@_numinit

+42 dB // "The dance is always danced above the hollow place, above the terrible abyss." -Sparrowhawk

 San Diego, CA
Joined March 2014
  • Tweets928
  • Following227
  • Followers154
119Media
sophg.one is maybe the first bootloader unlock for two architectures at once, thanks to #nix sha256(sophgone):

Sophgone SG-1

Mask-ROM BL2 stack overflow disclosure for the Sophgo SG2000 / CV181x

sophg.one
mjones (@numinit)@_numinitSep 3
4a3614cc900f3e0bc954ac49ed1836fdad7e291f5fe23b0359b18120ad22e4e6
2
3
471
DOOM is finally fast on the Nix Badge with some patches to pixman and wlroots.
7
Turning the CODA980 H.264 codec into a GPU for the #nixbadge which otherwise does not have a GPU As far as I know, H.264 codecs have not been exploited for 3D rendering before... let's change that
2
91
I have seen at least one php2shell PoC that funkyenv breaks so far. Need a bigger info leak, y'all! :)
mjones (@numinit)@_numinitOct 22
Randomize your binaries' function layout with #nix, in case you want to make it harder for blind ASLR bypasses to work. Tested with WordPress and openssh, Firefox is building now github.com/NixVegas/funkyenv

GitHub - NixVegas/funkyenv: 🎲 Mix your binaries up so people can't exploit your PHP install as...

🎲 Mix your binaries up so people can't exploit your PHP install as easily - NixVegas/funkyenv

github.com
2
207
When your root CA company's name becomes a command line option in mitmproxy. github.com/mitmproxy/mitmpro…

Add `--emudhra` option by mhils · Pull Request #8500 · mitmproxy/mitmproxy

Fixes #8497

github.com
4
130
Randomize your binaries' function layout with #nix, in case you want to make it harder for blind ASLR bypasses to work. Tested with WordPress and openssh, Firefox is building now github.com/NixVegas/funkyenv

GitHub - NixVegas/funkyenv: 🎲 Mix your binaries up so people can't exploit your PHP install as...

🎲 Mix your binaries up so people can't exploit your PHP install as easily - NixVegas/funkyenv

github.com
1
7
451
PHPocalypse Now
3
1
9
257
-----BEGIN EC PRIVATE KEY-----
7
167
NixOS mentioned by @qkaiser > A vulnerability affecting Broadcom’s proprietary implementation of 802.11 has been present in their SDK since at least 2010 (check out the slides) quentinkaiser.be/security/20…

One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux

A vulnerability in Broadcom’s proprietary WPS implementation enables unauthenticated attackers within WiFi range to leak memory and achieve unauthenticated remote code execution on millions of...

quentinkaiser.be
7
387
2e-31
Doug Colkitt
@0xdougOct 8
We are publishing an update to OpenAI problem #109 (integer multiplication) with further tightening. κ = 2⁻³⁴ (tightened from κ = 2⁻¹⁸²) The exact witness is 8.3 × 10⁻¹¹, a roughly 48 million fold improvement over the previous result and a 2¹⁴⁸ fold improvement over original OAI result. The improvement came from removing the spacing penalty behind the quadratic bottleneck. This was done by moving compact control bits instead of entire windows.
1
1
106
\kappa = 5.9e-10 (>2e-31) for integer multiplication, apparently (patch and nix flake soon)
1
110
we've just hit 5.9999e-10 (found some more 9s for @github)
36
mjones (@numinit) retweeted
geoff
@GeoffreyHuntleyOct 7
🗞️ the world hasn’t figured out yet that you can literally just fix everything with a Nix overlay In this blog post, I go into how I use Nix, why you should use it, and in the tweet below is a runnable demo showing all of the concepts in this post ghuntley.com/nix/
18
15
9
223
20,573
once I finish cooking up sway on the nix badge (hopefully quake will be more stable than it was at nixcon) it's probably time to do something silly with the 0.5 TOPS TPU on the SG2K right now the DRM stack is pretty broken - timing, colors, and overscan are all messed up
2
8
697
Problem was a Sophgo VO driver bug. The VO was applying a YUV to RGB matrix that the VO driver corrupted by setting the top left element to 0 instead of the whole thing to I = { 1 0 0; 0 1 0; 0 0 1 } so the color transform was completely broken
20
choose effects over 3Ds (quick demo reel on the nix badge, sway works)
6
179
mjones (@numinit) retweeted
Mikael Brockman
@meekaaleSep 26
finally had the chance to tell the inventor of Nix in person, after his talk on how to make Nix faster, that I’ve figured out a way to make it 7x slower
3
1
1
30
2,937
it would be cool to get raw I/Q data out from the AIC8800 and do ✨ something ✨
1
146
The AIC8800 is a lower power WLAN chip from AICSemi running a RivieraWaves(tm) RTOS on an armv6l connected to a diplexed 2.4/5GHz stack. It implements full MAC. Dumping the mask ROM was done through very slow 32 bit SDIO memory peek commands from the Linux driver.
92
Everyone ought to check how much the @NixVegas crew phoned this mask ROM vuln disclosure in. We styled it after the classic Y2K Stargate SG-1 website and it kind of slaps sophg.one
3
5
228
ai labs use "sandbox" in the game dev sense and not in the linux security sense
vik
@vikhyatkSep 26
Replying to @tomekkorbak
questions: 1. why was the DNS tool able to bypass the sandbox? 2. why 2.5 hours from detection to pausing the run?
28
297
14
5,427
119,978
Load more