lauriewired

1. not that I can think of, due to the core split. It really has to be independent cores racing independent loads. anything clever you could do with kernel modules, page-table-land, or dynamically reacting via PMU counters would likely cost microseconds...far larger than the 10s-100s of nanoseconds you gain.

what I wished I had during this project is a hypothetical hedged_load ISA instruction. Issue two requests to two memory controllers and drop the loser. That would let the strategy work on a single thread! Or, even better, integrating the behavior into the memory controller itself, which would be transparent to all software without recompilation. But, you’d have to convince Intel/AMD/someone else :)

2. It’s called a “smokeninja”. Fairly popular in product photography circles, it’s quite fun!

Nope, there isn’t a tradeoff; median latency isn’t affected. I don’t think you understand the code. The p50 is identical between a single read and the hedged strategy.

The clflush is there because the technique targets data that will miss the cache anyway. If your working set fits in L1, you don’t need this.

Also, AWS Graviton instances absolutely do not expose per-channel memory controller counter PMUs. That’s why you have to use timing-based channel discovery.

The IBM z-system is neat! But my technique will work on commodity hardware in userspace, and you can easily only sacrifice half the space if you accept 2-way instead of 8+ way hedging. It’s entirely up to you how many channel copies you want to use.

Your reply was quite rude, but I hope this is informative.

This is correct. The majority of cases I have to rely on my own expertise.

It's useful for the automation of small repetitive tasks here and there. I was never expecting it to gain the traction that it did; anyone saying they expect it to replace reverse engineers (it won't) is wildly misunderstanding the original intent.

Quite trivial to create binaries that massively confuse LLMs!

This is my own channel, but I made a 10+ part series on modern ARM assembly you may find interesting. I used CPUlator for the demonstrations, which is a nice way to inspect the memory as well as the individual registers as you are running a program.

All runs in the browser:

https://youtube.com/playlist?list=PLn_It163He32Ujm-l_czgEBhb...

If you can't make CPUs and you can't keep the internet up, where are you going to get the equipment for enough "private peering or Sat links" for the privileged?

Storage. You only need a few hundred working systems to keep a backbone alive. Electron migration doesn’t kill transistors if they are off and in a closet.

You need CPUs to build optical media drives! If you can't build CPUs you're not using optical media in 30 years.

You don’t need to make new drives; there are already millions of DVD/Bluray devices available. The small microcontrollers on optical drives are on wide node sizes, which also make them more resilient to degradation.

they're definitely f-ing going to have been able to repeat all the R&D to build a 68k CPU in 30 years (and that's assuming you've destroy all the literature and mind-wiped everyone with any knowledge of semiconductor manufacturing).

If you read the post, the scenario clearly states “no further silicon designs ever get manufactured”. It’s a thought experiment, nothing more.

It takes a bit of curation, but I find substack's algorithm to be quite good at recommending other bloggers I'd be interested in.

It's also pretty trivial to find what writers other bloggers enjoy based on the "reads" list tab. My algorithm is:

-> Find blogger you like -> Check their substack "reads" for other writers -> Repeat

The three “flaws” that this post lists are exactly what the industry has been moving away from for the last decade.

Arm’s SVE, and RISC-V’s vector extension are all vector-length-agnostic. RISC-V’s implementation is particularly nice, you only have to compile for one code path (unlike avx with the need for fat-binary else/if trees).

I touch on this briefly in the video, beside Claude Desktop, 5ire is a fairly model-agnostic local MCP client, I'm sure there are others.

sama also recently mentioned ChatGPT Desktop is getting MCP client functionality "soon".

As for remote clients, Cloudflare has some really useful tooling, look at their "AI Playground".

That's just my natural speaking voice. I'm a small person, and everyone sounds different.

I'd be happy to focus on the tool, or the content of the channel, rather than how I sound.

Ghidra is very feature-rich for code decompilation, however it doesn't handle dropping in an entire application bundle; only single executables.

Apple application files are special, bundling up resources and (potentially multiple) executables into the same package.

Many of these resource files are important for analysis, but have custom encodings by Apple. Malimite "digests" this information into a logical way.

It’s more like LLM-optional.

Malimite is first and foremost intended to be a tool to help Reverse Engineer iOS/Mac binaries, much like JADX for Android.

As it turns out, LLMs are quite good at “converting” C-Pseudocode into an approximation of the original Swift or Objective-C code. Therefore, you can optionally use the LLM extension to help analysis.

Of course, it’s not 100% accurate, but significantly easier to read, and I find it to save hours of manual research.

It might be better to think of Malimite as "JADX but for iOS/Mac".

(JADX is a very popular Android decompiler)

Ghidra is quite limiting, and the workflow makes iOS reverse engineering quite cumbersome.

Malimite is intended to have a swappable back-end, so theoretically compilers other than Ghidra can be used in the future.

Hi everyone, I'm the creator of Malimite. I actually released this as part of a conference talk at Objective By the Sea, which you can see here:

https://youtu.be/vWdKjVCZtTI

It gives a good overview of the development process as well as my motivations for creating it. The tool will also be on homebrew shortly :)

Does no one realize this is a thinly-veiled ad? The URL is bizarre

P550 cores don't have vector extensions. It's actually quite an old design, from 2021. What you'd want is SiFive P670 cores, which are RVA22 compliant with the vector 1.0 spec.

Work + Personal research. The main industry usecase for RE is malware analysis.

The flow is essentially: 1. Break down a sample to determine behavior; this is usually a mixture of static (decompilation) and dynamic (running the sample in a safe env /w a debugger) analysis.

2. Write a signature / detection based on unique identifiers you discover inside the payload. This is where the real skill comes in; being extremely clever with Regex is helpful here.

It's a tricky game to keep up with malware developers. Write a signature too specific, and all they have to do is recompile with a few string changes to defeat you. Conversely, if a detection is too broad, you run the risk of detecting benign software (aka a False Positive or FP).

https://www.youtube.com/@lauriewired

I talk about Reverse Engineering/Malware Research, Computing History, and low level programming.

Check out Jellyfin (open-source project) + it's associated clients. Pretty simple to spin up in a docker container, and if your machine is fast enough; it can auto-transcode for device and bandwidth limitations.

For example, your iPhone probably won't be able to stream an uncompressed blu-ray over 4G, Jellyfin can transcode the original file at a lower bitrate before sending to your device.

Any chance you'd consider making a version of this as a browser extension for paid subscribers?

What I really want is this functionality on unsupported websites/documentation. It would be killer to "ask" kagi a fact about the article or docs I'm already reading, even if it only traverses/parses the single page.

Personally, I find the 'knowledge half-life' problem to be easily solved with spaced repetition. I've used SuperMemo for a few years now, and have found it invaluable for retaining and revisiting old concepts, especially when switching between different tech stacks. The priority queue system of supermemo fixes the issues Anki and others have when collections grow to larger than 10K+ cards, where the daily load can often become unmanageable.

I find 30 minutes a day of supermemo, supplemented by an hour of purposefully randomized review on weekends keeps even very old topics near the forefront of my mind. It's like having a well-maintained toolbox I can throw at different problems at any time. The slight daily effort is more than compensated by the retention gains I've noticed over time.

I've made a lot (50+) of videos on Reverse Engineering, with a heavy focus on ARM assembly as well as mobile platforms.

youtube.com/@lauriewired

Self-promotion I know, but I hope someone finds it useful

- https://www.youtube.com/@lauriewired

- https://twitter.com/lauriewired

I do Reverse Engineering and I'm pretty active on Youtube

(This is my own channel), but I recently made a video on Objective C calling conventions specifically for Reverse Engineers that you might enjoy, with more iOS videos incoming:

https://youtu.be/eI-Btfjp-fg

As for modern RE resources, I can recommend Jonathan Levin's series of books on MacOS and iOS internals as a good reference. It's probably the newest information you are going to be able to get on iOS/mac internals outside of apple.

https://newosxbook.com/

CPUlator has played an instrumental role in my ARM-based Assembly explorations. One can simulate a full system, including not just the processor, but also the peripherals and the system-on-a-chip interconnects, mimicking a real system's behavior. I really appreciate the ability to inspect the memory as well as the individual registers as you are running a program.

The possibility to show real-time visual feedback and debugging capabilities provides an excellent avenue for people to understand the nuances of computer architecture. Through CPUlator, I have been able to guide learners through the use of ARMv7 assembly instructions and their usage who might not have access to ARM hardware themselves. I can't recommend this tool enough.

A new Mozilla bug report suspects an issue with the load-after-write operation on certain Samsung phones. The problem is due to the ARM instruction LDRB causing a sign extension in w12, leading to reading a value from an incorrect memory page. Check out from the report:

“Since we just stored 0xba, that's what x12 should contain. However, that's not what we're seeing. Looking at a dump, I see x12 = 0x00000000ffffffba. That's not zero-extended.”

This means that the upper bits are not getting cleared. Likely a bug in the Mongoose M5 core used in Non-US Samsung devices.

Try checking out this LessWrong thread about "The Best Textbooks on Every Subject": https://www.lesswrong.com/posts/xg3hXCYQPJkwHyik2/the-best-t...

The thread is a little old, but occasionally still gets new comments with book recommendations here and there.

KernelSU is pretty interesting in certain circumstances compared to say, Magisk, which is a systemless root. KernelSU cannot be prevented by SELinux—the kernel can even disable SELinux if it wants to.

It's quite useful for gaining root on "weird" and or/old android devices such as lesser-known smartwatches, often that have no support for Magisk at all.

In terms of bypassing SafetyNet, both KernelSU and Magisk have their own strengths and limitations. For those utilizing an Android smartphone in a conventional manner, Magisk may be the preferred choice due to its extensive module support and strong community support.

I would like to challenge the conventional approach and suggest starting with reverse engineering, particularly malware reverse engineering, as a foundation before engaging in research. Engaging in activities such as participating in CTFs, hacking boxes, and reproducing CVEs is valuable, but without the fundamental knowledge, it is akin to attempting to run before learning to walk.

I recommend exploring OpenSecurity's courses to gain a comprehensive understanding of topics such as assembly, debuggers, and x86 architecture. It is essential to have a solid grasp of these concepts before diving into malware analysis.

Then, I suggest watching OALab's YouTube channel and streams for excellent malware analysis content, and practicing by following along with his videos, reversing malware with Ghidra (if you do not have access to an IDAPro license). Additionally, if you have the money for it, also participate in virtual machine-based malware analysis exercises, such as those offered by the SANS Institute, to gain hands-on experience.

Once you are confident with the material from these resources, you can choose to specialize in a specific area that interests you. Would you like to delve into Linux Kernel security, Windows internals? Perhaps mobile security or ARM? By having a strong foundation, the research papers, CVEs, and exploits will be easier to comprehend and analyze.

Don't get discouraged by setbacks, it's a difficult field, just always strive to expand your knowledge and skills.

I've become increasingly convinced that the only long-term reliable solution against hypothetical ransomware attacks are airgapped backups. In some industries, there exists the concept of data-diodes that restrict the flow of information in only certain directions.

There almost needs to be a reliable, push-button WORM-filesystem "box" that people can plug into their computer a few times a week to perform a full snapshot. Storage is cheap, it's the implementation that's always the barrier.