Top all-time · #1630
j00ru//vx tech blog
Personal blog · j00ru.vexillium.orgsecuritysystems
j00ru//vx tech blog is a personal blog at j00ru.vexillium.org about security and systems. Since 2011, 47 different Hacker News readers have linked it 56 times, most often “Windows X86-64 System Call Table”. The last post was in 2018, but the archive is still widely read.
Most-linked posts?
- Windows X86-64 System Call Table16 people · 18 mentions · first linked 2019-01-04
- A story of cross-software ownage, shared codebases and advanced exploitation [pdf]3 people · 3 mentions · first linked 2015-06-24
- Detecting Kernel Memory Disclosure with x86 Emulation and Taint Tracking (2018) [pdf]3 people · 3 mentions · first linked 2018-07-05
- /syscalls/win32k/64/2 people · 2 mentions · first linked 2019-09-01
- Results of recent PostScript CharString security research2 people · 2 mentions · first linked 2015-06-24
- /ntapi_64/2 people · 2 mentions · first linked 2015-07-08
- /2014/01/ffmpeg-and-the-tale-of-a-thousand-fixes/2 people · 2 mentions · first linked 2023-05-30
What Hacker News says?
FFmpeg and a thousand fixes: https://j00ru.vexillium.org/2014/01/ffmpeg-and-the-tale-of-a... "While reading about the 4xm demuxer vulnerability, we thought that we could help FFmpeg eliminate many potential low-hanging problems from the code by making use of the Google fleet and fuzzing infrastructure we already had in place"
Comment linking /2014/01/ffmpeg-and-the-tale-of-a-thousand-fixes/
on “FFmpeg to Google: Fund us or stop sending bugs”Submitted Windows X86-64 System Call Table as a story · 179 points
HN discussionLinux is exceptional in that it has stable syscall numbers and guarantees stability. This is largely why statically linked binaries (and containers) "just work" on Linux, meanwhile Windows and Mac OS inevitably break things with an OS update. Microsoft frequently tweaks syscall numbers, and they make it clear that developers must access functions through e.g. NTDLL. Mac OS at least has public source files used to ge…
Comment linking /syscalls/nt/64/
on “Apple announces Foundation Models and Containerization frameworks, etc”Submitted Introducing the USB Stick of Death as a story · 165 points
HN discussionSymbol names and function prototypes in ntdll.dll are stable (albeit not officially stable), but system call numbers change frequently: https://j00ru.vexillium.org/syscalls/nt/64/
Comment linking /syscalls/nt/64/
on “αcτµαlly pδrταblε εxεcµταblε”Submitted Results of recent PostScript CharString security research as a story · 63 points
HN discussionNtdll is the kernel ABI on windows; it is stable, and cosmopolitan uses it. Not sure what you mean by ‘on Windows thing are more stable’; syscall numbers change all the time. See https://j00ru.vexillium.org/syscalls/nt/64/
Comment linking /syscalls/nt/64/
on “Cosmopolitan Libc: build-once run-anywhere C library”Submitted Windows x86-64 System Call Table (XP/2003/Vista/7/8/10/11 and Server) as a story · 42 points
HN discussionThey do change over time, and programs will break between updates on different windows versions of you make syscalls directly. https://j00ru.vexillium.org/syscalls/nt/64/ (click show all)
Comment linking /syscalls/nt/64/
on “Can I use a system call?”Submitted Bochspwn: Exploiting Kernel Race Conditions Found via Memory Access Patterns as a story · 20 points
HN discussionWindows syscall interface changes all the time. [1] has a table of windows syscall numbers. Just looking at the first syscall, NtAcceptConnectPort, you can see that all windowses up to and including 7 used 0x60; windows 8 changed to 0x61; 8.1 changed it to 1; and then 10 changed it to 2. 1. https://j00ru.vexillium.org/syscalls/nt/64/
Comment linking /syscalls/nt/64/
on “Swift System Is Now Open Source”Submitted Detecting Kernel Memory Disclosure with x86 Emulation and Taint Tracking (2018) [pdf] as a story · 14 points
HN discussionA value in the range between -4095 and -1 indicates an error, it is -errno. The syscall/errno stuff has always seemed unusual, inelegant, and inefficient --- instead of just returning a negative error code directly, the function returns the vague "an error has occurred" -1, and you have to then check errno separately after that. It only adds insult to injury when you realise that the kernel itself isn't doing it, bu…
Comment linking /ntapi_64/
on “Writing C software without the standard library”Submitted Detecting Kernel Memory Disclosure with X86 Emulation and Taint Tracking [pdf] as a story · 3 points
HN discussionWindows syscall numbers change with every service pack release (see https://j00ru.vexillium.org/syscalls/nt/64/ for an incomplete table), and the interfaces themselves are not guaranteed to be stable in any way. ntdll is the only reasonable way to make syscalls on Windows. Trying to build your own syscall code on Windows is fragile and unmaintainable. Linux maintains stable syscall interfaces. BSDs don't guarantee i…
Comment linking /syscalls/nt/64/
on “Why are my Go executable files so large?”Submitted PDF fuzzing and Adobe Reader 9.5.1 and 10.1.3 multiple critical vulnerabilities as a story · 3 points
HN discussionYes Windows does provide such a thing: http://j00ru.vexillium.org/ntapi/ Would be very interesting to see a Wine based on this concept instead...
Comment linking /ntapi/
on “Bash on Ubuntu on Windows”Submitted Detecting Kernel Memory Disclosure with X86 Emulation and Taint Tracking [pdf] as a story · 2 points
HN discussionCompare this: https://linuxhint.com/list_of_linux_syscalls/ with https://j00ru.vexillium.org/syscalls/nt/64/ and https://j00ru.vexillium.org/syscalls/win32k/64/
Comment linking /syscalls/win32k/64/
on “Proposed futex2 allows Linux to mimic the NT kernel for better Wine performance”Submitted Windows Kernel Local Denial-Of-Service: NtNtDuplicateToken (Windows 7-8) as a story · 2 points
HN discussionhttp://www.devttys0.com/blog/ http://www.dumpanalysis.org/blog/ https://blogs.oracle.com/ksplice/ http://j00ru.vexillium.org/?lang=en http://blogs.msdn.com/b/ntdebugging/
Comment linking /?lang=en
on “Ask HN: What unknown technical blogs or sites do you read?”Submitted Windows win32k.sys menus and some "close, but no cigar" bugs as a story · 2 points
HN discussionMicrosoft also changes the kernel syscalls between releases. It's not unusual for operating systems to specify ABI at the libc level, in fact I believe Linux is the odd one out to specify ABI at the syscall level. https://j00ru.vexillium.org/syscalls/nt/64/
Comment linking /syscalls/nt/64/
on “November 2022 Progress Report”Submitted CVE-2012-2553: Windows Kernel VDM use-after-free in win32k.sys as a story · 2 points
HN discussion> I wonder how many of the bugs led to code execution? The linked blog article [1] suggests 10% - 20%: Our personal feeling is that between 10% and 20% of the problems could be considered easily exploitable security issues; however, the estimation has not been formally confirmed in any way. [1] http://j00ru.vexillium.org/?p=2211
Comment linking /?p=2211
on “FFmpeg and a thousand fixes”Submitted Defeating Windows Driver Signature Enforcement #1: default drivers as a story · 2 points
HN discussion> relatively little investment compared to migrating to an OS on another kernel One of the more beautiful aspects of Windows is you actually rarely interact with the kernel at all. That portion of the OS could (and in practice often is) switched out and replaced without the user-facing portions being aware. If you look at the list of NT system calls [0] you can see how frequently they've changed. The only programs t…
Comment linking /syscalls/nt/32/
on “ReactOS Updates”Submitted Protected Mode Segmentation as a powerful anti-debugging measure as a story · 1 points
HN discussionKASLR: Kernel Address Space Layout Randomization. See https://en.wikipedia.org/wiki/Address_space_layout_randomiza... for an overview on what this does. SMAP/SMEP: Intel/x86-specific security features. See http://j00ru.vexillium.org/?p=783 for an early (2011!) take on SMEP. (j00ru is great reading, in any case.) See https://lwn.net/Articles/517475/ for SMAP from LWN. PAN: Privileged Access Never, Basically ARM SMAP:…
Comment linking /?p=783
on “The status of Linux kernel hardening”Submitted Bochspwn Reloaded: Detecting Kernel Memory Disclosure with x86 Emulation (2017) [pdf] as a story · 1 points
HN discussion
