Your #Linux#internals tip of the day: On Linux, there's a magical directory called /proc. In it, every process get a subdirectory according to its PID. Inside of this /proc/pid (that framework is called procfs) you can find a lot of information about the process, (1/3)
everything from it's memory allocation mapping (/proc/pid/maps) to the command line that executed the process (/proc/pid/cmdline) and more... An interesting file to check there is "status". Status sums up a lot of interesting pieces of information such as the PPID, owner (2/3)
uid/gid and more. If you're new to Linux internals, give yourself a tour of the /proc directory. The full documentation of procfs can be read here: kernel.org/doc/Documentat… (3/3)
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Had another "debate" with an avid trump supporter today over WhatsApp. Nuts. Facts I provided, backed with sources, graphs, charts, and actual empirical data meant nothing. For every fact there was a deflection and whataboutism. We couldn't even agree on reality. Depressing stuff
Eventually I snapped and the guy in a pretty large chat group "bro, you're in a cult". He replied that I am "in the cult of hate". I'm not proud of myself for talking like that to someone in front of a lot of people in a group chat but Im also tired of people not facing reality
I do believe though, that I gave a master class in debate to a whole group of people that never asked for it. Lol.
1/n Thread: Been reversing this malware that's been going around Ukraine. It appears to be a wiper that's dropping a driver to do low-level partition manipulation. That driver appears to be a legitimate EaseUS Partition Master driver
2/n This driver can also be seen accessing Parition0 of Hardisk%u (probably the boot device) in order to corrupt the partition table? (I've only done static analysis so I'm not quite sure)
Another thing that caught my eye was the pdb - when looking for those strings, I found a stackexchange post from almost a decade ago discussing an old version of the same driver, the paths are similar (see screenshots), so it looks like a recent version of the same EaseUS driver