lauriewired

what I wished I had during this project is a hypothetical hedged_load ISA instruction. Issue two requests to two memory controllers and drop the loser. That would let the strategy work on a single thread! Or, even better, integrating the behavior into the memory controller itself, which would be transparent to all software without recompilation. But, you’d have to convince Intel/AMD/someone else :)

2. It’s called a “smokeninja”. Fairly popular in product photography circles, it’s quite fun!

The clflush is there because the technique targets data that will miss the cache anyway. If your working set fits in L1, you don’t need this.

Also, AWS Graviton instances absolutely do not expose per-channel memory controller counter PMUs. That’s why you have to use timing-based channel discovery.

The IBM z-system is neat! But my technique will work on commodity hardware in userspace, and you can easily only sacrifice half the space if you accept 2-way instead of 8+ way hedging. It’s entirely up to you how many channel copies you want to use.

Your reply was quite rude, but I hope this is informative.

It's useful for the automation of small repetitive tasks here and there. I was never expecting it to gain the traction that it did; anyone saying they expect it to replace reverse engineers (it won't) is wildly misunderstanding the original intent.

Quite trivial to create binaries that massively confuse LLMs!

All runs in the browser:

https://youtube.com/playlist?list=PLn_It163He32Ujm-l_czgEBhb...

Storage. You only need a few hundred working systems to keep a backbone alive. Electron migration doesn’t kill transistors if they are off and in a closet.

> You need CPUs to build optical media drives! If you can't build CPUs you're not using optical media in 30 years.

You don’t need to make new drives; there are already millions of DVD/Bluray devices available. The small microcontrollers on optical drives are on wide node sizes, which also make them more resilient to degradation.

> they're definitely f-ing going to have been able to repeat all the R&D to build a 68k CPU in 30 years (and that's assuming you've destroy all the literature and mind-wiped everyone with any knowledge of semiconductor manufacturing).

If you read the post, the scenario clearly states “no further silicon designs ever get manufactured”. It’s a thought experiment, nothing more.

It's also pretty trivial to find what writers other bloggers enjoy based on the "reads" list tab. My algorithm is:

-> Find blogger you like -> Check their substack "reads" for other writers -> Repeat

Arm’s SVE, and RISC-V’s vector extension are all vector-length-agnostic. RISC-V’s implementation is particularly nice, you only have to compile for one code path (unlike avx with the need for fat-binary else/if trees).

sama also recently mentioned ChatGPT Desktop is getting MCP client functionality "soon".

As for remote clients, Cloudflare has some really useful tooling, look at their "AI Playground".

I'd be happy to focus on the tool, or the content of the channel, rather than how I sound.

Apple application files are special, bundling up resources and (potentially multiple) executables into the same package.

Many of these resource files are important for analysis, but have custom encodings by Apple. Malimite "digests" this information into a logical way.

Malimite is first and foremost intended to be a tool to help Reverse Engineer iOS/Mac binaries, much like JADX for Android.

As it turns out, LLMs are quite good at “converting” C-Pseudocode into an approximation of the original Swift or Objective-C code. Therefore, you can optionally use the LLM extension to help analysis.

Of course, it’s not 100% accurate, but significantly easier to read, and I find it to save hours of manual research.

(JADX is a very popular Android decompiler)

Ghidra is quite limiting, and the workflow makes iOS reverse engineering quite cumbersome.

Malimite is intended to have a swappable back-end, so theoretically compilers other than Ghidra can be used in the future.

https://youtu.be/vWdKjVCZtTI

It gives a good overview of the development process as well as my motivations for creating it. The tool will also be on homebrew shortly :)

The flow is essentially: 1. Break down a sample to determine behavior; this is usually a mixture of static (decompilation) and dynamic (running the sample in a safe env /w a debugger) analysis.

2. Write a signature / detection based on unique identifiers you discover inside the payload. This is where the real skill comes in; being extremely clever with Regex is helpful here.

It's a tricky game to keep up with malware developers. Write a signature too specific, and all they have to do is recompile with a few string changes to defeat you. Conversely, if a detection is too broad, you run the risk of detecting benign software (aka a False Positive or FP).

I talk about Reverse Engineering/Malware Research, Computing History, and low level programming.

For example, your iPhone probably won't be able to stream an uncompressed blu-ray over 4G, Jellyfin can transcode the original file at a lower bitrate before sending to your device.

What I really want is this functionality on unsupported websites/documentation. It would be killer to "ask" kagi a fact about the article or docs I'm already reading, even if it only traverses/parses the single page.

I find 30 minutes a day of supermemo, supplemented by an hour of purposefully randomized review on weekends keeps even very old topics near the forefront of my mind. It's like having a well-maintained toolbox I can throw at different problems at any time. The slight daily effort is more than compensated by the retention gains I've noticed over time.

youtube.com/@lauriewired

Self-promotion I know, but I hope someone finds it useful

- https://twitter.com/lauriewired

I do Reverse Engineering and I'm pretty active on Youtube

https://youtu.be/eI-Btfjp-fg

As for modern RE resources, I can recommend Jonathan Levin's series of books on MacOS and iOS internals as a good reference. It's probably the newest information you are going to be able to get on iOS/mac internals outside of apple.

https://newosxbook.com/

The possibility to show real-time visual feedback and debugging capabilities provides an excellent avenue for people to understand the nuances of computer architecture. Through CPUlator, I have been able to guide learners through the use of ARMv7 assembly instructions and their usage who might not have access to ARM hardware themselves. I can't recommend this tool enough.

“Since we just stored 0xba, that's what x12 should contain. However, that's not what we're seeing. Looking at a dump, I see x12 = 0x00000000ffffffba. That's not zero-extended.”

This means that the upper bits are not getting cleared. Likely a bug in the Mongoose M5 core used in Non-US Samsung devices.

The thread is a little old, but occasionally still gets new comments with book recommendations here and there.