AntiRush

I've found that most scripts can/should belong to a specific project.

We've started adopting the `s/` method described here by Chad Austin: https://chadaustin.me/2017/01/s/.

It means you always know where to look and it's easy to see what scripts exist.

Yeah, it's pretty common on these platforms since it's a way to run code on an otherwise locked down device.

A lot of console (and iphone) exploits tend to share similar webkit exploit code. This ps4 exploit uses a ROP strategy from an earlier iOS exploit.

This is a pretty good overview (though from 2016) of the techniques used in the browser based exploits:

http://phrack.org/papers/attacking_javascript_engines.html

It's a double free in bpf.

Here's some slides from the author (from last week) with a more in depth explanation:

http://crack.bargains/02r0.pdf

There's a pretty full functioning project from several years ago (seems actively maintained) that has similar goals here:

https://github.com/creationix/js-git

I think it was initially crowdfunded.

I always thought ZeroVM was a cool idea in this space. The NaCL runtime makes a lot of sense as a base for servers that can take advantage of existing libraries.

http://www.zerovm.org

I'm not sure if this gets revealed if you play long enough (I obviously did not).

But it is curious that there's some sort of battle simulation running (and being rendered to an invisible canvas).

  (function reveal() { document.getElementById('battleCanvasDiv').style = ''; requestAnimationFrame(reveal);})()

There are at least a couple of other examples of similar projects:

NES -> native executables: http://andrewkelley.me/post/jamulator.html

x86/Windows starcraft -> arm/Linux for openpandora: https://pyra-handheld.com/boards/threads/starcraft.73844/

(Tools used for this: https://github.com/notaz/ia32rtools)

For a lot of consoles, particularly older ones, this tends to yield worse performance than a JIT. Between different memory layouts, weird threaded code, jump tables, (and especially) self modifying code, a JIT can do a much better job building efficient code since it has all of the runtime information.

For newer consoles which more closely resemble PC hardware, things are definitely better; the current generation will basically look like the Starcraft port; an API compatibility layer.

Blackstorm | Engineer | SALARY: $140k - $220k | San Francisco Bay area (SF) | Tokyo, Japan | VISA REMOTE

Blackstorm is building the world's most advanced javascript game engine, among other cool products like an IDE (js.io) We are hiring senior engineers who can tackle architecture and APIs for our game engine on a small team of 3-4 folks. Blackstorm has raised more then $30M, and we have more than a million users per engineer at the company.

For flavor: our last project was to use redux as a server state timeline for 10M+ active players; before that we used code mods to port it from our propriety module and class system to es6. There are numerous projects coming up, such as first class typescript support to facilitate better tooling and API documentation, a facial tracking/AR engine, and a react-powered webgl-based UI system.

We have projects for hosted real-time multiplayer gaming, social gaming, cross-compilation to native platforms, and many other core infrastructure tools that we would welcome your support on defining and creating.

Our technologies engine have already been in front of tens of millions of users, and we're adding millions of new users monthly. This is a high leverage position, and very senior. We welcome remote for certain folks, because we're looking to build the best small engineering team in the world.

We are also actively looking for folks across range of leadership roles in product, engineering, and operations.

Please email keela@blackstormlabs.com

Subject: Blackstorm Engineering: YOUR NAME HERE

Please include a personal note about your background and interests so we can prioritize your application!

http://http.rip is another site with this purpose. Pretty easy to remember too.

Blackstorm | $140k - $200k | San Francisco Bay area (SF, Mountain View) | Tokyo, Japan | REMOTE OK | VISA OK

Blackstorm is building the world's most advanced javascript game engine, among other cool products like js.io. We are hiring senior engineers who can tackle architecture and APIs for our game engine on a small team of 3-4 folks.

We are currently in the process of writing code mods to port it from our propriety module and class system to es6, and will follow with first class typescript support to facilitate better tooling and API documentation.

We have projects for hosted real-time multiplayer gaming, social gaming, cross-compilation to native platforms, and many other core infrastructure tools that we would welcome your support on defining and creating.

Our technologies engine have already been in front of tens of millions of users, and we're on track to hit hundreds of millions this year. This is a high leverage position, and very senior. We welcome remote for certain folks, because we're looking to build the best small engineering team in the world.

Please email keela@blackstormlabs.com Subject: Blackstorm Core Engineer

Please include a personal note about your background and interests so we can prioritize your application!

http://http.rip will always be http only; it's the domain I use for this purpose.

There are multiple cases in the United States regarding game hacks.

Some of the more famous involve Blizzard, with the biggest example being a suit against the creators of WowGlider, a bot for World of Warcraft (https://en.wikipedia.org/wiki/MDY_Industries,_LLC_v._Blizzar...)

tcg (the qemu code generator) does have an interpreter - you could probably run qemu on iOS with that - though it would obviously be a lot slower than the jit.

http://opengameart.org/ has music and sound effect sections, too. They are under a variety of Creative Commons licenses, for the most part.

I think "secret" is a misnomer here.

The process results in a client ID and, in some cases, a client secret, which you embed in the source code of your application. (In this context, the client secret is obviously not treated as a secret.)

https://developers.google.com/identity/protocols/OAuth2 (under "Installed Applications")

They actually just started it a few months ago:

http://www.riotgames.com/articles/20150817/1697/our-engineer...

I'm trying to figure out if the version of WeChat I have installed is compromised. I haven't been able to find any specifics about versions of any of the apps. Does anyone have more info?

The compiler api has gotten a lot better: https://github.com/Microsoft/TypeScript/wiki/Using-the-Compi...

If you just want string->string compilation, there's typestring, which wraps the api: https://www.npmjs.com/package/typestring

There's always the option to run OpenBSD :P

http://www.jagshouse.com/openbsd68k.html

There are annual tours of the unfinished tunnels. You used to be able to get in, but 5 or 10 years ago a more substantial barricade was put in place.

Also of interest, the current (and long beleaguered) Cincinnati public transit project, the streetcars: https://en.wikipedia.org/wiki/Cincinnati_Streetcar

Hopefully we'll actually get them this time.

I've always been interested in this sort of thing - with webassembly standardizing, they may become realistically usable soon, too.

Another implementation from a few years ago:

https://github.com/nurv/BicaVM

Cool! Hashtables make for a fun project, to be sure.

Also worth checking out is uthash[1], which has been around for ever. It's a single header file include, full featured, and pretty bulletproof.

[1]https://troydhanson.github.io/uthash/

Doesn't render at all in Firefox 37:

"TypeError: undefined has no properties"

There's a library[1] that wraps the jni, allowing just that.

I haven't tried it, but it looks featureful enough to be useful.

[1] https://github.com/Monnoroch/RustJni

uthash[1] is another good solution. It's pretty bulletproof and has lots of options. Also implemented with macros, if that's a plus :-).

[1]: http://troydhanson.github.io/uthash/

The referencesource project seems to be MIT licensed:

https://github.com/Microsoft/referencesource/blob/master/LIC...

It seems like the current patch might not be a complete fix:

http://seclists.org/oss-sec/2014/q3/671

Another project targeting Java on iOS is XMLVM[1].

It has several frontends, including JVM bytecode, and several backends, including Objective-C (and vanilla C, these days).

1. http://xmlvm.org/overview/

Virtualbox is open source - GPLv2

https://www.virtualbox.org/browser/vbox/trunk

Javascript has the normal (C syntax) set of bitwise operations that operate on 32 bit numbers.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...