2 comments

  • kibitzor50 minutes ago
    Thanks for posting! ~15k lines of code, a lot to poke around in. I was working on a Siemens S7 PLC project with a WINCC HMI for a power plant (the same target of the cyber-weapon) as I listened to the audio book[2] based on this ~12 years ago, entirely changed how I viewed critical industrial infrastructure. One quote from the book that stuck with me was how you can only use a cyber weapon once at full potential, as it’ll either get patched and&#x2F;or everyone can reverse engineer it to use.<p>For those not familiar with Stuxnet, it’s a discovered cyber-weapon from 2010 which “reportedly destroyed almost one-fifth of Iran&#x27;s nuclear centrifuges. ” and “ neither the United States nor Israel has openly admitted responsibility” but likely were the developers [1]<p>[1-Wikipedia Entry](<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Stuxnet" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Stuxnet</a>)<p>[2-“Countdown To Zero Day” book if you liked the Wikipedia entry](<a href="https:&#x2F;&#x2F;www.audible.com&#x2F;pd&#x2F;Countdown-to-Zero-Day-Audiobook&#x2F;B00P30Z5F2" rel="nofollow">https:&#x2F;&#x2F;www.audible.com&#x2F;pd&#x2F;Countdown-to-Zero-Day-Audiobook&#x2F;B...</a>)<p>[3-“Zero Days” movie](<a href="https:&#x2F;&#x2F;www.imdb.com&#x2F;title&#x2F;tt5446858&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.imdb.com&#x2F;title&#x2F;tt5446858&#x2F;</a>)
  • monster_truck50 minutes ago
    Directory filtering needs to be fixed, one weird filename or symlink will make it BSOD.<p>SSDT should probably have a lock. The chance of a race is ~low (higher under heavy sustained workloads) but it&#x27;s too important to leave to chance.<p>I&#x27;d probably do a rebuild of the directory lists in a separate buffer instead of working in place to avoid alignment fuckups.<p>Yes I used LLMs, just like I did for all of the other vulns I&#x27;ve found or refined. As you can see from the source, this shit is tedious as hell. Doesn&#x27;t change the value of knowing what to look&#x2F;ask for.<p>Give one of those open models a fresh windows box (not a VM) and tell it to fuck something up, it&#x27;s fun.
    • joshka45 minutes ago
      If you&#x27;re using coding agents for this, it may be worth splitting this up into multiple well arranged modules that tell a coherent story and make it easy to browse, and add explanatory docs based on the various things the LLM has found about each function &#x2F; type.
      • monster_truck14 minutes ago
        Waste of tokens IME, better to do it like this and leave that kind of post processing to signature obfuscation.<p>You don&#x27;t need exploratory docs, try asking one for complete function signatures of all the Windows APIs used, it&#x27;s going to spit the docs out.