heljara
Joined 5 years ago
Karma
35
Submissions
9
Member since
Apr 13
Recent submissions
Comment · 9 months ago
Comment · 1 year ago
Thank you for the reply. Unfortunately, I don't own an iPhone - maybe I can borrow one, though. Any limitations of the app or practical advice you might want to share?
Comment · 1 year ago
I've been toying with photogrammetry a little bit lately, specifically for scanning indoor rooms and spaces. So far I'm finding metashape the most suitable for it, but some of the precision isn't great (but I'm still improving my technique). I mostly want to convert the interior of one real building into a digital model for preservation and analysis. I've briefly considered LIDAR, but put it in the too hard/expensive bucket. This project seems to challenge that assumption.
What does the software post-processing look like for this? Can I get a point cloud that I can then merge with other data (like DSLR photographs for texturing)?
I see in their second image[1] some of the wall is not scanned as it was blocked by a hanging lamp, and possibly the LIDAR could not see over the top of the couch either. Can I merge two (or more) point clouds to see around objects and corners? Will software be able to self-align common walls/points to identify its in the same physical room, or will that require some jiggery-pokery? Is there a LIDAR equivalent of coded targets or ARTags[0]? Would this scale to multiple rooms?
Is this even worth considering, or will it be more hassle than its worth compared to well-done photogrammetry?
(Apologies for the peak-of-mount-stupid questions, I don't know what I don't know)
0: https://en.wikipedia.org/wiki/ARTag 1: https://github.com/PiLiDAR/PiLiDAR/raw/main/images/interior....
Comment · 3 years ago
Good news, everyone! There is a WiFi standard for it: 802.11ah[1]. Seems like you can even buy hardware for it[2] today. Its most likely not going to show up in your phone anytime soon, though.
[1]: https://en.wikipedia.org/wiki/IEEE_802.11ah
[2]: https://www.silextechnology.com/connectivity-solutions/wifi-...
Comment · 3 years ago
Also pretty much every major SAN vendor underpinning the VMs in your local cloud provider.
Comment · 5 years ago
You can use the Meshtastic project to SSH between two computers connected with LoRa: https://meshtastic.discourse.group/t/guide-ssh-over-meshtast...
Not LoRaWAN, but over a DIY mesh network is still pretty cool.
Comment · 5 years ago
The actual bug is much before this though, WASM is just used to get a RWX page of memory, as v8 won't give JS that the other side of the JIT process.
Comment · 5 years ago
Broadly speaking, the wasm stuff is only there as a method of getting the browser to execute shellcode, its a pretty standard lump of code for turning a memory bug into code execution in v8. What this shellcode does is open calculator when the browser's sandbox is disabled (`--no-sandbox`). In general in v8 exploitation, once you've reached a point where you can read and write arbitrary memory, you find that v8 will only create either RW or RX pages for you when the JIT compilation happens. WASM is a neat little trick for getting a handle to a RWX page.
At first glance to me, the core bug is actually in abusing an array enough to get an unsigned int into a function that expects them all to be signed, causing an off-by-one error and leveraging that into a memory leak (to get the pointer to a FixedArray for floats and a pointer to a FixedArray of objects) and then replacing one with another to create a type confusion and read/write arbitrary memory through that. r4j will probably correct me on the subtlety here though!
Source: extremely similar to HackTheBox RopeTwo, which I spent more time than I am prepared to admit solving.
Disclaimer: am noob at v8 exploitation, but have done enough of it to know some of the tricks.
See also, an article that helped me previously, much of the code is similar (eg: the WASM stuff, the addrof() and fakeobj() methods): https://faraz.faith/2019-12-13-starctf-oob-v8-indepth/
Comment · 5 years ago
To add some further context that isn't written here, the exploit developer here has been tinkering around with v8 for a while. Last year he published a vulnerable VM to HackTheBox (a CTF platform) called RopeTwo[1], where the initial entry point looked extremely similar to this. Its largely regarded as one of the most difficult challenges to solve to date.
Suffice to say, military and intelligence agencies are probably a few generations ahead of this and you won't find them commenting on strategic capabilities on HN.
1. https://www.he360.com/ 2. https://spire.com/space-reconnaissance