MazharID

Thursday, 25 May 2023

👤 Mishael Khan is a new friend suggestion for you

Bint E, see what you and your new friend suggestion have in common.

Add the people you know to see their photos and updates.

Mishael Khan

Find more friends

Was this email:Useful | Not Useful

This message was sent to rukhsanamehmood009.bintehawa@blogger.com. If you don't want to receive these emails from Meta in the future, please unsubscribe.
Meta Platforms, Inc., Attention: Community Support, 1 Facebook Way, Menlo Park, CA 94025

To help keep your account secure, please don't forward this email. Learn more

Exploiting Golang Unsafe Pointers

There are situations when c interacts with golang for example in a library, and its possible to exploit a golang function writing raw memory using an unsafe.Pointer() parameter.

When golang receive a null terminated string on a *C.Char parameter, can be converted to golang s tring with s2 := C.GoString(s1) we can do string operations with s2 safelly if the null byte is there.

When golang receives a pointer to a buffer on an unsafe.Pointer() and the length of the buffer on a C.int, if the length is not cheated can be converted to a []byte safelly with b := C.GoBytes(buf,sz)

Buuut what happens if golang receives a pointer to a buffer on an unsafe.Pointer() and is an OUT variable? the golang routine has to write on this pointer unsafelly for example we can create a golangs memcpy in the following way:

We convert to uintptr for indexing the pointer and then convert again to pointer casted to a byte pointer dereferenced and every byte is writed in this way.

If b is controlled, the memory can be written and the return pointer of main.main or whatever function can be modified.

https://play.golang.org/p/HppcVpLfuMf

The return addres can be pinpointed, for example 0x41 buffer 0x42 address:

We can reproduce it simulating the buffer from golang in this way:

we can dump the address of a function and redirect the execution to it:

https://play.golang.org/p/7htJHJp8gUJ

In this way it's possible to build a rop chain using golang runtime to unprotect a shellcode.

XAC Pdp Nunchuk Replacement - Custom Options Update

Wii Nunchuk modified to work on an Xbox Adaptive Controller.

Rear view of a Wii Nunchuk C and Z buttons. Modified to work on HORI Flex and XAC.

A small update option for the OneSwitch XAC compatible Nunchuk. This replacement for a pdp controller normally has just two buttons, and mapped to buttons 1 and 2, which is not terrible useful if connected to the XAC left USB socket.

However, upon request these can be changed in-line with the guide below. See the OneSwitch XAC Accessories page for more.

This includes a way to make a simple exploration controller, if plugged into the right-socket, where the stick looks, and the buttons move forwards and back (if set to buttons 7 and 8 below).