3 ms·
Yep. I didn't read most of the last 1/2-1/3 of the slides, but it looks like the magic number may be different for each machine (ie. there is no one binary to r
by jsprogrammer 11y ago
Yep. I didn't read most of the last 1/2-1/3 of the slides, but it looks like the magic number may be different for each machine (ie. there is no one binary to rule them all[all though you could probably trivially generate all possibilities])? And that there is at least some process involved in determining the number what the number is?
The author is legit. Here's a somewhat recent talk he gave: https://www.youtube.com/watch?v=C8--cXwuuFQ https://www.youtube.com/watch?v=C8--cXwuuFQ
- TazeTSchnitzel 11y agoThe "magic number" is just a signal to the rootkit. It's not a rootkit itself.
- rasz_pl 11y agosemi legit, cantor.dust is still vaporware
- jsprogrammer 11y agoYes, true. No beta invite yet.
- rasz_pl 11y agoinvites to what? CIA front for reverse engineering? Guy works for a non profit that happens to be the biggest employee for RE coders, nobody heard of it _and_ its only client is DoD, all of this is dodgy as F edit: quick google shows Battelle Memorial is a 'known' CIA front company. /tinfoilhat mode Now Im starting to suspect this SMM escalation was in their arsenal and he overheard some details in the cafeteria?
- jsprogrammer 11y agoInvite to candor.dust? What is the relevance of a CIA front? The software was demo'd, explained, and makes sense. More likely, the software is quite powerful and was developed into a larger, more automated version that Domas/Battelle/CIA/whoever doesn't want to give away.
- caprinja 11y agosenseye seems to match the featureset from cantor dust pretty well but other than 'pretty pictures' its hard to see how its useful
- jsprogrammer 11y agoThe "intuitive" feeling that he claims to develop after using it for awhile seems like it would be useful of you do a lot of reverse engineering or forensics work.
- caprinja 11y agoyeah perhaps I just havn't gotten the feel for it - think I've spent some 8-10 hours total playing around (more comfortable with regular hex+disasm+debug+scripts), I liked the https://github.com/letoram/senseye/wiki/Sense_MFile https://github.com/letoram/senseye/wiki/Sense_MFile thing though
- jsprogrammer 11y agoThis looks pretty cool. cantor.dust seemed more usable than senseye (I haven't used either).