Disclaimer: 本人與Tornade Cash專案及其員工無任何利益往來。

Tornado Cash是一個Ethereum上的原生隱私轉帳解決方案,使用zk-SNARK+Merkle Tree的路徑證明作為其核心隱私保護機制。

你知我知,Ethereum上的交易記錄是公開的,這使得任何一個人只要知道你的address,便可以在https://etherscan.io/ 之類的網站上查出有多少人和這個位置進行過交易,你做過什麼消費行為或是交易行為等。

或許這聽來不像是個問題,而想要隱藏自己的交易記錄甚至聽起來反而像是不法分子的銷贓行為。

但試想下開情境:因為我曾經使用ethereum捐款給一個政治不正確的專案/組織,而我在接受dd/kyc/reference check的時候因為我的ethere …


In case you’re still using it

Damn it, it’s everywhere

Please check the second half of this article for English version.

從知乎得到的不可考消息與常識判斷,觸寶輸入法早就停止維護更新了。

我想應該很明顯沒有要重新上架的意思,畢竟只做輸入法他們也沒法賺錢。Time to move on.

但如果你像我一樣偏執,死不改變輸入習慣也不想move on,又不在意觸寶後臺送了一卡車隱私統計資料出去,要怎麼處理掉下面這個煩人的廣告?


I hate Android 9/10 fonts fallback behavior.

All thanks to John Wu and the awesome Magisk, so this is possible.

tl;dr: Download this: https://github.com/29988122/Magisk-Modules-PixelFonts-Android-10

This is for demonstration and education purpose only, of how to make a Magisk installer/wrapper. I’ll remove the copyrighted fonts when asked.
Please make sure you own the rights to use these fonts by Google or by htc!

I bought a htc U12+ Mayday customized edition some other day, and then I felt absolutely betrayed by it. The default fonts is some customized curvy fonts from hell, and the com.htc_launcher app is buggy as hell to the point that I cannot even change the fonts back to Roboto properly.

Utilizing this the base script by Lupin…


中文的大家讀得比較快。

其實Chain of Fools那篇已經寫得超級清楚了…不過畢竟是英文的。

以下簡單整理一下時間軸、出問題的lib、出問題的數學式、微軟patch過的function、PoC、以及可以串的exploit

Disclaimer: 沒有一個思路是我原創的。因為英文大概有些人會看得很累,稍微整理個tl;dr給大家而已 — 有講錯請不吝修正,因為那代表大概原本逆的人搞錯了 XD

時間軸

起先是NSA…大概用了很久的0day,2020/01/14的時候跟微軟跟媒體記者¹同步disclose。

NSA從DoD的網域那邊發了一篇 “Patch Critical Cryptographic Vulnerability in Microsoft Windows Clients and Servers”²,然後微軟也從善 …


asynchronous collaboration FTW

The whole “leaking” in chronological order is kind of cool.

It’s a worldwide effort, and everyone in the process is crucial. One missing link, and a fully functional “leak” cannot be achieved. That impressed me a lot.

I have to say — piracy is not cool, and we already have Ghrida
sometimes people like me (dirt poor+a student without work) still need IDA pro as most of the tutorials / convenient steps are conducted via IDA pro.

Thank you for developing such a powerful tool; and sorry, Hex-ray.
(To be honest, by using a pirated copy, I got my…


At least it’s easier to maintain for me.

What is upstream, by the way?

If this article looked extremely easy, and you feel like it’s a no-brainer — it is.
However, knowledge/information should be shared no matter how simple.

Premise: you can’t set permission separately for files/branches. (It’s also not a good practice in version control scheme.)
Premise: your project is public for people to use, utilizing their own credentials for services.

Problem: It’s just a small project, and complex CI/CD scheme could be avoided — how do I sync my credentials onto GitHub(stored in the same folder for maintainability) without accidentally leaking it?

Answer: Make two repos and sync one-way between them. …


Only in your dream…..or?

The following combinations will introduce delay anywhere between 1000ms to 10000ms. My 10+ hours of research results.

  • ffmpeg after I frame tweaking
  • obs with tweaked settings
  • local rtm(f)p server with nginx+monaserver
  • loca rtm(f)p server with nginx+ SRS

And there’s no auth option for monaserver. EXPOSED baby.

It seems that WEBRTC will be the future rather than rtmp, but the time just hasn’t come yet I guess. Found no open source solution for it.

Rather than paid commercial software such as wowza, here’s the free solution that will work flawlessly and take only 6 minutes to set up.

Requirements:

  • AMD Relive…

你永遠猜不透使用者的。

在嘗試的過程中,我發現很簡單的github 手機遊戲外掛reposity,其實也可以搞得很有學問。

我的使用者每天提出的要求、需求,都是我破天荒也想不到的。
大概去問同溫層外的朋友還是想不到。

他們透過我寫在說明書中的指引,利用github上的issue tracker(討論版)來提出他們對外掛的問題,或是希望新增的功能。

雖然這樣瞭解使用者和市場的方式很被動,並不是主動的做訪談persona或是問卷,不過這種願者上鉤式的回饋系統還是常常讓我驚豔。

如果沒有像這樣認真瞭解使用者需求的話,我就不會知道我的repo上最多的feature request其實是:

「請問大大,你的script可不可以新增一個跳過劇情的功能?我想要自動刷關把第一部全七章的劇情全部刷完。我只想趕快破關,讓角色成長,我不想看劇情。劇情太長了….」

鬼才知道啊?

我還以為FGO這遊戲拿掉劇情就一無是處了,沒想到真有人會覺得Fate Grand Order這遊戲是可以「玩」的…..

如果沒有像這樣快速推出MVP的話,我就不會有慢慢完善product的空間,也很可能憑空想像出一些不存在的需求,拖慢time to market。

startup mindset惠我良多。


A rather harmless attempt

A meaningless & inaccurate picture of binary analysis!

Headstart

It’s time to start the study in another new field, I think.

Learn to use IDA Pro seems like a good start.

By skimming The IDA Pro Book: The Unofficial Guide to the World’s Most Popular Disassembler (thank you, humble bundle), I decided to start from binary analysis. This book is also a suggested read by Hex-Rays.

Jerry Ho

A cryptographer, rigorous defender of civil liberties on blockchain. Trilingual in Mandarin, Japanese and English, I firmly believe in self-sovereign identity.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store