4 ms·
00011900: 0000 4883 f804 7416 b85f 5f5f 5f33 010f ..H...t..____3.. │
by bangoodirro 3y ago
00011900: 0000 4883 f804 7416 b85f 5f5f 5f33 010f ..H...t..____3.. │
00011910: b651 0483 f25a 09c2 0f84 5903 0000 488d .Q...Z....Y...H. │
00011920: 7c24 40e8 5875 0000 488b 4c24 4848 3b4c |$@.Xu..H.L$HH;L │
00011930: 2440 7516 4885 c074 114d 85ff 0f84 3202 $@u.H..t.M....2. │
00011940: 0000 498b 0ee9 2c02 0000 b9fe ffff ff45 ..I...,........E │
00011950: 31f6 4885 db74 0289 0b48 8bbc 2470 1300 1.H..t...H..$p.. │
00011960: 0048 85ff 0f85 c200 0000 0f57 c00f 2945 .H.........W..)E │
00011970: 0048 89ac 2470 1300 0048 8bbc 2410 0300 .H..$p...H..$... │
00011980: 0048 8d84 2428 0300 0048 39c7 7405 e8ad .H..$(...H9.t... │
00011990: e6ff ff48 8bbc 24d8 0200 0048 8d84 24f0 ...H..$....H..$. │
000119a0: 0200 0048 39c7 7405 e893 e6ff ff48 8bbc ...H9.t......H.. │
000119b0: 2480 0200 0048 8d84 2498 0200 0048 39c7 $....H..$....H9. │
000119c0: 7405 e879 e6ff ff48 8bbc 2468 0100 004c t..y...H..$h...L │
Please tell me what this code does, Sheldon
- tetromino_ 3y agoYou're right - the two exploit files are lzma-compressed and then deliberately corrupted using `tr`, so a hex dump wouldn't show anything immediately suspicious to a reviewer. Mea culpa!
- maxcoder4 3y agoIs this lzma compressed? Hard to tell because of the lack of formatting, but this looks like amd64 shellcode to me. But that's not really important to the point - I'm not looking at a diff of every committed favicon.ico or ttf font or a binary test file to make sure it doesn't contain a shellcode.
- bangoodirro 3y agoit's just an arbitrary section of libcxx-18.1.1/lib/libc++abi.so.1.0