Email or username:

Password:

Forgot your password?
q3k's posts Post Back to profile
Top-level
Astrid

@q3k What file is this extracted from? the liblzma_la-crc64-fast.o from the original mail?

30 March at 14:19 | Wall-to-wall | Open on hachyderm.io
6 comments
q3k :blobcatcoffee:

@astrid I took this from a 5.6.1 fedora build of liblzma. But it should also be extractable from that .o.

30 March at 14:38 | Open on social.hackerspace.pl
Astrid

@q3k It looks like there are a few more symbols in the .o file from there - I think I found the function you call bd_elf_lookup_hash (at 0x1860)? it's called crc_init in there, which isn't a name that exists in the xz source itself

30 March at 16:40 | Open on hachyderm.io
q3k :blobcatcoffee:

@astrid The symbol names from the .o are just fanfiction, they're just made to look like legit liblzma symbols.

But yes, the function at 0x1860 in the 5.6.0 .o seems to be what I call bd_elf_lookup_hash. 0x0a8a0 is what I call bd_hash (even though I now know it's not a hash).

30 March at 16:44 | Open on social.hackerspace.pl
Astrid

@q3k makes sense! neat trick (unsure if common) to hide like that. any clue where the data itself is stored?

30 March at 16:46 | Open on hachyderm.io
q3k :blobcatcoffee:
Riatre

@astrid The trie? In liblzma_la-crc64-fast.o it's at 0xC340 (has_child masks) and 0xAEE0 (node info).

Here is the parser, but so far I've only seen one version of this: gist.github.com/Riatre/527a34d

(Offsets hardcoded here is for snapshot.debian.org/archive/de)

30 March at 17:13 | Open on o3o.ca
Go Up