Elektrine lite

← Feed

Rairii :win3_progman: :win3:

Rairii@labyrinth.zone

some people port doom to things, I port NT to things<br/><br/>Reversing (malware and otherwise); appsec and websec; embedded security; exploit dev; software preservationist; knows how not to use cryptography.<br/><br/>Currently finding bugs in Windows bootloaders.<br/><br/>You may also know me from capcom.sys.<br/><br/><a class="hashtag" data-tag="nobot" href="https://labyrinth.zone/tag/nobot" rel="tag ugc">#nobot</a>

Posts

  • Post #4371866

    i didn’t think it was physically possible, but there’s finally something worse than curl | sh

  • Post #4356953

    i follow the fedi numbers go up bot because it keeps leading me to &quot;weird&quot; servers (the outliers eventually stick out) social.laoapp[.]la, federation seems to be working in some capacity (unsure how broken it is), running a custom fork of mastodon that also claims to be stock (breaking AGPL) they also run forks of mailcow, nextcloud, and what looks like matrix/element seems they started out with the matrix server and brought up the other stuff a few months ago? i think this is run...

  • Post #4242566

    OH: to err is human, to really screw things up requires a techbro

  • Post #4220323

    fixed a bug in my cuda driver code thanks to MAME LLEing it, i was setting the gpio direction to input at the wrong state transition, which appears to have had the effect of forcing some bits of the final transferred byte high (needed to fix an unaligned access i missed in the hal too)

  • Post #4220322

    i love it when i write rgb565 to an rgb555 framebuffer

  • Post #4201962

    oh look, wormable prompt injection https://enklypesalt.com/posts/context-collapse-part3-ai-worming-through-word/

  • Post #4121429

    i wonder how long it&#39;ll be before MS finally kills off BIOS bootmgr because it&#39;s just got too big they&#39;ve already had to save 2KB by removing an exception handler register dump, and even with that the whole binary uses 70% of 640KB

  • Post #4085913

    one ai agent to rule them all, one ai agent to find them, one ai agent to bring them all, and in the darkness bind them

  • Post #4035700

    windows vista install (computer name contains FUCK%) (TAS)

  • Post #3989724

    ok that’s really funny so IBM used Apple’s Open Firmware on the 43p-150 (seems to be a derivative of the one used on motorola viper, the 43p-150 chipset is almost a motorola viper fwiw) and it turns out they left this in there: : bye &quot; boot /AAPL,ROM&quot; eval ; this is a leftover from old world macs, even the dumped motorola viper bootrom image changed it to “boot macos”

  • Post #3654392

    just noticed that last month (2026-06-12) Microsoft changed Copilot terms of use to remove the “for entertainment purposes only” part old (https://www.microsoft.com/en-gb/microsoft-copilot/for-individuals/termsofuse/archives - “October 2025”): Copilot is for entertainment purposes only. It can make mistakes and it may not work as intended. Don’t rely on Copilot for important advice. Use Copilot at your own risk. new (https://www.microsoft.com/en-gb/microsoft-copilot/for-individuals/termsofuse...

  • Post #3569660

    looking at that pile of fatfs bugs, i don&#39;t see how CVE-2026-6682 is exploitable? given the value is just used to calculate the start of actual cluster data (the end of the root directory) as for the rest: CVE-2026-6687 is real, a length arg should have been added with exfat support, but let&#39;s be honest, who uses f_getlabel anyway? CVE-2026-6688 is arguably something that modern compilers should be warning on when lfn support is enabled (given that extends the 12 byte static buffer to...

  • Post #3316325

    there&#39;s supposedly a lot of NT people around but i think most of them are faking it because i don&#39;t see them porting Windows NT to things

  • Post #3004381

    oh, nitrogen released the first set of foxconn files

  • Post #3004380

    it appears that a lot of the stuff in the currently released foxconn leaks relates to Foxconn Industrial Internet (albeit i haven&amp;#39;t downloaded the biggest tarball yet) so if you&amp;#39;re interested in the internals of server hardware used by and in some cases specifically commissioned for cloud hosting vendors/etc, you&amp;#39;re in luck

  • Post #3004379

    what&amp;#39;s that you say? foxconn using warezed software internally? you can take the company out of china but you can&amp;#39;t take the china out of the company

  • Post #3004378

    there&amp;#39;s a very simple solution to prompt injection, and it&amp;#39;s called &amp;quot;don&amp;#39;t use large language models&amp;quot;

  • Post #2606831

    this hal is cursed, i&amp;#39;m having to emulate interrupt masking because 90% of the interrupts on these systems are nonmaskable (at least the interrupt controllers have a compatibility mode -- or ONLY mode -- that latches the interrupt line for 68k emulator compatibility, i&amp;#39;m using that) but hey, it wants a storage driver on emulated pdm

  • Post #2606830

    i&amp;#39;ve been meaning to release bcdeditmod for ages, so here, ahve a tool for researching the windows boot environment, this helped me discover/exploit several bugs so enjoy https://github.com/Wack0/bcdeditmod this was done in preparation for dropping my own bitlocker 0day (a 20+ year old bug) given MSRC said they were unable to reproduce this one and others are happily dropping bitlocker 0days. having written all the documentation i&amp;#39;m now unsure about committing though...

  • Post #2606829

    i saw that MIPS CE on N64 thing. was excited until i realised they used claude (claude is on one of the commits and &amp;quot;a blocked user has committed to this repo&amp;quot; doesn&amp;#39;t show up?! i ended up realising something was up because there was an em-dash in a comment). at least the repo has documentation for interesting little endian mode hardware issues. including an unaligned uncached write thing that&amp;#39;s eerily similar to what happens on GC/Wii.

  • Post #2098435

    i bought another powerpc mac laptop all the pre-pci powerpc macs, as far as i can tell, have similar MMIO and identical cascaded interrupt controllers (inherited from the late 68k era it appears - this system uses a chipset identical to an earlier 68k powerbook, except with a newer graphics controller revision - probably to support 800x600x16bpp), so I hacked in powerpc 601 support to the loader and arc too, and it boots on emulated PDM (NT 3.5 PPC emulation soon?) actually writing drivers for...

  • Post #2098434

    so last night i got arc firmware initial bringup the PMU is slightly different between the pre-pci and pci powerbooks, and the screen brightness/contrast pmu commands did something quite unwanted on the 1400cs, see pictures for more info. it&amp;#39;s not a monochrome thing as colours did indeed kinda show up when booting into mac os things to do: - fix media bay, which not even linux on PBX support. media bay id and power goes through the PMU on these systems (the tbxi rom keeps reading the m...

  • Post #2098433

    i still consider &amp;quot;the first google search result&amp;quot; to mean &amp;quot;the first organic search result, after any ads (that ubo should make disappear anyway)&amp;quot;

  • Post #1901948

    Modern database client powered by AI this makes me want to scream

  • Post #1901946

    i wonder how much seo-spam sites are still run on boxes with cpanel installed (the number was probably higher 15 years ago) what i&amp;#39;m saying is the people who had that bug as 0day could have done a very funny wiper campaign

  • Post #1708038

    &quot;i hate javascript and wish it never existed&quot; monkey&#39;s paw curls, IE&#39;s influence ensured that clientside scripting on the web is all vbscript

  • Post #1533780

    reversing another powerpc kernel&amp;#39;s pagefault codepath, so consulting the best readable documentation available on powerpc page tables again for those unaware, that&amp;#39;s the mario kart wii forums

  • Post #1530953

    oh this is interesting a while ago ransomhouse leaked data from some chinese microcontroller company, and it seems nobody really noticed this company also makes TPMs a lot of the data looks crypted, but there’s some plaintext in there including listing files (which for C code seems to be preprocessor debug-output, with single character prefix denoting what the preprocessor did, comments and preprocessor directives and preprocessor output are ALL included) for the firmware of a production TPM...

  • Post #1315744

    &amp;quot;In December 2025, they classified drivers protected with VMProtect, Themida, or Virtualizer as malware or potential vulnerabilities without providing any notification&amp;quot; ...microsoft can actually do good things??? amazed i didnt hear about this until now

  • Post #1315743

    did some compression reversing shenanigans to recover a couple of Mac OS 8.5 builds present (as Disk Copy 6.x compressed HFS partition images) on a badly dumped warez CD missing resource forks https://archive.org/details/Mac.OS.8.5a6c2 https://archive.org/details/Mac.OS.8.5a7c3