Re:Bunny.py: A WiFi darknet that hides its traffic in the no...
by marshray on Thursday May 16, 2013 @04:16PM
(#5720890)
It's not the -4 that's weird, it's the modulus and remainder with floating point arithmetic.
Re:Bunny.py: A WiFi darknet that hides its traffic in the no...
by andrewcooke on Thursday May 16, 2013 @05:17PM
(#5721201)
agree it's odd, but it's basically 100 * (len - 4) % 121 = 85
(I think?)
(yes, I know about rounding, fractions, different bases - I was just trying to explain why it still worked. sigh.)
Re:Bunny.py: A WiFi darknet that hides its traffic in the no...
by marshray on Thursday May 16, 2013 @05:49PM
(#5721397)
No, actually they're different. http://floating-point-gui.de/ http://web.cse.msu.edu/~cse320/Documents/FloatingPoint.pdf
If you know enough about floating point to prove that the rounding will always give you the correct answer, then probably you would have just used the integer representation to begin with.
The mod/remainder values are agreed upon by the network operators, that is why they are in config.
The length % mod == remainder trick for detecting packets was inspired by the KIS rootkit in the later 90's. http://packetstormsecurity.com/files/25029/kis-0.9.tar.gz.ht...