf"], "content_html": "<p>In this post, I am describing some payloads which\nI used to bypass two distinct XSS filter implementations\n(such as Web Application Firewalls (WAF))\nas well as the approach to design them.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2024/10/22/websub-sequence-diagram/", "title": "WebSub sequence diagram", "url": "https://www.gabriel.urdhr.fr/2024/10/22/websub-sequence-diagram/", "date_published": "2024-10-22T00:00:00+02:00", "date_modified": "2024-10-22T00:00:00+02:00", "tags": ["computer", "web", "websub"], "content_html": "<p>A sequence diagram for <a href=\"https://www.w3.org/TR/websub/\">WebSub</a> (formerly PubSubHubbub).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2024/09/08/on-ad-blockers/", "title": "The FBI recommends using ad blockers", "url": "https://www.gabriel.urdhr.fr/2024/09/08/on-ad-blockers/", "date_published": "2024-09-08T00:00:00+02:00", "date_modified": "2024-09-08T00:00:00+02:00", "tags": ["computer", "web", "security", "privacy"], "content_html": "<p>An interesting note from the FBI.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2024/06/17/uma2-diagrams/", "title": "UMA 2.0 diagrams", "url": "https://www.gabriel.urdhr.fr/2024/06/17/uma2-diagrams/", "date_published": "2024-06-17T00:00:00+02:00", "date_modified": "2024-06-17T00:00:00+02:00", "tags": ["computer", "protocol", "web", "security", "oauth", "uma"], "content_html": "<p>Some diagrams (mostly sequence diagrams) about UMA 2.0.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2024/05/09/x3dh/", "title": "Notes on X3DH", "url": "https://www.gabriel.urdhr.fr/2024/05/09/x3dh/", "date_published": "2024-05-09T00:00:00+02:00", "date_modified": "2024-05-09T00:00:00+02:00", "tags": ["computer", "network", "cryptography", "diffie-hellman"], "content_html": "<p>Some notes on <a href=\"https://signal.org/docs/specifications/x3dh/\">X3DH</a> (Extended Triple Diffie-Hellman).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2024/04/13/ssh-tunnels/", "title": "OpenSSH tunneling guide", "url": "https://www.gabriel.urdhr.fr/2024/04/13/ssh-tunnels/", "date_published": "2024-04-13T00:00:00+02:00", "date_modified": "2024-07-20T02:11:29+02:00", "tags": ["computer", "network", "ssh", "unix", "network", "tun", "vpn", "linux", "socks", "foxyproxy"], "content_html": "<p>This post is an overview of the different tunneling options available in OpenSSH.\nThis is inteded as a reference to use when I am explaining\n(every so often) how to use SSH for tunneling.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/12/20/protocol-stacks/", "title": "Protocol stack diagrams", "url": "https://www.gabriel.urdhr.fr/2023/12/20/protocol-stacks/", "date_published": "2023-12-20T00:00:00+01:00", "date_modified": "2026-01-07T11:06:02+01:00", "tags": ["computer", "network"], "content_html": "<p>A collection of ASCII-art protocol stack diagrams.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/09/23/code-execution-through-kitty-open/", "title": "Arbitrary code execution through kitty-open.desktop file association", "url": "https://www.gabriel.urdhr.fr/2023/09/23/code-execution-through-kitty-open/", "date_published": "2023-09-23T00:00:00+02:00", "date_modified": "2023-09-23T00:00:00+02:00", "tags": ["computer", "security", "terminal", "kitty"], "content_html": "<p>In Debian <code>kitty</code> package, the\n<code>kitty-open.desktop</code> file would associate <code>kitty +open</code> with several MIME types.\nThis could be used to arbitrary trigger code execution by serving a\nfile with such a MIME type.</p>\n<p>This has been introduced in kitty in <a href=\"https://github.com/kovidgoyal/kitty/commit/73a197fcd\">73a197fcd</a> (2022-02-06)\nreleased as part of v0.24.3.\nThis has been fixed in v0.26.5-5 of the Debian kitty package.\nFixed upstream in\n<a href=\"https://github.com/kovidgoyal/kitty/commit/537cabca7\">537cabca7</a>\nreleased in v0.29.0.\nOther distributions\nsuch as <a href=\"https://packages.ubuntu.com/lunar/kitty\">Ubuntu Lunar</a>\nare still impacted.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/09/17/process-json-log/", "title": "Analysing structured log files with simple tools", "url": "https://www.gabriel.urdhr.fr/2023/09/17/process-json-log/", "date_published": "2023-09-17T00:00:00+02:00", "date_modified": "2023-09-17T00:00:00+02:00", "tags": ["computer", "log", "journald"], "content_html": "<p>Some tools and other notes\nwhen you just want to analyze your structured\nlog files locally using simple tools\nwith a focus for <a href=\"http://ndjson.org/\">newline-delimited JSON</a> (NDJSON) /\n<a href=\"https://jsonlines.org/\">JSON lines</a> /\n<a href=\"https://datatracker.ietf.org/doc/html/rfc7464\">JSON Text Sequences</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/08/29/simple-iterm2-image/", "title": "Simple terminal image display using the iTerm2 image protocol", "url": "https://www.gabriel.urdhr.fr/2023/08/29/simple-iterm2-image/", "date_published": "2023-08-29T00:00:00+02:00", "date_modified": "2023-08-29T00:00:00+02:00", "tags": ["computer", "terminal", "image", "python", "matplotlib"], "content_html": "<p>A simple way to display image in a terminal using the <a href=\"https://iterm2.com/documentation-images.html\">iTerm2 image protocol</a>.\nThis is supported by <a href=\"https://iterm2.com/\">iTerm2</a>,\n<a href=\"https://wezfurlong.org/wezterm/index.html\">WezTerm</a>,\nrecent versions of <a href=\"https://konsole.kde.org/\">Konsole</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/06/08/emacsclient-mail-shell-elisp-injections/", "title": "Shell command and Emacs Lisp injection in emacsclient-mail.desktop", "url": "https://www.gabriel.urdhr.fr/2023/06/08/emacsclient-mail-shell-elisp-injections/", "date_published": "2023-06-08T23:43:56+02:00", "date_modified": "2023-06-08T23:43:56+02:00", "tags": ["computer", "security", "emacs", "shell", "unix", "freedesktop"], "content_html": "<p>Shell command injection and Emacs Lisp injection vulnerabilities\nin one of the Emacs Desktop Entry (emacsclient-mail.desktop)\nleading to arbitrary code execution\nthrough a crafted <code>mailto:</code> URI.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/06/08/arbitrary-file-write-in-stellarium-file-association/", "title": "Arbitrary file write in Stellarium file association", "url": "https://www.gabriel.urdhr.fr/2023/06/08/arbitrary-file-write-in-stellarium-file-association/", "date_published": "2023-06-08T23:20:04+02:00", "date_modified": "2023-06-08T23:20:04+02:00", "tags": ["computer", "security", "vulnerability"], "content_html": "<p>I found an arbitrary file write vulnerability (through path traversal)\nwhich would be exploited\nfor arbitrary code execution in <a href=\"https://stellarium.org/\">Stellarium</a> (desktop version).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/03/07/mime-type-spoofing/", "title": "MIME-type spoofing in Firefox/Thunderbird and file managers", "url": "https://www.gabriel.urdhr.fr/2023/03/07/mime-type-spoofing/", "date_published": "2023-03-07T00:00:00+01:00", "date_modified": "2023-03-07T00:00:00+01:00", "tags": ["computer", "web", "security", "vulnerability", "firefox", "freedesktop", "thunderbird"], "content_html": "<p>An interesting spoofing attack\nresulting from the interaction\nbetween Firefox (or Thunderbird)\nMIME types handling and file managers.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/02/28/rce-file-association-debian-mono/", "title": "Code execution through MIME-type association of Mono interpreter", "url": "https://www.gabriel.urdhr.fr/2023/02/28/rce-file-association-debian-mono/", "date_published": "2023-02-28T00:00:00+01:00", "date_modified": "2023-02-28T00:00:00+01:00", "tags": ["computer", "web", "security", "vulnerability", "debian", "freedesktop", "mono"], "content_html": "<p>A dangerous file type association in <a href=\"https://www.debian.org/\">Debian</a>\nwhich could be used to trigger arbitrary code execution.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/02/19/kapnlink-linux/", "title": "Using a Kap&Link smart card reader with CPS3 smart cards on Linux", "url": "https://www.gabriel.urdhr.fr/2023/02/19/kapnlink-linux/", "date_published": "2023-02-19T00:00:00+01:00", "date_modified": "2023-02-19T00:00:00+01:00", "tags": ["computer", "linux", "device", "smart card"], "content_html": "<p>Tutorial on how to get\n<a href=\"https://industriels.esante.gouv.fr/produits-services/cps-et-socle-technique/caracteristiques-de-la-cps3\"><i lang=\"fr\">Carte Professionnel de Sant\u00e9 3</i></a> (CPS3) smart cards\nwork with Firefox under Linux\nwith a Kap&amp;Link smart card reader.\nIt has some information to understand the related lingo, how the different components interact\nand how you might try to enable support for\na PC/SC (Personal computer/Smart Card) / CCID (Chip/Smart Card Interface Devices)\nsmart card reader\nwhich is not supported by the driver.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/02/06/oauth2-diagrams/", "title": "OAuth 2.x and OpenID Connect sequence diagrams", "url": "https://www.gabriel.urdhr.fr/2023/02/06/oauth2-diagrams/", "date_published": "2023-02-06T00:00:00+01:00", "date_modified": "2026-01-09T11:59:47+01:00", "tags": ["computer", "protocol", "web", "security", "oauth", "openid-connect", "keycloak"], "content_html": "<p>Some sequence diagrams about OAuth 2.x and OpenID Connect.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/12/03/entering-podman-namespaces/", "title": "Entering in Podman containers", "url": "https://www.gabriel.urdhr.fr/2022/12/03/entering-podman-namespaces/", "date_published": "2022-12-03T00:00:00+01:00", "date_modified": "2022-12-03T00:00:00+01:00", "tags": ["computer", "linux", "system", "podman", "container", "security"], "content_html": "<p>Some commands for interacting with the <a href=\"https://man7.org/linux/man-pages/man7/namespaces.7.html\">namespaces</a>\nof <a href=\"https://podman.io/\">Podman</a> containers.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/10/13/switching-from-docker-to-podman/", "title": "Switching from Docker to Podman", "url": "https://www.gabriel.urdhr.fr/2022/10/13/switching-from-docker-to-podman/", "date_published": "2022-10-13T00:00:00+02:00", "date_modified": "2022-10-13T00:00:00+02:00", "tags": ["computer", "container", "podman", "docker"], "content_html": "<p>Some notes about using <a href=\"https://podman.io/\">Podman</a> instead of <a href=\"https://www.docker.com/\">Docker</a>,\non Linux.\nThis has been tested on Podman v3.4.7.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/08/28/trying-to-run-stable-diffusion-on-amd-ryzen-5-5600g/", "title": "Stable Diffusion on an AMD Ryzen 5 5600G", "url": "https://www.gabriel.urdhr.fr/2022/08/28/trying-to-run-stable-diffusion-on-amd-ryzen-5-5600g/", "date_published": "2022-08-28T00:00:00+02:00", "date_modified": "2022-08-28T00:00:00+02:00", "tags": ["computer", "machine-learning", "deep-learning", "generative-art", "neural-networks"], "content_html": "<p>Executing\nthe <a href=\"https://stability.ai/blog/stable-diffusion-public-release\">Stable Diffusion</a>\ntext-to-image model on an AMD Ryzen 5 5600G integrated GPU (iGPU).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/07/06/extract-schema-from-remote-ldap/", "title": "Extract the schema from a remote LDAP server", "url": "https://www.gabriel.urdhr.fr/2022/07/06/extract-schema-from-remote-ldap/", "date_published": "2022-07-06T00:00:00+02:00", "date_modified": "2022-07-06T00:00:00+02:00", "tags": ["computer", "ldap"], "content_html": "<p>How to extract the schema from a remote LDAP server\nand use it on a <a href=\"https://www.openldap.org/\">OpenLDAP</a> instance.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/06/07/impact-of-the-different-wifi-security-modes/", "title": "Impact of the different Wifi security modes", "url": "https://www.gabriel.urdhr.fr/2022/06/07/impact-of-the-different-wifi-security-modes/", "date_published": "2022-06-07T00:00:00+02:00", "date_modified": "2024-01-05T13:47:35+01:00", "tags": ["computer", "network", "wifi", "security"], "content_html": "<p>Comparing the different Wifi/WPA authentication and key distribution methods (PSK, EAP, SEA).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/05/05/browser-mediated-attacks-on-webdriver/", "title": "Browser-based attacks on WebDriver implementations", "url": "https://www.gabriel.urdhr.fr/2022/05/05/browser-mediated-attacks-on-webdriver/", "date_published": "2022-05-05T00:00:00+02:00", "date_modified": "2022-05-05T00:00:00+02:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "firefox", "dns-rebinding", "csrf"], "content_html": "<p>Some context and analysis about attacks on\nin <a href=\"https://www.w3.org/TR/webdriver/\">WebDriver</a> implementations.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/03/24/zap-no-certificate-validation/", "title": "Lack of X.509 TLS certificate validation in OWASP ZAP", "url": "https://www.gabriel.urdhr.fr/2022/03/24/zap-no-certificate-validation/", "date_published": "2022-03-24T00:00:00+01:00", "date_modified": "2022-03-24T00:00:00+01:00", "tags": ["computer", "security", "zap", "tls", "vulnerability"], "content_html": "<p>Lack of X.509 TLS certificate validation in OWASP <a href=\"https://www.zaproxy.org/\">ZAP</a>\n(Zed Attack Proxy)\ncould be used for man-in-the-middle attacks.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/03/15/dns-rebinding-readymedia/", "title": "DNS rebinding on ReadyMedia/minidlna v1.3.0 and below", "url": "https://www.gabriel.urdhr.fr/2022/03/15/dns-rebinding-readymedia/", "date_published": "2022-03-15T00:00:00+01:00", "date_modified": "2022-03-15T00:00:00+01:00", "tags": ["computer", "security", "upnp", "dns-rebinding", "vulnerability"], "content_html": "<p>A DNS rebinding vulnerability I found\nin <a href=\"https://sourceforge.net/projects/minidlna/\">ReadyMedia</a> (formerly MiniDLNA)\nv1.3.0 and below.\nThis is <a href=\"https://nvd.nist.gov/vuln/detail/CVE-2022-26505\">CVE-2022-26505</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/02/26/tls1.3-intro/", "title": "Introduction to TLS v1.3", "url": "https://www.gabriel.urdhr.fr/2022/02/26/tls1.3-intro/", "date_published": "2022-02-26T00:00:00+01:00", "date_modified": "2024-11-23T01:15:07+01:00", "tags": ["computer", "web", "network", "tls", "cryptography"], "content_html": "<p>Some notes about how <a href=\"https://datatracker.ietf.org/doc/html/rfc8446\">TLS v1.3</a> works.\nThis is a follow-up of the <a href=\"https://www.gabriel.urdhr.fr/2021/11/30/tls1.2-intro/\">previous episode</a>\nabout <a href=\"https://datatracker.ietf.org/doc/html/rfc5246\">TLS v1.2</a>.\nAs before, the goal is to have a high-level overview\nabout how the protocol works,\nwhat is the role of the different messages\nand be able to understand (and debug) a network traffic dump.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/", "title": "CSRF and DNS-rebinding to RCE in Selenium Server (Grid)", "url": "https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/", "date_published": "2022-02-07T22:15:00+01:00", "date_modified": "2022-02-07T22:15:00+01:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "csrf", "dns-rebinding"], "content_html": "<p>Vulnerabilities in found on the <a href=\"https://www.w3.org/TR/webdriver2/\">WebDriver</a>\nendpoints of Selenium Server (Grid).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/02/07/geckodriver-dns-rebinding-rce/", "title": "DNS rebinding vulnerability to RCE in GeckoDriver", "url": "https://www.gabriel.urdhr.fr/2022/02/07/geckodriver-dns-rebinding-rce/", "date_published": "2022-02-07T22:10:00+01:00", "date_modified": "2022-02-07T22:10:00+01:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "firefox", "dns-rebinding"], "content_html": "<p>A DNS rebinding vulnerability I found in\nGeckoDriver which could be used to execute arbitrary shell commands.\nThis is bug <a href=\"https://bugzilla.mozilla.org/show_bug.cgi?id=1652612\">#1652612</a>\nand <a href=\"https://nvd.nist.gov/vuln/detail/CVE-2021-4138\">CVE-2021-4138</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/11/30/tls1.2-intro/", "title": "Introduction to TLS v1.2", "url": "https://www.gabriel.urdhr.fr/2021/11/30/tls1.2-intro/", "date_published": "2021-11-30T00:00:00+01:00", "date_modified": "2024-11-23T01:15:07+01:00", "tags": ["computer", "web", "network", "tls", "cryptography"], "content_html": "<p>Some notes\nabout how <a href=\"https://datatracker.ietf.org/doc/html/rfc5246\">TLS v1.2</a>\n(Transport Layer Security) works.\nThe goal explain what is going on in a network traffic dump,\nthe role of the different TLS extensions,\nthe impact of the different cipher suites on security, etc.\nIt includes several diagrams and many references.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/10/19/diffie-hellman-intro/", "title": "Introduction to the Diffie-Hellman key exchange", "url": "https://www.gabriel.urdhr.fr/2021/10/19/diffie-hellman-intro/", "date_published": "2021-10-19T00:00:00+02:00", "date_modified": "2021-10-19T00:00:00+02:00", "tags": ["computer", "network", "cryptography", "tls", "diffie-hellman"], "content_html": "<p>The Diffie-Hellman (DH) key exchange (and variants thereof) is widely used\nin many protocols\n(such as TLS, SSH, IKE (IPSec), Signal, etc.)\nto bootstrap some symmetric key material\nwhich may then be used to secure communication channel between two parties.\nThis introduction\nfocuses on the different ways the DH key exchange\nis used in practice\nin several protocols (especially TLS)\nand the impact of these different approaches on the security.\nThis is intended as a prelude for the upcoming <a href=\"https://www.gabriel.urdhr.fr/2021/11/30/tls1.2-intro/\">next episodes</a>\nabout how TLS works.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/09/22/whats-in-my-covid-cert/", "title": "What is in my COVID-19 vaccination certificate?", "url": "https://www.gabriel.urdhr.fr/2021/09/22/whats-in-my-covid-cert/", "date_published": "2021-09-22T00:00:00+02:00", "date_modified": "2021-09-22T00:00:00+02:00", "tags": ["computer", "covid-19", "cbor", "cwt", "cose", "hcert", "privacy"], "content_html": "<p>Manually inspecting the content of a French COVID-19 vaccination certificate QR code.\nThe main intent is to show with a concrete example\nwhich data is actually included in the certificate.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/08/16/chromedriver-cross-origin-request-forgery-rce/", "title": "Cross-origin/same-site request forgery to RCE in chromedriver", "url": "https://www.gabriel.urdhr.fr/2021/08/16/chromedriver-cross-origin-request-forgery-rce/", "date_published": "2021-08-16T23:22:56+02:00", "date_modified": "2022-02-13T23:19:32+01:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "csrf"], "content_html": "<p>I found a cross-origin/same-site request forgery vulnerability\nin chromedriver.\nIt was <a href=\"https://bugs.chromium.org/p/chromium/issues/detail?id=1100097\">rejected</a> (won't fix) because it is only\npossible to trigger this from the cross-origin/same-site and not cross-site.\nIn practice, it means it is really only possible to trigger this from another\nlocalhost-bound web application.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/08/16/geckodriver-csrf-rce/", "title": "CSRF to RCE in GeckoDriver", "url": "https://www.gabriel.urdhr.fr/2021/08/16/geckodriver-csrf-rce/", "date_published": "2021-08-16T23:00:48+02:00", "date_modified": "2021-08-16T23:00:48+02:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "firefox", "csrf"], "content_html": "<p>A Cross-Site Request Forgery (CSRF) vulnerability I found in\nGeckoDriver which could be used to execute arbitrary shell commands.\n<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-15660\">CVE-2020-15660</a>\nhas been assigned to this vulnerability.\nThis was fixed by <a href=\"https://github.com/mozilla/geckodriver/releases/tag/v0.27.0\">GeckoDriver v0.27.0</a>\nin 2020-07-27.\nThis is <a href=\"https://bugzilla.mozilla.org/show_bug.cgi?id=1648964\">bug #1648964</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/06/24/gupnp-dns-rebinding/", "title": "DNS rebinding vulnerability in GUPnP", "url": "https://www.gabriel.urdhr.fr/2021/06/24/gupnp-dns-rebinding/", "date_published": "2021-06-24T00:00:00+02:00", "date_modified": "2021-07-05T18:50:55+02:00", "tags": ["computer", "security", "upnp", "dns-rebinding", "vulnerability"], "content_html": "<p>GUPnP, a GNOME library for Universal Plug and Play (UPnP),\nwas vulnerable to <a href=\"https://www.gabriel.urdhr.fr/2021/06/02/dns-rebinding-explained/\">DNS rebinding</a> attacks.\nThis is <a href=\"https://nvd.nist.gov/vuln/detail/CVE-2021-33516\">CVE-2021-33516</a>\nand <a href=\"https://gitlab.gnome.org/GNOME/gupnp/-/issues/24\">GUPnP issue #24</a>.\nThis <a href=\"https://discourse.gnome.org/t/security-relevant-releases-for-gupnp-issue-cve-2021-33516/6536/3\">was fixed</a>\nin GUPnP 1.0.7 and GUPnP 1.2.5.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/06/12/pupnp-dns-rebinding/", "title": "DNS rebinding vulnerability in pupnp and npupnp", "url": "https://www.gabriel.urdhr.fr/2021/06/12/pupnp-dns-rebinding/", "date_published": "2021-06-12T00:00:00+02:00", "date_modified": "2021-06-12T00:00:00+02:00", "tags": ["computer", "security", "upnp", "dns-rebinding", "vulnerability"], "content_html": "<p>I found that <a href=\"https://github.com/pupnp/pupnp\">pupnp</a> was vulnerable to DNS rebinding attacks.\n<a href=\"https://framagit.org/medoc92/npupnp\">npupnp</a>, a fork a pupnp, was impacted as well.\nThis is demonstrated using Gerbera a UPnP MediaServer.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/06/02/dns-rebinding-explained/", "title": "DNS rebinding explained", "url": "https://www.gabriel.urdhr.fr/2021/06/02/dns-rebinding-explained/", "date_published": "2021-06-02T00:00:00+02:00", "date_modified": "2021-06-02T00:00:00+02:00", "tags": ["computer", "security", "dns-rebinding", "dns"], "content_html": "<p>A quick summary about how DNS rebinding attacks work.\nThe main motivation for this post is to have\na diagram to show when explaining DNS-rebinding attacks.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/05/08/tuntap/", "title": "TUN/TAP interface (on Linux)", "url": "https://www.gabriel.urdhr.fr/2021/05/08/tuntap/", "date_published": "2021-05-08T00:00:00+02:00", "date_modified": "2021-05-08T00:00:00+02:00", "tags": ["computer", "system", "network", "tun", "tap", "linux", "vpn"], "content_html": "<p>Some notes about using the TUN/TAP interface, especially on Linux.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/04/05/firefox-doh-dns-rebinding-protection-bypass/", "title": "Firefox DoH DNS rebinding protection bypass using IPv4-mapped addresses", "url": "https://www.gabriel.urdhr.fr/2021/04/05/firefox-doh-dns-rebinding-protection-bypass/", "date_published": "2021-04-05T00:00:00+02:00", "date_modified": "2021-04-05T00:00:00+02:00", "tags": ["computer", "security", "vulnerability", "web", "dns-rebinding", "firefox"], "content_html": "<p>I found that\nthe filtering of private IPv4 addresses\nin the <a href=\"https://tools.ietf.org/html/rfc8484\">DNS-over-HTTPS</a> (DoH) implementation of Firefox could by bypassed.\nThis is <a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-26961\">CVE-2020-26961</a>\nand <a href=\"https://bugzilla.mozilla.org/show_bug.cgi?id=1672528\">Mozilla bug 1672528</a>.\nIt has been fixed in <a href=\"https://www.mozilla.org/en-US/security/advisories/mfsa2020-50/\">Firefox 83</a>,\n<a href=\"https://www.mozilla.org/en-US/security/advisories/mfsa2020-51/\">Firefox ESR 78.5</a>\nand <a href=\"https://www.mozilla.org/en-US/security/advisories/mfsa2020-52/\">Thunderbird 78.5</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/03/22/introduction-to-upnp/", "title": "Introduction to UPnP", "url": "https://www.gabriel.urdhr.fr/2021/03/22/introduction-to-upnp/", "date_published": "2021-03-22T23:24:42+01:00", "date_modified": "2021-03-22T23:24:42+01:00", "tags": ["computer", "network", "upnp", "security", "csrf", "dns-rebinding"], "content_html": "<p>This post gives simple explanations of how UPnP (Universal Plug-and-Play) works,\nespecially with the goal of testing the security devices\nsuch as <a href=\"https://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/\">routers</a>,\n<a href=\"https://www.gabriel.urdhr.fr/samsung-tv-upnp-dns-rebinding/\">smart TVs</a>, etc.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/03/22/samsung-tv-dial/", "title": "DNS rebinding and CSRF vulnerabilites on Samsung TV DIAL implementation", "url": "https://www.gabriel.urdhr.fr/2021/03/22/samsung-tv-dial/", "date_published": "2021-03-22T23:17:24+01:00", "date_modified": "2021-03-22T23:17:24+01:00", "tags": ["computer", "security", "vulnerability", "dial", "dns-rebinding", "csrf"], "content_html": "<p>I found\na DNS rebinding vulnerability as well as a Cross Site Request Forgery\n(CSRF) vulnerability\non the <a href=\"http://www.dial-multiscreen.org/\">DIAL</a> (Discovery And Launch)\nimplementation of the Samsung TV UE40F6320 (v1.0), from 2011.\nThis can be used to open any installed application (eg. Netflix and Youtube)\nand force the vizualisation of a given video in the applications.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/03/22/samsung-tv-upnp-dns-rebinding/", "title": "DNS rebinding vulnerability in Samsung SmartTV UPnP", "url": "https://www.gabriel.urdhr.fr/2021/03/22/samsung-tv-upnp-dns-rebinding/", "date_published": "2021-03-22T23:15:29+01:00", "date_modified": "2021-03-22T23:15:29+01:00", "tags": ["computer", "security", "vulnerability", "dns-rebinding", "upnp"], "content_html": "<p>I found\na DNS rebinding vulnerability on the Universal Plug-and-Play (UPnP)\ninterface of the Samsung TV UE40F6320 (v1.0), from 2011.\nThis could be used, for example, to change the channel, to know\nwhich channel is currently used or open the builtin browser to any URI.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/03/17/frida-disable-certificate-check-on-android/", "title": "Disable certificate verification on Android with Frida", "url": "https://www.gabriel.urdhr.fr/2021/03/17/frida-disable-certificate-check-on-android/", "date_published": "2021-03-17T00:00:00+01:00", "date_modified": "2021-03-17T00:00:00+01:00", "tags": ["computer", "system", "security", "android", "frida", "tls", "reverse-engineering"], "content_html": "<p>Some notes about how to write a <a href=\"https://frida.re/\">Frida</a> script\nwith the (somewhat classic) example of disabling certificate verification\nfor TLS communications on Android applications.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/", "title": "DNS rebinding vulnerabilities in Freebox", "url": "https://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/", "date_published": "2020-09-23T00:00:00+02:00", "date_modified": "2020-09-23T00:00:00+02:00", "tags": ["computer", "security", "vulnerability", "web", "upnp", "dns-rebinding", "csrf", "device"], "content_html": "<p>I found some <a href=\"https://nitter.net/RedTeamPT/status/1318165465429061633\">DNS rebinding</a> vulnerabilities in <a href=\"https://www.free.fr/freebox/\">Freebox</a> devices\n(<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24374\">CVE-2020-24374</a>,\n<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24375\">CVE-2020-24375</a>,\n<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24376\">CVE-2020-24376</a>,\n<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24377\">CVE-2020-24377</a>)\nas well as a Cross Site Request Forgery (CSRF) vulnerability\n(<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24373\">CVE-2020-24373</a>).\nThese vulnerabilities were <a href=\"https://dev.freebox.fr/blog/?p=10222\">fixed in 2020-08-05</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2020/04/20/linux-host-name-resolution/", "title": "GNU/Linux host name resolution", "url": "https://www.gabriel.urdhr.fr/2020/04/20/linux-host-name-resolution/", "date_published": "2020-04-20T00:00:00+02:00", "date_modified": "2020-04-20T00:00:00+02:00", "tags": ["computer", "network", "dns", "system"], "content_html": "<p>This post describes different software components\ninvolved in host name resolutions and DNS configuration on GNU/Linux systems.\nIt consists of a diagram and some accompanying explanations.\nThe goal is to give some pointers and references to understand\nhow to troubleshoot host name/DNS resolution problems\nand configuration problems on GNU/Linux systems.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2020/04/11/push-to-talk-in-any-application/", "title": "Push-to-talk in any application", "url": "https://www.gabriel.urdhr.fr/2020/04/11/push-to-talk-in-any-application/", "date_published": "2020-04-11T00:00:00+02:00", "date_modified": "2020-04-11T00:00:00+02:00", "tags": ["computer", "unix", "gui", "pulseaudio", "x11", "covid-19"], "content_html": "<p>Some scripts I wrote to enable system-wide <a href=\"https://en.wikipedia.org/wiki/Push-to-talk\">push-to-talk</a>\n(for X11 and <a href=\"https://www.freedesktop.org/wiki/Software/PulseAudio/\">PulseAudio</a>).\nSome people might find it useful for the ongoing lockdown.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2020/03/17/systemd-revolved-dns-configuration-for-vpn/", "title": "Systemd-resolved DNS configuration for VPN", "url": "https://www.gabriel.urdhr.fr/2020/03/17/systemd-revolved-dns-configuration-for-vpn/", "date_published": "2020-03-17T00:00:00+01:00", "date_modified": "2020-03-17T00:00:00+01:00", "tags": ["computer", "vpn", "dns", "systemd", "covid-19"], "content_html": "<p>Some guidance about configuring/fixing domain name resolution\nwith a corporate Virtual Private Network (VPN),\nespecially OpenVPN and with systemd-based Linux systems.\nThis configuration uses the internal/private corporate resolvers\nfor resolving internal/private domain names\nwhile using the ISP resolver for general domain names.\nThis might help if your VPN is struggling these days\nbecause of the COVID-19 threat \ud83d\ude37.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2019/11/18/flamegraph-disk-usage/", "title": "Disk usage with FlameGraph", "url": "https://www.gabriel.urdhr.fr/2019/11/18/flamegraph-disk-usage/", "date_published": "2019-11-18T00:00:00+01:00", "date_modified": "2019-11-18T00:00:00+01:00", "tags": ["computer", "flamegraph"], "content_html": "<p>Using <a href=\"https://github.com/brendangregg/FlameGraph\">FlameGraph</a>\nfor displaying disk usage.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2019/04/02/llmnr-mdns-cli-lookup/", "title": "Using dig as a LLMNR or mDNS CLI lookup utility", "url": "https://www.gabriel.urdhr.fr/2019/04/02/llmnr-mdns-cli-lookup/", "date_published": "2019-04-02T00:00:00+02:00", "date_modified": "2023-09-22T14:20:00+02:00", "tags": ["computer", "network", "dns", "llmnr", "mdns"], "content_html": "<p>I was looking for a LLMNR commandline lookup utility.\nActually, <code>dig</code> can do the job quite fine.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2019/03/29/surprising-shell-pathname-expansion/", "title": "Surprising shell pathname expansion", "url": "https://www.gabriel.urdhr.fr/2019/03/29/surprising-shell-pathname-expansion/", "date_published": "2019-03-29T00:00:00+01:00", "date_modified": "2019-03-29T00:00:00+01:00", "tags": ["computer", "unix", "shell"], "content_html": "<p>I thought I was understanding pretty well how bash argument processing and\nvarious expansions is supposed to behave. Apparently, there are still\nsubtleties which tricks me, sometimes.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2019/02/12/yunohost-rce-csrf/", "title": "Remote code execution via cross site request forgery in InternetCube and YunoHost", "url": "https://www.gabriel.urdhr.fr/2019/02/12/yunohost-rce-csrf/", "date_published": "2019-02-12T00:00:00+01:00", "date_modified": "2019-02-12T00:00:00+01:00", "tags": ["computer", "web", "security", "yunohost", "csrf", "vulnerability"], "content_html": "<p>How I found remote code execution vulnerabilities\nvia <a href=\"https://marc.info/?l=bugtraq&amp;m=99263135911884&amp;w=2\">Cross Site Request Forgery</a> (CSRF)\non the administration interfaces\nof <a href=\"https://labriqueinter.net/\">InternetCube</a> applications\nand of the <a href=\"https://yunohost.org/\">YunoHost</a> administration interface\nwhich could have been used to execute arbitrary code as root.\nThese vulnerabilities were fixed in YunoHost 3.3, OpenVPN Client app 1.3.0.\nand YunoHost 3.4.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2018/11/26/document-generation-workflow/", "title": "My document generation workflow with Markdown, YAML, Jinja2 and WeasyPrint", "url": "https://www.gabriel.urdhr.fr/2018/11/26/document-generation-workflow/", "date_published": "2018-11-26T00:00:00+01:00", "date_modified": "2018-11-26T00:00:00+01:00", "tags": ["computer", "python"], "content_html": "<p>Here is the workflow I am using to generate simple text documents\n(resume, cover letters, etc.) from Markdown, YAML and Jinja2 templates.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2018/11/22/south-park-ip-address-spoofing/", "title": "IP address spoofing in order to watch South Park", "url": "https://www.gabriel.urdhr.fr/2018/11/22/south-park-ip-address-spoofing/", "date_published": "2018-11-22T00:00:00+01:00", "date_modified": "2018-11-22T00:00:00+01:00", "tags": ["computer", "web", "hack", "firefox"], "content_html": "<p>Trying to bring back some old IP spoofing Firefox extension\nfor watching South Park episodes.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2018/05/30/more-browser-injections/", "title": "More example of argument and shell command injections in browser invocation", "url": "https://www.gabriel.urdhr.fr/2018/05/30/more-browser-injections/", "date_published": "2018-05-30T00:00:00+02:00", "date_modified": "2018-05-30T00:00:00+02:00", "tags": ["computer", "unix", "debian", "security", "shell", "vulnerability"], "content_html": "<p>In the <a href=\"https://www.gabriel.urdhr.fr/2018/05/28/browser-injections/\">previous episode</a>, I talked about\nsome argument and shell command injections vulnerabilities\nthrough URIs passed to browsers.\nHere I am evaluating some other CVEs\nwhich were registered at the same time (not by me).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2018/05/28/browser-injections/", "title": "Argument and shell command injections in browser invocation", "url": "https://www.gabriel.urdhr.fr/2018/05/28/browser-injections/", "date_published": "2018-05-28T00:00:00+02:00", "date_modified": "2018-05-28T00:00:00+02:00", "tags": ["computer", "unix", "debian", "security", "shell", "vulnerability", "freedesktop"], "content_html": "<p>I found an argument injection vulnerability\nrelated to the  handling of the <code>BROWSER</code> environment variable\nin <code>sensible-browser</code>.\nThis lead me (and others) to a few other arguments and shell command injection\nvulnerabilities in <code>BROWSER</code> processing and browser invocation in general.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2018/03/19/sibling-tco-in-python/", "title": "Sibling tail call optimization in Python", "url": "https://www.gabriel.urdhr.fr/2018/03/19/sibling-tco-in-python/", "date_published": "2018-03-19T00:00:00+01:00", "date_modified": "2018-03-19T00:00:00+01:00", "tags": ["computer", "python", "functional"], "content_html": "<p>In <a href=\"http://chrispenner.ca/posts/python-tail-recursion\">Tail Recursion In Python</a>,\n<a href=\"http://chrispenner.ca/posts/python-tail-recursion\">Chris Penner</a>\nimplements (self) tail-call optimization (TCO) in Python using a function decorator.\nHere I am extending the approach for sibling calls.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2017/08/02/foo-over-ssh/", "title": "Foo over SSH", "url": "https://www.gabriel.urdhr.fr/2017/08/02/foo-over-ssh/", "date_published": "2017-08-02T00:00:00+02:00", "date_modified": "2017-08-02T00:00:00+02:00", "tags": ["computer", "network", "ssh", "unix"], "content_html": "<p>A comparison of the different solutions for using SSH2 as a secured\ntransport for protocols/services/applications.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2016/10/18/terminal-sharing/", "title": "Terminal read-only live sharing", "url": "https://www.gabriel.urdhr.fr/2016/10/18/terminal-sharing/", "date_published": "2016-10-18T00:00:00+02:00", "date_modified": "2017-05-06T00:00:00+02:00", "tags": ["computer", "unix", "ssh", "screen"], "content_html": "<p>Live sharing a terminal session to another (shared) host over SSH in\nread-only mode.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2016/08/07/openssh-proxyusefdpass/", "title": "OpenSSH ProxyUseFdPass", "url": "https://www.gabriel.urdhr.fr/2016/08/07/openssh-proxyusefdpass/", "date_published": "2016-08-07T00:00:00+02:00", "date_modified": "2025-03-28T15:37:22+01:00", "tags": ["computer", "network", "system", "ssh", "python", "unix"], "content_html": "<p>While looking at the OpenSSH <code>ssh_config</code> manpage, I found the\n<code>ProxyUseFdpass</code> configuration I did not know about.\nIt is apparently not widely known or used.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2016/08/01/simgrid-synchronisation/", "title": "C++ synchronisations for SimGrid", "url": "https://www.gabriel.urdhr.fr/2016/08/01/simgrid-synchronisation/", "date_published": "2016-08-01T00:00:00+02:00", "date_modified": "2016-08-01T00:00:00+02:00", "tags": ["computer", "simgrid", "c++", "future"], "content_html": "<p>This is an overview of some recent additions to the SimGrid code\nrelated to actor synchronisation. It might be interesting for people\nusing SimGrid, working on SimGrid or for people interested in generic\nC++ code for synchronisation or asynchronicity.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2016/07/11/intel-amt-discovery/", "title": "Intel AMT discovery", "url": "https://www.gabriel.urdhr.fr/2016/07/11/intel-amt-discovery/", "date_published": "2016-07-11T00:00:00+02:00", "date_modified": "2020-11-19T13:29:26+01:00", "tags": ["computer", "amt", "python", "security"], "content_html": "<p>There has been some articles lately about Intel Active Management Technology (AMT)\nand its impact on\n<a href=\"http://invisiblethingslab.com/press/itl-press-2009-03.pdf\">security</a>,\ntrust,\nprivacy\nand <a href=\"https://www.fsf.org/blogs/community/active-management-technology\">free-software</a>.\nAMT supposed to be widely deployed in newest Intel hardware.\nSo I wanted to see if I could find some AMT devices in the wild.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2016/03/25/cloc-with-flamegraph/", "title": "Number of lines of code with FlameGraph", "url": "https://www.gabriel.urdhr.fr/2016/03/25/cloc-with-flamegraph/", "date_published": "2016-03-25T00:00:00+01:00", "date_modified": "2016-03-25T00:00:00+01:00", "tags": ["computer", "simgrid"], "content_html": "<p><a href=\"https://github.com/brendangregg/FlameGraph\">FlameGraph</a>\nis used to display stack trace samples but we can ue it for\nother purposes as well.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2016/01/12/ip-over-udp-with-socat/", "title": "IP over UDP tunnel with socat", "url": "https://www.gabriel.urdhr.fr/2016/01/12/ip-over-udp-with-socat/", "date_published": "2016-01-12T00:00:00+01:00", "date_modified": "2016-01-12T00:00:00+01:00", "tags": ["computer", "network", "vpn", "tun"], "content_html": "<p>A simple way to create <a href=\"http://sites.inka.de/~W1011/devel/tcp-tcp.html\">IP over\nUDP</a> tunnels using\n<code>socat</code>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/12/09/dns-aggregator-tls/", "title": "DNS aggregation over TLS", "url": "https://www.gabriel.urdhr.fr/2015/12/09/dns-aggregator-tls/", "date_published": "2015-12-09T00:00:00+01:00", "date_modified": "2015-12-09T00:00:00+01:00", "tags": ["computer", "dns", "network", "tls", "privacy"], "content_html": "<p>In a <a href=\"https://www.gabriel.urdhr.fr/2015/02/14/recursive-dns-over-tls-over-tcp-443/\">previous\npost</a>, I tried\ndifferent solutions for tunnelling <a href=\"https://ant.isi.edu/tdns/index.html\">DNS over\nTLS</a>.  One of those solutions was\nusing a <a href=\"https://github.com/randomstuff/truncatednsd\">dedicated DNS-over-UDP fake\nservice</a> replying to all\nqueries with the truncate flag set: this was causing the stub\nresolvers to retry the query using a TCP-based virtual-circuit. This\nsolution is interesting because it is dead simple (it fits in a few\nline of codes) but it is clearly a hack. Here, I am using a dedicated\n<a href=\"https://github.com/randomstuff/dnsfwd\">DNS forwarder</a> aggregating all\nthe incoming DNS-over-UDP requests over a single persistent TCP\nvirtual-circuit.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/11/25/rr-use-after-free/", "title": "Debugging use-after-free with RR reverse execution", "url": "https://www.gabriel.urdhr.fr/2015/11/25/rr-use-after-free/", "date_published": "2015-11-25T00:00:00+01:00", "date_modified": "2015-11-25T00:00:00+01:00", "tags": ["computer", "debug", "gdb", "rr", "simgrid"], "content_html": "<p><a href=\"http://rr-project.org/\">RR</a> is a very useful tool for debugging. It\ncan record the execution of a program and then replay the exact same\nexecution at will inside a debugger. One very useful extra power\navailable since 4.0 is the support for <a href=\"http://robert.ocallahan.org/2015/10/rr-40-released-with-reverse-execution.html\">efficient reverse\nexecution</a>\nwhich can be used to find the root cause of a bug in your program\nby rewinding time. In this example, we reverse-execute a program from a\ncase of use-after-free in order to find where the block of memory was\nfreed.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/10/12/mutt-multiaccount/", "title": "Multiple accounts with mutt", "url": "https://www.gabriel.urdhr.fr/2015/10/12/mutt-multiaccount/", "date_published": "2015-10-12T00:00:00+02:00", "date_modified": "2015-10-12T00:00:00+02:00", "tags": ["computer", "mutt", "email"], "content_html": "<p>If you try to use mutt, you will wonder how you are supposed to <a href=\"https://www.df7cb.de/blog/2010/Using_multiple_IMAP_accounts_with_Mutt.html\">handle\nmultiple\naccounts</a>.\nYou will find suggestions to bind some keys to switch to different\naccounts, use hooks.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/09/29/private-postgresql/", "title": "Private PostgreSQL instance", "url": "https://www.gabriel.urdhr.fr/2015/09/29/private-postgresql/", "date_published": "2015-09-29T00:00:00+02:00", "date_modified": "2022-12-06T00:47:56+01:00", "tags": ["computer", "sql", "postgres"], "content_html": "<p>How to create a private on-demand PostgreSQL instance accessible only\nfor the local user over UNIX socket.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/09/28/elf-file-format/", "title": "The ELF file format", "url": "https://www.gabriel.urdhr.fr/2015/09/28/elf-file-format/", "date_published": "2015-09-28T00:00:00+02:00", "date_modified": "2015-09-28T00:00:00+02:00", "tags": ["computer", "system", "elf", "linker", "dwarf"], "content_html": "<p>Some notes on the ELF \ud83e\udddd file format with references, explanations and\nsome examples.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/09/01/simgrid-mc-rewrite/", "title": "SimGridMC: The Big Split (and Cleanup)", "url": "https://www.gabriel.urdhr.fr/2015/09/01/simgrid-mc-rewrite/", "date_published": "2015-09-01T00:00:00+02:00", "date_modified": "2015-09-01T00:00:00+02:00", "tags": ["computer", "simgrid", "system"], "content_html": "<p><a href=\"https://www.gabriel.urdhr.fr/2015/01/06/simgrid-mc-isolation/\">In my previous SimGrid post</a>, I\ntalked about different solutions for a better isolation between the\nmodel-checked application and the model-checker.  We chose to avoid\nthe (hackery) solution based multiple dynamic-linker namespaces in the\nsame process and use a more conventional process-based isolation.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/08/16/ftl-data/", "title": "FTL data file", "url": "https://www.gabriel.urdhr.fr/2015/08/16/ftl-data/", "date_published": "2015-08-16T00:00:00+02:00", "date_modified": "2015-08-16T00:00:00+02:00", "tags": ["computer", "video-game", "ftl", "reverse-engineering"], "content_html": "<p><a href=\"http://www.ftlgame.com/\">Faster Than Light</a> (FTL)\nis a very nice (and quite difficult)\nrogue-like-ish game with space battles, teleporters, management of the energy of\nyour ship, asteroid fields, alien species, droids (drones), etc.\nIt is quite cheap, <a href=\"https://defectivebydesign.org/\">DRM-free</a>\nand available natively on Intel-based GNU/Linux.\nThese are notes taken while trying to find out the format of the <code>.dat</code> files of\nthe game containing the game assets, ships statistics, events, etc.\nwhen I had not access to the internet to find the solution.\nThere is a companion C program, <a href=\"https://github.com/randomstuff/ftldat\">ftldat</a>,\nfor extracting the files within the archives and generating archives.\nUnsurprisingly, <a href=\"https://github.com/bwesterb/ftldat\">similar tools</a>\nwith the same name already exists. However, the description of the process\nof reverse-engineering a (very simple) binary format might be interesting for\nsomeone out there.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/07/29/i-can-has-systray/", "title": "I can has systray?", "url": "https://www.gabriel.urdhr.fr/2015/07/29/i-can-has-systray/", "date_published": "2015-07-29T00:00:00+02:00", "date_modified": "2015-07-29T00:00:00+02:00", "tags": ["computer", "gui", "kde"], "content_html": "<p>In Plasma 5, support for the <a href=\"http://standards.freedesktop.org/xembed-spec/xembed-spec-latest.html\">XEmbed</a>-based\n<a href=\"http://standards.freedesktop.org/systemtray-spec/systemtray-spec-latest.html\">\u201clegacy\u201d systray protocol</a>\nwas removed:\nonly the <a href=\"http://www.freedesktop.org/wiki/Specifications/StatusNotifierItem/\">new SNI protocol</a> is handled.\nHowever, a lot of applications still do not handle the new protocol:\nQt4 and Qt5 applications <a href=\"http://www.aegiap.eu/kdeblog/2015/02/comment-avoir-le-systray-sous-plasma5/\">can be fixed</a>\nby installing the <code>sni-qt</code> (currently in experimental) and <code>libdbusmenu-qt5</code> respectively\nbut other applications (such as GTK ones) must be patched/recompiled with SNI support.\nWithout this, windows disappear into oblivion \ud83d\ude3f.\nYou can have a seamless systray-enabled Plasma panel\nwith a single (OK, two) line of shell \ud83d\ude3c.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/07/04/html-pipeline-middleman/", "title": "Use HTML pipeline in Middleman", "url": "https://www.gabriel.urdhr.fr/2015/07/04/html-pipeline-middleman/", "date_published": "2015-07-04T00:00:00+02:00", "date_modified": "2015-07-04T00:00:00+02:00", "tags": ["computer", "middleman", "ruby", "html", "emoji", "markdown", "web"], "content_html": "<p>How to use <a href=\"https://github.com/jch/html-pipeline\"><code>html-pipeline</code></a> in\n<a href=\"https://middlemanapp.com/\">middleman</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/05/29/core-file/", "title": "Anatomy of an ELF core file", "url": "https://www.gabriel.urdhr.fr/2015/05/29/core-file/", "date_published": "2015-05-29T00:00:00+02:00", "date_modified": "2015-05-29T00:00:00+02:00", "tags": ["computer", "system", "elf", "coredump"], "content_html": "<p>The Executable and Linkable Format (ELF) \ud83e\udddd is used for\ncompilation outputs (<code>.o</code> files), executables, shared libraries and core dumps.\nThe first cases are documented in the <a href=\"http://www.sco.com/developers/devspecs/gabi41.pdf\">System V ABI\nspecification</a>\nand the <a href=\"http://refspecs.linuxbase.org/elf/elf.pdf\">Tools Interface Standard (TIS) ELF\nspecification</a> but there does not\nseem to be much documentation about the usage of the ELF format for core dumps.\nHere are some notes on this.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/05/10/verify-a-debian-cd/", "title": "Verifying authenticity of Debian CDs", "url": "https://www.gabriel.urdhr.fr/2015/05/10/verify-a-debian-cd/", "date_published": "2015-05-10T00:00:00+02:00", "date_modified": "2015-05-10T00:00:00+02:00", "tags": ["computer", "debian"], "content_html": "<p>The <a href=\"https://www.debian.org/CD/verify\">official guide</a> for verifying\nthe authenticity of a Debian \ud83c\udf65 CD image is not so clear if you don't\nalready have an idea about what you are doing. Here is a translation in\nterms of shell commands.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/04/29/journald-workflow/", "title": "Logging message workflow with journald", "url": "https://www.gabriel.urdhr.fr/2015/04/29/journald-workflow/", "date_published": "2015-04-29T00:00:00+02:00", "date_modified": "2020-07-30T23:00:00+02:00", "tags": ["computer", "system", "log", "syslog", "systemd", "journald"], "content_html": "<p>A short summary of the logging message workflow with\n<a href=\"http://www.freedesktop.org/software/systemd/man/systemd-journald.service.html\">systemd-journald</a>\n(and the different formats and sockets involved).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/03/29/update-firefox-os/", "title": "Updating Firefox OS", "url": "https://www.gabriel.urdhr.fr/2015/03/29/update-firefox-os/", "date_published": "2015-03-29T00:00:00+01:00", "date_modified": "2015-03-29T00:00:00+01:00", "tags": ["computer", "firefox"], "content_html": "<p>I updated a <a href=\"http://www.geeksphone.com/\">Geeksphone</a> Peak from\n<a href=\"https://www.mozilla.org/fr/firefox/os/\">Firefox OS</a> 1.1 to Firefox OS\n2.1 and it was not that easy.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/03/02/bundler-starter-kit/", "title": "Bundler starter kit", "url": "https://www.gabriel.urdhr.fr/2015/03/02/bundler-starter-kit/", "date_published": "2015-03-02T00:00:00+01:00", "date_modified": "2015-03-02T00:00:00+01:00", "tags": ["computer", "ruby"], "content_html": "<p><a href=\"http://bundler.io/\">Bundler</a> is a tool to manage Ruby gem\ndependencies, install them and setup the execution environment. The\nhomepage shows how to use it to install the gems alongside the ruby\ninstallation/systemwide which is not so great. For some reason, I\ninitially didn't find the option to install the gems locally\n(<code>--path</code>) and have been using horrible environment variable\nmodifications to avoid the systemwide installation. In fact, this is\nquite simple\u2026</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/02/15/broadband-protocol-stack/", "title": "The broadband protocol stacks", "url": "https://www.gabriel.urdhr.fr/2015/02/15/broadband-protocol-stack/", "date_published": "2015-02-15T00:00:00+01:00", "date_modified": "2021-05-25T21:27:22+02:00", "tags": ["computer", "network", "broadband", "dsl"], "content_html": "<p>The Broadband Forum as a lot of <a href=\"http://www.broadband-forum.org/technical/trlist.php\">technical\nreports</a> about\nthe xDSL architecture but it is not so easy to find a good description\nof the global architecture. Those are ASCII-art protocol stack I\ninferred from those documents. What is in there may be wrong, feel free\nto correct me.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/02/14/recursive-dns-over-tls-over-tcp-443/", "title": "Recursive DNS over TLS over TCP 443", "url": "https://www.gabriel.urdhr.fr/2015/02/14/recursive-dns-over-tls-over-tcp-443/", "date_published": "2015-02-14T00:00:00+01:00", "date_modified": "2019-12-13T00:53:18+01:00", "tags": ["computer", "network", "dns", "tls", "privacy"], "content_html": "<p>You might want to use an open recursive DNS servers if your ISP's DNS\nserver is lying. However, if your network/ISP is intercepting all DNS\nrequests, a standard open recursive DNS server won't help. You might\nhave more luck by using an alternative port or by forcing the usage of\nTCP (<code>use-vc</code> option in recent versions of glibc) but it might not\nwork. Alternatively, you could want to talk to a (trusted) remote\nrecursive DNS server over secure channel such as TLS: by using DNS\nover TLS over TCP port 443 (the HTTP/TLS port), you should be able to\navoid most filtering between you and the recursive server.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/01/22/elf-linking/", "title": "ELF loading and dynamic linking", "url": "https://www.gabriel.urdhr.fr/2015/01/22/elf-linking/", "date_published": "2015-01-22T00:00:00+01:00", "date_modified": "2015-01-22T00:00:00+01:00", "tags": ["computer", "system", "elf", "linker", "linux", "multiarch"], "content_html": "<p>Some notes on ELF \ud83e\udddd loading and dynamic linking mainly for GNU userland\n(<code>ld.so</code>, <code>libc</code>, <code>libdl</code>) running on top of the Linux kernel. Some\nprior knowlegde on the topic (virtual memory, shared objects,\nsections) might be useful to understand this.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/01/15/recover-a-password-in-a-process-memory/", "title": "Recover a (forgotten) password in a process memory", "url": "https://www.gabriel.urdhr.fr/2015/01/15/recover-a-password-in-a-process-memory/", "date_published": "2015-01-15T00:00:00+01:00", "date_modified": "2015-01-15T00:00:00+01:00", "tags": ["computer", "system", "thunderbird"], "content_html": "<p>Today, I managed to forget a password but I had a Icedove (Thunderbird) process\nrunning containing the password.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/01/11/logstash-vhost-combined/", "title": "nginx, Logstash and vhost-combined log format", "url": "https://www.gabriel.urdhr.fr/2015/01/11/logstash-vhost-combined/", "date_published": "2015-01-11T00:00:00+01:00", "date_modified": "2015-01-11T00:00:00+01:00", "tags": ["computer", "log", "apache", "nginx"], "content_html": "<p>The Apache HTTP server ships with a\n<a href=\"http://httpd.apache.org/docs/2.4/programs/split-logfile.html\"><code>split-logfile</code></a>\nutility which parses Combined Log File entries prefixed with the virtual host:\nsome notes about this and its inclusion in nginx and\n<a href=\"http://logstash.net/\">logstash</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/01/06/simgrid-mc-isolation/", "title": "Better isolation for SimGridMC", "url": "https://www.gabriel.urdhr.fr/2015/01/06/simgrid-mc-isolation/", "date_published": "2015-01-06T00:00:00+01:00", "date_modified": "2015-01-06T00:00:00+01:00", "tags": ["simgrid", "system", "computer", "linker", "linux", "simulation", "elf"], "content_html": "<p>In an attempt to simplify the development around the SimGrid\nmodel-checker, we were thinking about moving the model-checker out in\na different process. Another different approach would be to use a\ndynamic-linker isolation of the different components of the process.\nHere is a summary of the goals, problems and design issues surrounding\nthese topics.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2014/11/03/not-cleaning-the-stack/", "title": "Avoiding to clean the stack", "url": "https://www.gabriel.urdhr.fr/2014/11/03/not-cleaning-the-stack/", "date_published": "2014-11-03T00:00:00+01:00", "date_modified": "2014-11-03T00:00:00+01:00", "tags": ["computer", "simgrid", "compilation", "assembly", "x86_64"], "content_html": "<p>In two previous posts, I looked into cleaning the stack frame of a\nfunction before using it by adding assembly at the beginning of each\nfunction. This was done either by modifying LLVM with a <a href=\"https://www.gabriel.urdhr.fr/2014/10/06/cleaning-the-stack-in-a-llvm-pass/\">custom\ncodegen pass</a> or by\n<a href=\"https://www.gabriel.urdhr.fr/2014/10/06/cleaning-the-stack-by-filtering-the-assembly/\">rewriting the\nassembly</a>\nbetween the compiler and the assembler. The current implementation\nadds a loop at the beginning of every function. We look at the impact\nof this modification on the performance on the application.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2014/10/06/cleaning-the-stack-by-filtering-the-assembly/", "title": "Cleaning the stack by filtering the assembly", "url": "https://www.gabriel.urdhr.fr/2014/10/06/cleaning-the-stack-by-filtering-the-assembly/", "date_published": "2014-10-06T12:40:02+02:00", "date_modified": "2014-10-06T12:40:02+02:00", "tags": ["computer", "simgrid", "unix", "compilation", "assembly", "x86_64"], "content_html": "<p>In order to help the SimGridMC state comparison code, I wrote a\nproof-of-concept <a href=\"https://www.gabriel.urdhr.fr/2014/10/06/cleaning-the-stack-in-a-llvm-pass/\">LLVM pass which cleans each stack\nframe</a> before using\nit. However, SimGridMC currently does not work properly when compiled\nwith clang/LLVM. We can do the same thing by pre-processing the\nassembly generated by the compiler before passing it to the linker:\nthis is done by inserting a script between the compiler and the\nassembler. This script will rewrite the generated assembly by\nprepending stack-cleaning code at the beginning of each function.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2014/10/06/cleaning-the-stack-in-a-llvm-pass/", "title": "Cleaning the stack in a LLVM pass", "url": "https://www.gabriel.urdhr.fr/2014/10/06/cleaning-the-stack-in-a-llvm-pass/", "date_published": "2014-10-06T10:00:02+02:00", "date_modified": "2014-10-06T10:00:02+02:00", "tags": ["computer", "simgrid", "llvm", "compilation", "assembly", "x86_64"], "content_html": "<p>In the previous episode, we implemented a <a href=\"https://www.gabriel.urdhr.fr/2014/09/26/adding-a-llvm-pass/\">LLVM pass which does\nnothing</a>. Now we are trying to modify\nthis to create a (proof-of-concept) LLVM pass which fills the current\nstack frame with zero before using it.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2014/09/26/adding-a-llvm-pass/", "title": "Adding a basic LLVM pass", "url": "https://www.gabriel.urdhr.fr/2014/09/26/adding-a-llvm-pass/", "date_published": "2014-09-26T00:00:00+02:00", "date_modified": "2014-09-26T00:00:00+02:00", "tags": ["computer", "simgrid", "llvm", "compilation", "assembly", "x86_64"], "content_html": "<p>The SimGrid model checker uses memory introspection (of the heap,\nstack and global variables) in order to detect the equality of the\nstate of a distributed application at the different nodes of its\nexecution graph. One difficulty is to deal with uninitialised\nvariables. The uninitialised global variables are usually not a big\nproblem as their initial value is 0. The heap variables are dealt with\nby <code>memset</code>ing to 0 the content of the buffers returned by <code>malloc</code>\nand friends. The case of uninitialised stack variables is more\nproblematic as their value is whatever was at this place on the stack\nbefore. In order to evaluate the impact of those uninitialised\nvariables, we would like to clean each stack frame before using\nthem. This could be done with a LLVM plugin. Here is my first attempt\nto write a LLVM pass to modify the code of a function.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2014/09/25/filtering-the-clipboard/", "title": "Filtering the clipboard using UNIX filters", "url": "https://www.gabriel.urdhr.fr/2014/09/25/filtering-the-clipboard/", "date_published": "2014-09-25T00:00:00+02:00", "date_modified": "2014-09-25T00:00:00+02:00", "tags": ["computer", "x11", "unix", "cms", "html"], "content_html": "<p>I had a few Joomla posts that I wanted to clean up semi-automatically.\nHere are a few scripts, to pass the content of the clipboard (or the\ncurrent selection) through a UNIX filter.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2014/09/19/reading-joomla-content/", "title": "Joomla to Wordpress redirections", "url": "https://www.gabriel.urdhr.fr/2014/09/19/reading-joomla-content/", "date_published": "2014-09-19T00:00:00+02:00", "date_modified": "2014-09-19T00:00:00+02:00", "tags": ["computer", "cms"], "content_html": "<p>There are some <a href=\"https://wordpress.org/plugins/fg-joomla-to-wordpress/\">good\nplugins</a> to\nexport Joomla content to WordPress. However, the free version does not\nrewrite the URIs. It is quite simple to read the Joomla database and\ngenerates a bunch of Apache <code>Redirect</code> directives.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2014/08/20/compile-wine-debian/", "title": "Compile a mixed 32 bit/64 bit wine for Debian", "url": "https://www.gabriel.urdhr.fr/2014/08/20/compile-wine-debian/", "date_published": "2014-08-20T00:00:00+02:00", "date_modified": "2014-08-20T00:00:00+02:00", "tags": ["computer", "wine", "debian", "multiarch"], "content_html": "<p>The <a href=\"https://www.winehq.org/\">Wine</a> \ud83c\udf77  <a href=\"http://wiki.winehq.org/\">wiki</a>\nhas instructions for <a href=\"http://wiki.winehq.org/Wine64#head-50d8acdb0146929a14b9601757cbc03452f2056d\">building a shared WoW64\nWine</a>\u00a0:\nthis needs two out of source builds. The issue is that some\ndevelopement packages are not multiarch co-installable. Another wiki\npage for Ubuntu recommends <a href=\"http://wiki.winehq.org/BuildingBiarchWineOnUbuntu\">setting up a 32-bit\nLXC</a>.  Here is how\nI did it without a 32-bit container on Debian \ud83c\udf65 testing.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2014/07/22/same-page-merging/", "title": "Results on same-page-merging snapshots", "url": "https://www.gabriel.urdhr.fr/2014/07/22/same-page-merging/", "date_published": "2014-07-22T00:00:00+02:00", "date_modified": "2014-07-22T00:00:00+02:00", "tags": ["simgrid", "system", "computer", "checkpoint"], "content_html": "<p>In the <a href=\"https://www.gabriel.urdhr.fr/2014/06/13/page-store/\">previous episode</a>, I talked about the\nimplementation of a same-page-merging page store. On top of this, we\ncan build same-page-merging snapshots for the SimGrid model checker.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2014/07/17/sample-watchpoint/", "title": "Sample watchpoints or breakpoints with GDB (and FlameGraph)", "url": "https://www.gabriel.urdhr.fr/2014/07/17/sample-watchpoint/", "date_published": "2014-07-17T00:00:00+02:00", "date_modified": "2014-07-17T00:00:00+02:00", "tags": ["gdb", "debug", "computer", "flamegraph"], "content_html": "<p>GDB can be used to get the stack each time a breakpoint is reached.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2014/06/13/page-store/", "title": "Page store for the Simgrid model checker", "url": "https://www.gabriel.urdhr.fr/2014/06/13/page-store/", "date_published": "2014-06-13T00:00:00+02:00", "date_modified": "2014-06-13T00:00:00+02:00", "tags": ["simgrid", "system", "computer", "checkpoint"], "content_html": "<p>The first (lower) layer of the per-page snapshot mechanism is a page\nstore: its responsibility is to store immutable shareable\nreference-counted memory pages independently of the snapshoting\nlogic. Snapshot management and representation, soft-dirty tracking\nwill be handled in  higher layer.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2014/06/11/sdl2-gamepad-calibration/", "title": "SDL2 gamepad calibration", "url": "https://www.gabriel.urdhr.fr/2014/06/11/sdl2-gamepad-calibration/", "date_published": "2014-06-11T00:00:00+02:00", "date_modified": "2014-06-11T00:00:00+02:00", "tags": ["computer", "config", "video-game"], "content_html": "<p>Many recent games do not provide an option to map the keys/axes of the\ngamepad to specific actions. They assume that the gamepad is XBox\ncompatible: if it is not the game is completely unusable. SDL2\nprovides a way to calibrate a gamepad \ud83c\udfae in order to map its\nkeys/axes to the \u201cstandard\u201d XBox ones.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2014/06/06/custom-keyboard/", "title": "Custom (X11/xkb) keyboard layout without being root", "url": "https://www.gabriel.urdhr.fr/2014/06/06/custom-keyboard/", "date_published": "2014-06-06T00:00:00+02:00", "date_modified": "2014-06-06T00:00:00+02:00", "tags": ["computer", "config", "xkb"], "content_html": "<p>Short tutorial about creating a custom keyboard layout without being\nroot.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2014/06/03/non-cow-snapshots/", "title": "Per-page shallow snapshots for the SimGrid model checker", "url": "https://www.gabriel.urdhr.fr/2014/06/03/non-cow-snapshots/", "date_published": "2014-06-03T00:00:00+02:00", "date_modified": "2014-06-03T00:00:00+02:00", "tags": ["simgrid", "system", "computer", "checkpoint"], "content_html": "<p>I looked at my options to achieve efficient/cheap snapshots of the\nsimulated application for the Simgrid model checker using\n<a href=\"https://www.gabriel.urdhr.fr/2014/06/02/cow-snapshots/\">copy-on-write</a>. Here I look at another\nsolution to achieve this without using copy-on-write.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2014/06/02/cow-snapshots/", "title": "Copy-on-write snapshots for the SimGrid model checker", "url": "https://www.gabriel.urdhr.fr/2014/06/02/cow-snapshots/", "date_published": "2014-06-02T00:00:00+02:00", "date_modified": "2014-06-02T00:00:00+02:00", "tags": ["simgrid", "system", "computer", "checkpoint"], "content_html": "<p>The <a href=\"http://simgrid.gforge.inria.fr/\">SimGrid</a> model checker\nexplores the graph of possible executions of\na simulated distributed application in order to verify safety and\nliveness properties. The model checker needs to store the state of the\napplication in each node of the execution graph in order to detect\ncycles. However, saving the whole state of the application at each\nnode of the graph leads to huge memory consumption and in some\ncases most of the time is spent copying data in order to take the\nsnapshots of the application. We will see how we could solve this problem,\nusing copy-on-write.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2014/05/23/flamegraph/", "title": "Profiling and optimising with Flamegraph", "url": "https://www.gabriel.urdhr.fr/2014/05/23/flamegraph/", "date_published": "2014-05-23T00:00:00+02:00", "date_modified": "2014-05-23T00:00:00+02:00", "tags": ["simgrid", "optimisation", "profiling", "computer", "flamegraph", "unix", "gdb", "perf"], "content_html": "<p><a href=\"http://www.brendangregg.com/flamegraphs.html\">Flamegraph</a>\nis a software which generates SVG graphics\nto visualise stack-sampling based\nprofiles. It processes data collected with tools such as Linux perf,\nSystemTap, DTrace.</p>\n"}]}