EatonZ

Thank you for the laugh (:

TruffleHog: https://trufflesecurity.com/trufflehog

I worked for them a little bit and their product is really impressive and works great.

Appreciate the insight!

There are certainly more things I could have done to get more $/hour. I ultimately find these things enjoyable and help keep my skills sharp.

It would be nice to see rewards that scale with severity. Ultimately they did accomodate me by sending a gift card I can use instead of coupons I would likely have given away, so I appreciate that. Most companies don't offer me anything!

Location: Florida, USA

Remote: Yes

Willing to relocate: No

Résumé/CV: https://eaton-works.com/resume/

Email: eaton@eaton-works.com

I am an experienced C# / .NET Windows desktop developer of more than 15 years with an interest in file systems, reverse-engineering, and security. Some of my recent security disclosures have been front-page news on major media outlets such as Automotive News[1] and TechCrunch[2].

Currently seeking new opportunities in the C# / .NET and/or security space.

Please see my website for a full catalog of my notable work: https://eaton-works.com/

[1] https://www.autonews.com/mobility-report/how-toyotas-supplie...

[2] https://techcrunch.com/2022/06/22/jacuzzi-flaws-admin-expose...

I have just put up an Atom feed, more details: https://eaton-works.com/2023/01/28/syndication-feed-now-avai...

https://i.imgur.com/AFZIA3p.png

It takes in the RSA signature, SHA data hash, and RSA key type. Key types are: XE_PIRS_RSA_KEY = 0x0, XE_LIVEDRM_RSA_KEY = 0x1, XE_DEVICE_RSA_KEY = 0x2 (this is the Sata verification key), XE_XSIGNER2_RSA_KEY = 0x3

It uses key type to load the corresponding public key from memory at static addresses, then verification takes place.

Thank you for the kind words :D My contact info is here: https://eaton-works.com/contact/

If anyone is interested in RSS you can subscribe here to be notified when it's available (I will post about it): https://eaton-works.com/subscribe

You can then unsubscribe & that will delete your email from my list, if you prefer RSS over emails.

Glad everyone enjoyed the writeup! I have several more interesting writeups planned, including a significant hack disclosure (not Xbox/gaming related), so keep an eye out (:

It's a 2048-bit key. If it was 1024 maybe it could eventually be cracked? With 2048, I don't think it will be.

There are "transfer flags" on content items that control whether they could be copied/moved.

Microsoft also knows if you have USBs connected to your console (: If any are connected, it will report back the sizes.

The key is inside of the hypervisor. Not changeable if you want to retain your unmodded status.

I have received other requests for this. I thought about it when I redesigned the site, but didn't think people really used RSS that much anymore. I have it on my list to implement (:

I've added it to the to-do list, but I would not be surprised if it's inaccessible. The HTTP request to download it has console ID as a header.

Craziness is one way to define it (:

And it is still valid!

The dash is one of the last things loaded on the nand. At that point all the critical stuff has been loaded. They also had to compress the dash for storage on the nand, or else the file system would have went beyond capacity.

I recently redesigned my site using the IBM Plex font, if anyone wants to see how it looks in-use: https://eaton-works.com/

They added an "Export" button a while ago, so you can now download the original image.

Been waiting for .dev too. Haven't been able to get any info from them as to when it will be supported ):

As a workaround maybe you could, behind the scenes, split large files into 2 (or more) key-value pairs, and then bill appropriately for the use of 2 key-value pairs instead of just 1.

Building a non-prod Angular project produces a 7 MB js file, so the 2 MB limit definitely needs to be raised. I think it would make sense to have a higher limit for certain file types, like js and html.

I am very interested in this feature, but the limit is a bit concerning right now.

Looks like a nice improvement. There's some very bizzare design decisions with Subscriptions, so hopefully this will start making things more flexible.

Probably, still spooky to see that there!

Interesting: https://github.com/h1x0rz3r0/iBoot/blob/master/apps/iBoot/bo...

Things are stabilizing, was not expecting the article to get this many hits!

Definitely not my intention. )-: Embeds will be gone soon.

Hey guys, author here. I used the embed code because some of the images are large and WordPress wasn't resizing them correctly for some reason. I also was unaware of the policy in Imgur's ToS. I will look into these issues and update the article accordingly.