<p><span class="h-card" translate="no"><a href="https://mastodon.social/@whitequark" class="u-url mention">@<span>whitequark</span></a></span> yeah ETW APIs are... nontrivial</p><p>I did once find an information disclosure issue specific to ETW. it took me a whole three days of reading and tinkering to figure out the architecture and tooling sufficiently to exploit it. the docs aren&#39;t great.</p>

<p>OH: what if you wrote an ELF dumper that used PE field names?</p>

<p>out of all byzantine Windows NT APIs, ETW takes the cherry on the layered two meter tall cake for being by far the most byzantine of them, which is ironic because it&#39;s one of the few things which makes figuring out why other byzantine APIs break easier.</p><p>in theory, i&#39;ve never managed it</p>

<p><span class="h-card" translate="no"><a href="https://mastodon.social/@neuronakaya" class="u-url mention">@<span>neuronakaya</span></a></span> Happy Birthday! They better reply!</p>

<p>OH: me sobbing and pleading the NSA to fix their implants so i could go to bed. please. my computer keeps rebooting</p>

<p><span class="h-card" translate="no"><a href="https://social.treehouse.systems/@dysfun" class="u-url mention">@<span>dysfun</span></a></span> this would concern me if NSA made good software</p>

<p>the &quot;disassemblers and decompilers&quot; section doesn&#39;t include ghidra because i don&#39;t swing that way, and r2 because it is unfit for purpose</p>

<p>realized that i have way too many github stars for reverse engineering tools that i never remember to use whenever i&#39;m actually reverse engineering something (and so i end up just writing some cursed python script), so i went and classified them all <a href="https://gist.github.com/whitequark/2bf913cdb65c1c313bf2d747f79223c5" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="ellipsis">gist.github.com/whitequark/2bf</span><span class="invisible">913cdb65c1c313bf2d747f79223c5</span></a></p>

<p>ah, yes, the little-known &quot;human remains&quot; clause of CC0</p><p><a href="https://www.smbc-comics.com/comic/last-rights" target="_blank" rel="nofollow noopener noreferrer" translate="no"><span class="invisible">https://www.</span><span class="ellipsis">smbc-comics.com/comic/last-rig</span><span class="invisible">hts</span></a></p>