Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Ange Profile picture
@angealbertini
Aug 2, 2020 • 4 tweets • 2 min read • Read on X
MP3 players... Cubic Players ImageImage
DOSAmp ImageImage
WinPlay3 ImageImage
WinAmp ImageImageImage

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Ange

Ange Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @angealbertini

Ange Profile picture
Sep 23, 2022
ICYDK the issue 0x14 of PoC or GTFO has articles about PostScript, GIF, PDF and NES (code) hashquines by @teh_gerg, @__spq__ , @makomk, @ESultanik and @evan_teran.
github.com/angea/pocorgtf…
The issue itself is a PDF/NES hashquine.
And @doegox’s small article about putting the MD5 on the front cover of the PDF via PDFLaTeX.
Rogdham did a very nice write-up about GIF hashquines. rogdham.net/2017/03/12/gif…
Read 4 tweets
Ange Profile picture
Sep 9, 2020
From a file format perspective, it's pretty cool to get different payloads - both authenticated - from the same ciphertext with different keys.

It's a neat way to exploit key rotation: clean now, malicious tomorrow.
Naturally, from a format perspective, it was always doable with any form of polyglots, as both formats typically don't overlap.
However, it's even more powerful: when one format is decrypted, the other format is garbled, which bypasses polyglot blacklisting (easy PDF polyglots).
Also, it's possible to bruteforce nonce to get some overlapping bytes, which enables polyglots unique to crypto-polyglots, such as PDF-PE (get the PDF you want now, it becomes Wannacry later).
Read 5 tweets
Ange Profile picture
Aug 8, 2020
When people ask me about the French language,
I tell them about "99 birds".

Why... what could go wrong?...
We read 99 as 'quatre vingt dix neuf' (4 20 10 9),
because 4*20=80 and 80+10+9 = 99 ;)

yes, '4 20' is the official way in France to read "80".

In other countries, they sometimes say "80" huitante (8 = huit),
which makes sense since 60 is soixante, even in France (6 = six).
Seriously, my son thought I was joking when I told him about 99 for the first time.
Especially because it requires to understand multiplication, which is a lot more complex than adding 1 or 10 for him at the time...
Read 5 tweets
Ange Profile picture
Jul 28, 2020
Recap thread on files set I've contributed to depending on your needs.

Mocks to understand magic signatures
A polymock to demonstrate magic abuse
github.com/corkami/pocs/t… Image
borderline valid but usually content-less files
github.com/mathiasbynens/…
Read 5 tweets
Ange Profile picture
Jul 27, 2020
FWIW I made a set of minimal but self-descriptive pics of common file formats.
github.com/corkami/pocs/t… Image
PoCs, not pics.
ICYDK I made posters that explains some of these formats
github.com/corkami/pics/b… Image
Read 5 tweets
Ange Profile picture
Jul 9, 2020
Another trick with `file` is that the types are checked by category, so some lesser known types will be checked before the classic exploitable ones (and not in the offset order either)

check the list:
github.com/file/file/tree… Image
The Allegro magic is first,
But the Acorn one is scanned first. (Acorn < Allegro in the alpha order) Image
So you can take, say a PNG. Image
Read 5 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

Send Email!

:(