Karl Koscher supersat

Native Secure Enclave backed ssh keys on MacOS

It turns out that MacOS Tahoe can generate and use secure-enclave backed SSH keys! This replaces projects like https://github.com/maxgoedjen/secretive

There is a shared library /usr/lib/ssh-keychain.dylib that traditionally has been used to add smartcard support to ssh by implementing PKCS11Provider interface. However since recently it also implements SecurityKeyProivder which supports loading keys directly from the secure enclave! SecurityKeyProvider is what is normally used to talk to FIDO2 devices (e.g. libfido2 can be used to talk to your Yubikey). However you can now use it to talk to your Secure Enclave instead!

ESP-IDF have exported function esp_err_t esp_wifi_80211_tx(wifi_interface_t ifx, const void *buffer, int len, bool en_sys_seq); It allows user to send raw ieee802.11 packets, it allows only certain types of packet.

To bypass check and send all packets you want you need to remove one call and replace it with mov instruction.

To use bypass copy "bypass.S" next to your "main.c", change CMakeLists.txt to something like this: idf_component_register(SRCS "main.c" "bypass.S" "other_c_files.c" INCLUDE_DIRS ".") and use esp_wifi_80211_tx_mod to send any packet you want using example code from bypass.c

Reverse Engineered VAS Protocol Specification

Research by Grayson Martin
Last Updated 7/8/23

Introduction

Value Added Services (VAS) is the protocol used by NFC capable passes in Apple Wallet. Access to this protocol is heavily restricted on both the device end (a special certificate issued by Apple is required to create these passes) and the reader end (NDA enforced confidentiality). As such, a desire arose to better understand the protocol in order to explore additional use cases and examine its cryptographic integrity. There are gaps in understanding in certain parts of this protocol, however this document contains the minimum necessary understanding to automatically select, read data from, and decrypt a pass.

Importantly, this specification does not enable a malicious actor to read the data from a pass for which they do not have both the reader's private key, and the pass type identifier. Imp

Introduction

As the Ghidra open source community is growing, trying to document the new projects around Ghidra. Feel free to fork the gist and propose improvements.

CPU support

New 6502 language module for Ghidra
Atmel AVR helpers for Ghidra - ATmega328p
Processor definitions for DMG and CGB in Ghidra - Gameboy CPU (LR35902) (WiP)
ghidra based disassembly of the x68000's IPL.

ModelSim Installation on Ubuntu

Installation requirements

The free version of Modelsim is a 32-bit binary and therefore requires certain 32-bit libraries in order to work correctly. For Ubunutu, install the following packages

sudo dpkg --add-architecture i386
sudo apt-get update
sudo apt-get install libc6:i386 libncurses5:i386 libstdc++6:i386 lib32ncurses6 libxft2 libxft2:i386 libxext6 libxext6:i386

Falsehoods programmers believe about time

This is a compiled list of falsehoods programmers tend to believe about working with time.

Don't re-invent a date time library yourself. If you think you understand everything about time, you're probably doing it wrong.

Falsehoods

There are always 24 hours in a day.
February is always 28 days long.
Any 24-hour period will always begin and end in the same day (or week, or month).

	<?xml version="1.0" encoding="utf-8"?>
	<wsdl:definitions xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"
	xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
	xmlns:u="urn:Belkin:service:basicevent:1">

	<wsdl:types>
	<xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema" targetNamespace="urn:Belkin:service:basicevent:1">
	<xsd:element name="SetBinaryState">
	<xsd:complexType>
	<xsd:all>

	from nmigen import *
	from pprint import pprint

	PFD_MIN = 3.125
	PFD_MAX = 400
	VCO_MIN = 400
	VCO_MAX = 800

	def find_pll_params(input, output):
	freqs = []

	#! /usr/bin/python3

	import sys

	#MainUnit
	key = b'\x7a\x49\x1e\xeb\x33\x28\x2b\x8b\x84\xa7\xad\x47\xb8\x31\x03\xd0'

	def main():
	fileIn = open(str(sys.argv[1]), "rb")
	fileOut = open("file.out", "ab")