Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote code execution via MIDI messages

psi3.ru

Post reply on HN
Print view View original

11–20 of 86 posts

Re: Remote code execution via MIDI messages

#11

Post by codetrotter »

cluckindan wrote: post #9

Any mirrors not in Russia? My ISP blocks access.

Snapshot: https://archive.is/FVUHe

There's an embedded YouTube video in the article as well, that appears twice. First at the top and then again further down.

https://www.youtube.com/watch?v=u6sukVMijBg

There are also several videos in the article that are hosted on the same site as the original article (so on the .ru site). Those are not included in the snapshot unfortunatelly. You'll see placeholders and the associated text that describes them but you can't view those via the snapshot.

It also contains a link to a GitHub repo at the end.

https://github.com/portasynthinca3/swl01u

Re: Remote code execution via MIDI messages

#12

Post by perching_aix »

> Now, we have to get a little philosophical here. In my eyes, RE is like a game of minesweeper. You start with an empty field not knowing the state of any of the cells, i.e. not knowing whether each individual cell contains a landmine or not. When you discover the state of a cell, you have the context to deduce the state of its neighbor cells. In minesweeper, you don’t have a particular direction in which you progress. You never say “In this game of minesweeper, I want to go up no matter what”, you just let the numbers nudge you in the direction that is the easiest to go in at the moment. I assert that this is also true for RE. Once you find out what a function or a variable does, you suddenly understand a little more about functions and variables that depend on the ones whose meaning you’ve just inferred. It may be beneficial not to set any particular goal with an RE project, and instead letting the complex network of intertwined functions and variables guide you towards understanding the system as a whole.

That's such a nice way to think about it. Maybe I should try giving RE a go again.

Re: Remote code execution via MIDI messages

#13

Post by moosedev »

Great project, write-up, and sense of humor in the videos!

> Using that part number I wasn’t able to find any information about the chip online apart from an article that claimed it was based around a “SuperH” CPU core – an ISA that I’ve encountered for the first time ever in that article.

Also found in Sega 32x, Sega Saturn, and Sega Dreamcast! And some early Pocket PCs (turn-of-the-century handhelds running Windows CE) like the HP Jornada series, although most Pocket PCs were ARM-based.

Re: Remote code execution via MIDI messages

#15

Post by Waterluvian »

perching_aix wrote: post #12

> Now, we have to get a little philosophical here. In my eyes, RE is like a game of minesweeper. You start with an empty field not knowing the state of any of the cells, i.e. not knowing whether each individual cell contains a landmine or not. When you discover the state of a cell, you have the context to deduce the state of its neighbor cells. In minesweeper, you don’t have a particular direction in which you progre…

I don’t know RE but I love this sentiment. I think it’s quite generalizable too. So many things are like that. Just start somewhere. It really doesn’t matter where. And what you find will guide your next steps. Eventually you’ll have enough context to see a much bigger picture well before it’s fully revealed.

Re: Remote code execution via MIDI messages

#17

Post by perching_aix »

cluckindan wrote: post #9

Any mirrors not in Russia? My ISP blocks access.

Do you not have DNS-over-HTTPS/TLS configured, or are you on some weird browser that doesn't support ECH [0]? I wonder how they blocked it if those are in place (unless you use the ISP's DNS), since the site itself is served by Cloudflare from wherever close to you, not from Russia (and so the actual SNI isn't leaked via the ClientHelloOuter field either).

[0] you can test these by using https://www.cloudflare.com/ssl/encrypted-sni/

Post reply on HN