685f92e4e10edc358176b98747a44e32be5d053f
explain/vondehi.md
... | ... | @@ -1 +1,14 @@ |
1 | -free slots no registration no download http://onlinecasinogameslots.com/# real money casino <a href="http://onlinecasinogameslots.com/# ">casino slots </a> free slot games no download no registration |
|
... | ... | \ No newline at end of file |
0 | + |
|
1 | +## vondehi |
|
2 | + |
|
3 | +Vondehi is an in-memory unpacker for data compressed with `gzip` or `xz` (or |
|
4 | +`xz` in LZMA1-mode). It basically performs these steps: |
|
5 | + |
|
6 | +1. Set up a memfd using the `memfd_create` syscall. This file descriptor works |
|
7 | + like a regular file, except the backing storage is RAM. |
|
8 | +2. Fork, pipe the payload data to `zcat` or `xzcat`, which outputs everything |
|
9 | + to the memfd from step 1. |
|
10 | +3. Run `execveat` on the memfd. |
|
11 | + |
|
12 | +Of course, the code itself is hand-optimized x86 assembly, and is very crazy. |
|
13 | + |