3 ms·
You're right - the two exploit files are lzma-compressed and then deliberately corrupted using `tr`, so a hex dump wouldn't show anything immediately suspicious
by tetromino_ 3y ago
You're right - the two exploit files are lzma-compressed and then deliberately corrupted using `tr`, so a hex dump wouldn't show anything immediately suspicious to a reviewer.
Mea culpa!
- maxcoder4 3y agoIs this lzma compressed? Hard to tell because of the lack of formatting, but this looks like amd64 shellcode to me. But that's not really important to the point - I'm not looking at a diff of every committed favicon.ico or ttf font or a binary test file to make sure it doesn't contain a shellcode.
- bangoodirro 3y agoit's just an arbitrary section of libcxx-18.1.1/lib/libc++abi.so.1.0