魔法少女プリティジューリャ

I'm trying to figure out how long it takes for a particular shuffling algorithm to cycle for a particular number of elements. The algorithm is to count from 1 to M, moving the character at position M mod N (N:=number of elements) to the end, and moving everything down so there's no space. [i.e. (indexed from 1 here) g(1,"ABCDEF")="BCDEFA", then g(2,"BCDEFA")="BDEFAC", then g(3,"BDEFAC")="BDFACE", eventually this will cycle; How long? (30 in this example (That's M).)] I've stumped The On-Line Encyclopedia of Integer Sequences, I want to find f() which generates the following sequence, and I don't want to think about this too hard, and I don't have my Knuth books handy (I think it involves factorials).

What is f()?
f(2) = 2
f(3) = 4
f(4) = 9
f(5) = 20
f(6) = 30
f(7) = 36
f(8) = 28
f(9) = 72
f(10)= 36
f(11)= 280
f(12)= 110
f(13)= 108
f(14)= 182
f(15)= 168
f(16)= 75
f(17)= 1120
f(18)= 306
f(19)= 432
f(20)= 190
f(21)= 140
f(22)= 4410
f(23)= 2772
f(24)= 2530
f(25)= 1440
f(26)= 650
f(27)= 3120
f(28)= 243
f(29)= 812
f(30)= 870
f(31)= 1800
f(32)= 186
f(33)= 1056
f(34)= 10164
f(35)= 1428
f(36)= 2100
f(37)= 35640
f(38)= 1110
f(39)= 14212

A reader asks:

How can I get a job looking at malware? I worked at a company that was exposed to lots and lots of stuff targeting Chinese dissident groups and got pretty good at analyzing, tracking and spotting it. Do you know anyplace that I could go to do this for a living?
Any input appreciated

I don't have time to write a proper response to this, so perhaps you, the reader, can offer some advice.

A question I am frequently asked is: What do you do for a living?

I'll usually say something like I'm a malware analyst. — although that's an incomplete answer. And they'll say What's malware? And I'll try to explain it to them, but they're too impatient for more than a one sentence explanation. And so I say stuff about hacking and computer viruses and spam, in about two or three sentences, which don't penetrate their skull. (Since they didn't really want to know the answer, they were just making small talk.) And in frustration I'll say something like I break into computers for a living. And then they're like Oh! But that's not really what I do either. And If you've ever seen my CV, you'll note that I do a lot of different, hard-to-explain things. Like Reverse engineering, exploit development, vulnerability analysis, tool development, and even some QA work (tracking down the root cause of the really hard bugs).

The only really succinct response I've come up with is that I stare at the 1's and 0's, and explain what's going on in English. (Or that I'm just really smart at people.)

This is what I actually do for a living, seriously:

http://xkcd.com/350/

Speaking of which, I'm (or should be) working on an abstract for a presentation for Security Opus and Black-Hat Europe, next spring. I'm not 100% certain what I'm going to talk about, since I'm still researching it, so it will be sufficiently vague that I can fill in the details… once I have them. Considering how many talks never match up the the vague blurbs in the schedules, I think most presenters do this.

Anyway, what would you, the LJ-reading audience, like to hear me give a presentation on?

[Poll #1096517]

There are some other projects I have too, that I could probably talk about, but I don't think I'll have them done in time.

The morning after I made this post: http://foxgrrl.livejournal.com/50642.html I walked into work — that afternoon actually — and was making random chit-chat with a coworker — flint_otter actually — and he said that he was reading this article on C|Net about how there was some new super-exploit already for the recent Windows vulnerability, and I'm like: Yeah, the MS06-070 one, I just wrote an exploit for it last night. And he's like, No it's something really new as of Tuesday. And I'm like, Yeah, that was MS06-070, unless one of the other ones was horribly exploitable. And he's like, Well, someone just wrote an exploit for it, and it's on the front page of C|Net. And I'm like, Um, I just wrote an exploit for it… And made a mention of it in my blog… Having been around C|Net reporters before, I know that they print a lot of hearsay and rumors from questionable sources. [And as I write this, Nyah keeps trying to tickle me → Just you wait until I write about this in my LJ! I exclaim. It's making it a bit hard to concentrate…]

So, I looked the article up…

http://news.com.com/Experts+raise+Windows+security+alarm/2100-1002_3-6136310.html

Paranoia mounting… Right now, I really don't need nameless cyclopean institutions investigating me… again. Especially, if there's suddenly a huge MS06-070 exploiting-worm outbreak. You know, it looks kinda suspicious, since I told a bunch of people that I write 0-day exploits and internet worms for a living; I might be viewed as a suspect. But I quickly figured out that they were referring to this: http://www.milw0rm.com/exploits/2789 (I still haven't published my MSF3 module anywhere.)

There was a period of time when I wasn't oppressively paranoid all the time, when I wasn't incredibly uptight and stressed out… when I wasn't pretending to be normal. It was right after I transitioned (the first time). In a way, I was really going from one box to another by going stealth - But there was a time in between, when I was outside of the rigid boxes.
( Read more... )

Now students, can anyone tell me what happens next?
( Courtesy LJ cut for large images )
I think that it'll help if I tell you that the heap structure at 0x00BFA8D8 was a free block, originally 0x005E 0x004D 0x01 0x10 0x00 0x00 with the forward and backwards pointers both set to 0x00230178, and I don't know why the fuck I can remember that without having to look it up, when I can't even remember my own postal address most of the time. (Maybe it's like lurene said, that all the really good reverse engineers/assembly coders are mentally broken in some way.) Anyway, 0x00230178 is the start of the free list (I think), it points back to 0x00BFA8E0.

Anyway, since this is Windows 2K Advanced Server SP0, I could just overwrite one of the function pointers in the PEB, or the TEB... or the SEH, wheee! [I'll explain later...] Although this particular buffer tends to move around a bit in memory, and I've been up all night trying to make the exploit [no you can't have a copy] more reliable. So I've been thinking of using Halvar's trick of building a VirtAlloc structure in the buffer underneath the free block, to get an extra DWORD copy. And with two writes, I think that would be enough to make this reliable, because the pointer to the free block exists in the segment table at 0x00B70027 (I think it was), which I know the address of. And worst case I could leave the original Forward pointer intact, because that does point to the FreeTable entry for itself. (In other words, if I can take the DWORD located at 0x00B70027 -- which points to data from the overflowed buffer, and write it to your favorite function pointer, then the shellcode will be jumped to exactly.)

Maybe.

Either that I'll just have to manipulate the heap list itself in such a way, that I can control where the next buffer will be written (to an address of my choice), write the shellcode there, and then do the overflow again to put this known address in some know location that will jump to it.
( Overtired )