build/blog/python-for-re-1/index.html (view raw)
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 |
<!DOCTYPE html>
<html lang=en>
<link rel="stylesheet" href="/static/style.css" type="text/css">
<link rel="stylesheet" href="/static/syntax.css" type="text/css">
<link rel="shortcut icon" type="images/x-icon" href="/static/favicon.ico">
<meta name="description" content="Building your own disassembly tooling for — that’s right — fun and profit">
<meta name="viewport" content="initial-scale=1">
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
<meta content="#021012" name="theme-color">
<meta name="HandheldFriendly" content="true">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:site" content="@icyphox">
<meta name="twitter:title" content="Python for Reverse Engineering #1: ELF Binaries">
<meta name="twitter:description" content="Building your own disassembly tooling for — that’s right — fun and profit">
<meta name="twitter:image" content="/static/icyphox.png">
<meta property="og:title" content="Python for Reverse Engineering #1: ELF Binaries">
<meta property="og:type" content="website">
<meta property="og:description" content="Building your own disassembly tooling for — that’s right — fun and profit">
<meta property="og:url" content="https://icyphox.sh">
<meta property="og:image" content="/static/icyphox.png">
<html>
<title>
Python for Reverse Engineering #1: ELF Binaries
</title>
<div class="container-text">
<header class="header">
<a href="/">home</a>
<a href="/blog">blog</a>
<a href="/reading">reading</a>
<a href="https://twitter.com/icyphox">twitter</a>
<a href="/about">about</a>
</header>
<body>
<div class="content">
<div align="left">
<code>2019-02-08</code>
<h1>Python for Reverse Engineering #1: ELF Binaries</h1>
<h2>Building your own disassembly tooling for — that’s right — fun and profit</h2>
<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>
<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>
<h3 id="setup">Setup</h3>
<p>As the title suggests, you’re going to need a Python 3 interpreter before
anything else. Once you’ve confirmed beyond reasonable doubt that you do,
in fact, have a Python 3 interpreter installed on your system, run</p>
<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
</code></pre></div>
<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>
<p>With that out of the way, let’s start with an example of a basic reversing
challenge.</p>
<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>
<span class="cp">#include</span> <span class="cpf"><stdio.h></span><span class="cp"></span>
<span class="cp">#include</span> <span class="cpf"><stdlib.h></span><span class="cp"></span>
<span class="cp">#include</span> <span class="cpf"><string.h></span><span class="cp"></span>
<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
<span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
<span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'a'</span><span class="p">;</span>
<span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o"><=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
<span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
<span class="p">}</span>
<span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'\0'</span><span class="p">;</span>
<span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
<span class="n">printf</span><span class="p">(</span><span class="s">"password: "</span><span class="p">);</span>
<span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span> <span class="c1">// 'abcdefghi'</span>
<span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
<span class="n">printf</span><span class="p">(</span><span class="s">"haha yes!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
<span class="p">}</span>
<span class="k">else</span> <span class="p">{</span>
<span class="n">printf</span><span class="p">(</span><span class="s">"nah dude</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
<span class="p">}</span>
<span class="p">}</span>
</code></pre></div>
<p>Compile it with GCC/Clang:</p>
<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
</code></pre></div>
<h3 id="scripting">Scripting</h3>
<p>For starters, let’s look at the different sections present in the binary.</p>
<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>
<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
<span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
<span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
<span class="k">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
</code></pre></div>
<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>
<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
<span class="go">0x238 .interp</span>
<span class="go">0x254 .note.ABI-tag</span>
<span class="go">0x274 .note.gnu.build-id</span>
<span class="go">0x298 .gnu.hash</span>
<span class="go">0x2c0 .dynsym</span>
<span class="go">0x3e0 .dynstr</span>
<span class="go">0x484 .gnu.version</span>
<span class="go">0x4a0 .gnu.version_r</span>
<span class="go">0x4c0 .rela.dyn</span>
<span class="go">0x598 .rela.plt</span>
<span class="go">0x610 .init</span>
<span class="go">0x630 .plt</span>
<span class="go">0x690 .plt.got</span>
<span class="go">0x6a0 .text</span>
<span class="go">0x8f4 .fini</span>
<span class="go">0x900 .rodata</span>
<span class="go">0x924 .eh_frame_hdr</span>
<span class="go">0x960 .eh_frame</span>
<span class="go">0x200d98 .init_array</span>
<span class="go">0x200da0 .fini_array</span>
<span class="go">0x200da8 .dynamic</span>
<span class="go">0x200f98 .got</span>
<span class="go">0x201000 .data</span>
<span class="go">0x201010 .bss</span>
<span class="go">0x0 .comment</span>
<span class="go">0x0 .symtab</span>
<span class="go">0x0 .strtab</span>
<span class="go">0x0 .shstrtab</span>
</code></pre></div>
<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>
<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>
<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>
<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>
<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./bin.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
<span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
<span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">'.text'</span><span class="p">)</span>
<span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
<span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]</span>
<span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'0x{i.address:x}:</span><span class="se">\t</span><span class="s1">{i.mnemonic}</span><span class="se">\t</span><span class="s1">{i.op_str}'</span><span class="p">)</span>
</code></pre></div>
<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>
<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less </span>
<span class="go">0x6a0: xor ebp, ebp</span>
<span class="go">0x6a2: mov r9, rdx</span>
<span class="go">0x6a5: pop rsi</span>
<span class="go">0x6a6: mov rdx, rsp</span>
<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
<span class="go">0x6ad: push rax</span>
<span class="go">0x6ae: push rsp</span>
<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
<span class="go">0x6ca: hlt</span>
<span class="go">... snip ...</span>
</code></pre></div>
<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>
<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>
<blockquote>
<p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
</blockquote>
<p>To try and find these relocation entries, we write a third script.</p>
<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>
<span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>
<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
<span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
<span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
<span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
<span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'{section.name}:'</span><span class="p">)</span>
<span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_link'</span><span class="p">])</span>
<span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
<span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_info_sym'</span><span class="p">])</span>
<span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_offset'</span><span class="p">])</span>
<span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'{symbol.name} {addr}'</span><span class="p">)</span>
</code></pre></div>
<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>
<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
<span class="go">.rela.dyn:</span>
<span class="go"> 0x200d98</span>
<span class="go"> 0x200da0</span>
<span class="go"> 0x201008</span>
<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
<span class="go">**__libc_start_main 0x200fe0**</span>
<span class="go">__gmon_start__ 0x200fe8</span>
<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
<span class="go">__cxa_finalize 0x200ff8</span>
<span class="go">stdin 0x201010</span>
<span class="go">.rela.plt:</span>
<span class="go">puts 0x200fb0</span>
<span class="go">printf 0x200fb8</span>
<span class="go">fgets 0x200fc0</span>
<span class="go">strcmp 0x200fc8</span>
<span class="go">malloc 0x200fd0</span>
</code></pre></div>
<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib—libc-start-main-.html">linuxbase.org</a></p>
<blockquote>
<p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
</blockquote>
<p>And its definition is like so</p>
<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span>
<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span>
<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
</code></pre></div>
<p>Looking back at our disassembly</p>
<pre><code>0x6a0: xor ebp, ebp
0x6a2: mov r9, rdx
0x6a5: pop rsi
0x6a6: mov rdx, rsp
0x6a9: and rsp, 0xfffffffffffffff0
0x6ad: push rax
0x6ae: push rsp
0x6af: lea r8, [rip + 0x23a]
0x6b6: lea rcx, [rip + 0x1c3]
**0x6bd: lea rdi, [rip + 0xe6]**
0x6c4: call qword ptr [rip + 0x200916]
0x6ca: hlt
... snip ...
</code></pre>
<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>
<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>
<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>
<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>
<pre><code>printf 0x650
fgets 0x660
strcmp 0x670
malloc 0x680
</code></pre>
<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>
<pre><code>0x7b2: mov edi, 0xa ; 10
0x7b7: call 0x680 ; malloc
</code></pre>
<p>The loop to populate the <code>*pw</code> string</p>
<pre><code>0x7d0: mov eax, dword ptr [rbp - 0x14]
0x7d3: cdqe
0x7d5: lea rdx, [rax - 1]
0x7d9: mov rax, qword ptr [rbp - 0x10]
0x7dd: add rax, rdx
0x7e0: movzx eax, byte ptr [rax]
0x7e3: lea ecx, [rax + 1]
0x7e6: mov eax, dword ptr [rbp - 0x14]
0x7e9: movsxd rdx, eax
0x7ec: mov rax, qword ptr [rbp - 0x10]
0x7f0: add rax, rdx
0x7f3: mov edx, ecx
0x7f5: mov byte ptr [rax], dl
0x7f7: add dword ptr [rbp - 0x14], 1
0x7fb: cmp dword ptr [rbp - 0x14], 8
0x7ff: jle 0x7d0
</code></pre>
<p>And this looks like our <code>strcmp()</code></p>
<pre><code>0x843: mov rdx, qword ptr [rbp - 0x10] ; *in
0x847: mov rax, qword ptr [rbp - 8] ; *pw
0x84b: mov rsi, rdx
0x84e: mov rdi, rax
0x851: call 0x670 ; strcmp
0x856: test eax, eax ; is = 0?
0x858: jne 0x868 ; no? jump to 0x868
0x85a: lea rdi, [rip + 0xae] ; "haha yes!"
0x861: call 0x640 ; puts
0x866: jmp 0x874
0x868: lea rdi, [rip + 0xaa] ; "nah dude"
0x86f: call 0x640 ; puts
</code></pre>
<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>
<p><strong>Update</strong>: It’s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>
<h3 id="conclusion">Conclusion</h3>
<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>
<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>
<p>Ciao for now, and I’ll see ya in #2 of this series — PE binaries. Whenever that is.</p>
</div>
<hr />
<p class="muted">Questions or comments? Open an issue at <a href="https://github.com/icyphox/site">this repo</a>, or send a plain-text email to <a href="mailto:x@icyphox.sh">x@icyphox.sh</a>.</p>
<footer>
<a href="https://creativecommons.org/licenses/by-nc-sa/4.0/">
<img class="footimgs" src="/static/cc.svg">
</a>
<a href="https://webring.xxiivv.com/#random" target="_blank">
<img class="footimgs" alt="xxiivv webring" src="/static/webring.svg">
</a>
</footer>
</body>
</div>
</html>
|