@Rairii@haqueers.com
@Rairii@haqueers.com avatar

Rairii

@Rairii@haqueers.com

Reversing (malware and otherwise); appsec and websec; embedded security; exploit dev; software preservationist; knows how not to use cryptography.

Currently finding bugs in Windows bootloaders.

You may also know me from capcom.sys.

#nobot

This profile is from a federated server and may be incomplete. Browse more on the original instance.

Rairii, to random
@Rairii@haqueers.com avatar

// TODO: draw the rest of the fucking owl

Rairii, to random
@Rairii@haqueers.com avatar

meanwhile:

  • got a random IRQL_NOT_LESS_OR_EQUAL in ntoskrnl when playing pinball
  • display output is "wobbling". I reseated both ends of AV cable, still did it, happens in hbc too. noticed it only happens when GX does efb->xfb copy (inside arc firmware/nt kernel boot which writes to XFB directly everything is fine). I hope this isn't a sign of hardware failure...
Rairii, to random
@Rairii@haqueers.com avatar

"It is possible to make it appear that memory is organized in little-endian format, even though it is maintained by a microprocessor that is inherently big-endian, such as the PowerPC processor. This effect is desirable, for example, when Windows NT runs on a PCI-based Power Macintosh computer, because Windows NT requires memory to appear to be little-endian."

  • Apple documentation : Designing PCI Cards and Drivers for Power Macintosh Computers, Revised Edition (1999-03-26), "Address Swizzling" in Appendix A.

powerpc NT was dead for two years by this point???

Rairii, to random
@Rairii@haqueers.com avatar

hmm

based on code and documentation and hardware datasheet evidence it seems likelier and likelier that G3 macs - and only G3 macs - were to have a powerpc NT port

Rairii, to random
@Rairii@haqueers.com avatar

big social media have algorithms focusing on engagement

but i don't see people getting rings when they go viral

Rairii, to random
@Rairii@haqueers.com avatar

using brendan eich's cryptocurrency browser?

that's not brave, that's stupid

Rairii, to random
@Rairii@haqueers.com avatar

downloaded a bunch of old world mac ROM dumps

the powermac G3 (v3) is the earliest to have an MS ARC-style COFF loader in its open firmware implementation

they were released nine months after MS announced they were abandoning PowerPC NT

edit because i got confused with the models. the blue and white G3 is of course the first new world powermac

Rairii, to random
@Rairii@haqueers.com avatar

i also took a look at some apple open firmware things, bootloaders, and ppc osx kernel

i was surprised to see a PE loader in the disassembled forth part of a ppc mac bootrom. well, it CALLS itself a PE loader but what it actually loads is a raw COFF but with PE optional header (ie, link.exe /rom). which is what veneer.exe is (and setupldr/osloader).

just trying to load such a COFF will enable little-endian variable and reboot, which is a Bad Idea on new-world ppc macs (can cause boot failure, possibly because graphics cards can't handle it)

there's also some "nt-hack" thing. not sure what that's for. it's been noticed before but nobody figured out what it does.

Rairii, to random
@Rairii@haqueers.com avatar

KMODE_EXCEPTION_NOT_HANDLED
STATUS_INVALID_INSTRUCTION
faulting address: appears to be in the middle of a registry hive
what the fuck?

Rairii, to random
@Rairii@haqueers.com avatar

for a second i got scared that spotify was making a misskey fork

https://github.com/spotify/sparkey

Rairii, to random
@Rairii@haqueers.com avatar

nice

Rairii, to random
@Rairii@haqueers.com avatar

somehow i can play space cadet pinball with one hand better than i can play it with two? lol

https://youtu.be/d8BpUpr1h9U

Rairii, to random
@Rairii@haqueers.com avatar

i just missed the iconic win animation, my phone wasn't in the room when i made the final move lol

Rairii, to random
@Rairii@haqueers.com avatar

this mastodon draft PR looks interesting: "enable authorised fetch for any individual user who blocks remote domains" https://github.com/mastodon/mastodon/pull/28457

...would actually mean blocking, for example, facebook threads, as an individual user, from a server that does not block it, would actually be effective

Rairii, to random
@Rairii@haqueers.com avatar

KEVIN? YOU SPENT NINE HUNDRED AND SIXTY SEVEN DOLLARS ON ROBLOX FORTNITE BUCKS?

Rairii, to random
@Rairii@haqueers.com avatar

just realised i was playing pinball on dolphin over RDP too so i'm doubly amazed that it was.kinda playable lol

Rairii, to random
@Rairii@haqueers.com avatar

i just lost my ball because of lag

Rairii, to random
@Rairii@haqueers.com avatar

still not sure how stable iossdmc.sys is; but after some refactoring and bug fixing it's stable enough to get here:

Rairii, to random
@Rairii@haqueers.com avatar

today i learned people have unironically ported modern chromium to NT4 for electron

they should try the hard mode version of that and port to NT PPC

Rairii, to random
@Rairii@haqueers.com avatar

>obscure undocumented DMA block in debug register area with custom hash required to use it

what's the more likely solution? attacker somehow figured it out by decapping and hardware reversing, or attacker managed to compromise apple or associated entity enough to get things like HDL, docs, test code, etc?

i can guess which one would be easier

...i wonder if that MMIO block has other interesting functionality

Rairii, to random
@Rairii@haqueers.com avatar

hmm

Rairii, to random
@Rairii@haqueers.com avatar

lol

so apparently (some?) new-world powerpc macs have bi-endian memory controllers (G3 definitely, I read the MPC106 datasheet: "PICR1[LE_MODE] controls the endian mode of the MPC106. LE_MODE is also
accessible from the external configuration register at port 0x092")

and open firmware has a little-endian nvram var

which causes early boot failure if set to true, other sources say some systems do boot but without the display

seems interesting, and now i'm seriously thinking about buying a new world powerpc mac (laptop, maybe?) from ebay lol

just targeting a hal for one of these things would be harder than the wii one though. for a start, there's no way i'll be able to cheat and skip implementation of some things lol

...oh boy, i've been bitten by the powerpc bug now haven't i

Rairii, to random
@Rairii@haqueers.com avatar

if the USA national anthem is so good why is there no USB national anthem

Rairii, to random
@Rairii@haqueers.com avatar
Rairii, to random
@Rairii@haqueers.com avatar

rebased kernel32, user32, ole32 to different hardcoded addresses (giving the first two 1MB of address space and the last one as much as it needs, it's over 1MB when mapped anyway)

and taskmgr comes up

winmsd still doesn't want to, though.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • anitta
  • thenastyranch
  • rosin
  • GTA5RPClips
  • osvaldo12
  • love
  • Youngstown
  • slotface
  • khanakhh
  • everett
  • kavyap
  • mdbf
  • DreamBathrooms
  • ngwrru68w68
  • megavids
  • magazineikmin
  • InstantRegret
  • normalnudes
  • tacticalgear
  • cubers
  • ethstaker
  • modclub
  • cisconetworking
  • Durango
  • provamag3
  • tester
  • Leos
  • JUstTest
  • All magazines