Submitted by dennis on Fri, 03/15/2013 - 23:36
Submitted by dennis on Tue, 08/14/2012 - 23:00
Some smartcards can execute Java or .NET code - that's the way to hide your sensitive algorithm into chip that very hard to break (decapsulate).
For example, one may encrypt/decrypt data files by hidden crypto algorithm rendering software piracy of such software nearly impossible.
That's what called Black box in math: http://en.wikipedia.org/wiki/Black_box
Some software protection dongles offers this functionality too.
Submitted by dennis on Thu, 07/19/2012 - 17:48
These PoCs (proof-of-concept) I made while discovering Oracle NA (network authorization) packet structure...
CVE-2012-1745 and CVE-2012-1746 are just DoSs (denial of service), CVE-2012-1747 is heap overflow.
CVSS score is 5.0 for each.
Fixed in CPUjul2012.
Submitted by dennis on Tue, 07/17/2012 - 11:04
Submitted by dennis on Tue, 07/17/2012 - 10:59
Here is two PoCs for CVE-2010-0911 TNS Listener vulnerability fixed in CPUjul2010 (CVSS 7.8).
Was reported via Sentrigo (now part of McAfee) and found using fuzzing...
Submitted by dennis on Fri, 09/23/2011 - 14:29
Submitted by dennis on Wed, 07/27/2011 - 17:02
Just added to my generic tracer a module which I can call "dataflow tracker".
This is a module which would be able to answer the question "where each received from network byte is RIGHT NOW?"
It's state is far from release-state, so I can't publish it yet.
But how it works is extremely simple. When function like socket recv() is called and it received some data chunk from network, dataflow tracker (dt) marking each byte in memory buffer in form:
Submitted by dennis on Wed, 07/27/2011 - 12:30
Not sure if it's worth blogging...
All strings in Oracle RDBMS network layer are usual C-strings terminated by zero byte, but often, string length is also passing as a separate function argument.
This makes some things much faster.
* strlen() is not necessary anymore - just take string length you already have.
* strcat() do not need to calculate string lengths.
* strcmp() against const string is working much faster:
Instead of:
Submitted by dennis on Wed, 04/06/2011 - 11:12
Submitted by dennis on Wed, 01/19/2011 - 02:12
New Advanced Vector Extensions (AVX) x86 CPU extension is extending SIMD registers from 128 to 256 bits.
It is present now in Intel Sandy Bridge CPUs and will present is future AMD CPUs as well.
It is possible to make my Oracle passwords (DES) solver working at double speed on these CPUs because of register extension.
But I need to test it before.
Pages
