AdmVonSchneider
Joined 10 years ago
Karma
9
Submissions
11
Member since
Mar 19
Recent submissions
Comment · 2 years ago
Comment · 5 years ago
> If zlib goes in to an infinite 100% CPU loop, perhaps due to a zip bomb, you're still screwed as far as I can tell
You can set CPU and wall time limits and the sandbox will be killed if it runs for longer.
> A full RPC abstraction also gives you the opportunity to change out the backend implementation that this doesn't.
Absolutely, but the RPC mechanism in SAPI is an implementation detail and ideally not something you should have to care about. You can of course just use the Sandbox2 part of Sandboxed API and implement an RPC layer yourself.
Comment · 5 years ago
In case you're using CMake instead, you may want to take a look at the `hello_sapi` example (https://github.com/google/sandboxed-api/blob/main/sandboxed_...).
Other build systems will be significantly harder to integrate with.
Comment · 7 years ago
Anyone interested in accurate (and fast) instruction decoding for x86(-64) should also look into Zydis: https://github.com/zyantific/zydis
Comment · 10 years ago
+1 for the logo. Now please update the project web site with matching colors :P
Comment · 10 years ago
LOL, haters gonna hate. So let's see...
- BinDiff would work stand-alone if someone wrote an exporter for another disassembler (BinDiff uses https://github.com/google/binexport for that).
- Closed source - yeah it contains some secret sauce and also depends on a commercial graph library (yFiles). Not easily replaced. Their product is also pretty good.
- Limited platform support - well, there is an older OS X version as well and we have this on our radar for future releases.
- Far better free solutions - please do show. Maybe we can do a diff-off some time :)
YOLO :P
Comment · 10 years ago
There used to be (4.0). I'm working on it, though :)
Comment · 10 years ago
Yeah that's a sore point :-/
The downloads are served via HTTPS, though. Also, publishing the SHA1 hashes over HTTP kind of defeats the purpose, so here they are again (HackerNews is HTTPS :)):
bindiff420-debian8-amd64.deb 38fbea8070495fc8730d7c86eae03bc68fde291f bindiff420-debian8-i386.deb 49cdd6ae7ebe5b1813a5fcafaae9fde19005c824 bindiff420-win-pluginsonly.zip e2b786d405aac23aced989e02080dd69c18ab75e bindiff420-win-x86.msi 89f2eadc6582d4acca1e78db3617b5fba3eced0f bindiff-license-key.zip 95715a8bd7469106fc60b03f94f3cc87604e354c
Comment · 10 years ago
You only need the IDA Pro Starter Edition (589 USD, 32-bit files only) or the regular IDA Pro version for a single architecture (1129 USD).
Even so, IDA comes with decades of RE experience baked into its heuristics and analysis features. It's quirky, yes, but as a professional tool it's also worth the money.
Comment · 10 years ago
Well it mostly works on 6.9 as well. Linux should work without any restrictions, but on Windows there were some IDA Qt changes that lead to some annoyances:
- Can't reopen BinDiff windows after they were closed
- Shortcuts don't work
Other than that the Windows version is functional.
Comment · 10 years ago
Yup, we didn't bother with updating it in a looong while :-/
https://web.archive.org/web/20110902114238/http://www.zynami...
We never got around to open sourcing it, so I'm happy to see that there is work being done in this space.
Congrats to seekbytes for releasing this!