ps -eo pid,ppid,user,command

Use ps without cpu time to perform a diff between ps runs.  This allows you to find processes started or stopped between runs.

To run dd or ddrescue on an encrypted APFS drive you should remember that APFS volumes first have to be unlocked and then decrypted.  Unlocking them automatically mounts them.  Once mounted then you need to decrypt them.

Boot the mac from an external drive (use an SSD for speed).  I used a SABRENT USB3 enclosure.

Once booted up with the external MacOS instance, identify the internal drive which needs to be decrypted with the following command:

diskutil apfs list

Container disk1 45DA114F-7418-41B9-ACF0-F965CC48E8B4

|   ====================================================

|   APFS Container Reference:     disk1

|   Size (Capacity Ceiling):      500068036608 B (500.1 GB)

|   Capacity In Use By Volumes:   249342025728 B (249.3 GB) (49.9% used)

|   Capacity Not Allocated:       250726010880 B (250.7 GB) (50.1% free)

|   |

|   +-< Physical Store disk0s2 76998992-D9B0-4CAF-AF06-8E44EBF91F5B

|   |   -----------------------------------------------------------

|   |   APFS Physical Store Disk:   disk0s2

|   |   Size:                       500068036608 B (500.1 GB)

|   |

|   +-> Volume disk1s1 035E01AA-7321-3A41-9479-22DF47E45B7E

|   |   ---------------------------------------------------

|   |   APFS Volume Disk (Role):   disk1s1 (No specific role)

|   |   Name:                      APPLE SSD SM512E Media (Case-insensitive)

|   |   Mount Point:               /Volumes/APPLE SSD SM512E Media

|   |   Capacity Consumed:         247547052032 B (247.5 GB)

|   |   FileVault:                 Yes (locked)

sh-3.2# diskutil apfs unlockVolume /dev/disk1s1 

Passphrase:

Unlocking any cryptographic user on APFS Volume disk1s1

Unlocked and mounted APFS Volume

Find out valid users

sh-3.2# diskutil apfs listkeys disk1s1

Cryptographic users for disk1s1 (4 found)

|

+-- EC1C2AD9-B618-4ED6-BD8D-50F361C27507

|   Type: iCloud Recovery User

|

+-- 64C0C6EB-0000-11AA-AA11-00306543ECAC

|   Type: iCloud Recovery External Key

|

+-- 6AAC510E-AE1F-417A-B739-8687BD5D2023

|   Type: Local Open Directory User

|

+-- 223300DE-012D-4D48-A458-102F94617E62

    Type: Local Open Directory User

Pick a user and use the UUID as the argument for -user:

sh-3.2# diskutil apfs decryptVolume /dev/disk1s1 -user 6AAC510E-AE1F-417A-B739-8687BD5D2023 

Passphrase for existing user 6AAC510E-AE1F-417A-B739-8687BD5D2023: ****************

Starting background decryption of disk1s1 using crypto user 6AAC510E-AE1F-417A-B739-8687BD5D2023 as authorization

Background decryption is ongoing; see "diskutil apfs list" to see progress

sh-3.2# diskutil apfs list |grep Unlocked

|   |   Decryption Progress:       44.0% (Unlocked)

Notes:

ddrescue seems to be faster than dd

If you are examining a SDCARD, use a USB3 adapter and not the native Flashcard reader.  The native reader seems to be USB2.0

• In OS X 10.15 "Catalina" tokend-s are disabled and need to be enabled explicitly:

sudo defaults write /Library/Preferences/com.apple.security.smartcard Legacy -bool true

Add Borders to Windows on Ubuntu



1. Confirm your ubuntu version and codename with lsb_release

user@ubuntu:~$ lsb_release -a
No LSB modules are available.
Distributor ID:    Ubuntu
Description:    Ubuntu 16.04.6 LTS
Release:    16.04
Codename:    xenial

 

2. Make edits to unity.css 

sudo gedit /usr/share/themes/Ambiance/gtk-3.0/apps/unity.css

 -UnityDecoration-extents: 28px 0 0 0;

 -UnityDecoration-extents: 28px 2px 2px 2px; 

 

a8df1e58626','the string I'm looking for');">

pcregrep  -o \'[\\w\\d\\s]+\'\\\)\; source-strings.txt > programs.txt

How to burn a Blu-Ray disk of Win10

growisofs -dvd-compat -speed=8 -Z /dev/sr0=/home/user/Win10_1809Oct_English_x64.iso

user@ubuntu-desktop:/media/user/CCCOMA_X64FRE_EN-US_DV9$ ls -altr
total 1928
-r-xr-xr-x   1 user  user      128 Oct 29 19:32 autorun.inf
-r-xr-xr-x   1 user  user    82440 Oct 29 19:32 setup.exe
-r-xr-xr-x   1 user  user  1452856 Oct 29 19:32 bootmgr.efi
-r-xr-xr-x   1 user  user   408074 Oct 29 19:32 bootmgr
dr-xr-xr-x   4 user  user      148 Oct 29 19:47 efi
dr-xr-xr-x   5 user  user      564 Oct 29 19:47 boot
dr-xr-xr-x   3 user  user       96 Oct 29 19:48 support
dr-xr-xr-x   6 user  user      492 Oct 29 19:48 .
dr-xr-xr-x  12 user  user    12264 Oct 29 19:48 sources
drwxr-x---+  3 root root    4096 Mar 27 19:37 ..
user@ubuntu-desktop:/media/user/CCCOMA_X64FRE_EN-US_DV9$

Where are my crash dumps?
Windows 10 puts crash dumps in different locations as compared to Windows XP

Kernel Dumps are here:
%SystemRoot%\LiveKernelReports

Userland Dumps are here:
%ProgramData%\Microsoft\Windows\WER\ReportArchive

One directory up in WER you will see:
Report Archive
Report Queue
Temp

One could assume that Windows Error Reporting (WER) will put initial dump files and other telemetry in the Queue and once they are transmitted to the Microsoft team moved to Archive.  Perhaps you don't want your crashes reported.  How does one turn off WER but still maintain the ability to see what has crashed?

Centos mdadm -- how to replace an already failed drive.   There is a TON of information on the web about mdadm.  My problem was that the config file didn't exist.  After I created that everything else jived with what I was reading. 

/dev/sdb failed

1. find out UUID and details of the array

Use --examine to look at an existing disk

mdadm --examine -v /dev/sde

output:

 Magic : a92b4efc

        Version : 1.2

    Feature Map : 0x0

     Array UUID : a94ed4cc:acd0f975:28f03379:fe085d38

There is the Array UUID

I didn't have a mdadm.conf file, so I had to create one (it's apparently optional and I didn't create one when I first build the raid).

mkdir /etc/mdadm/mdadm.conf (this is where centos keeps it I believe)
Add these lines and make sure all others are commented out

DEVICE /dev/sdb /dev/sdc /dev/sdd /dev/sde

ARRAY /dev/md0 UUID=a94ed4cc:acd0f975:28f03379:fe085d38

My array has 4 drives as you can see

Start the array ( you might have to stop it first)

mdadm --assemble /dev/md0 --scan --force

Re-start the array (force it) and add the drive that you've replaced

mdadm: Marking array /dev/md0 as 'clean'

mdadm: /dev/md0 has been started with 3 drives (out of 4).

[root@localhost ~]# mdadm --manage /dev/md0 --add /dev/sdb

mdadm: added /dev/sdb

Bingo!

mdadm --detail /dev/md0

/dev/md0:

        Version : 1.2

  Creation Time : Mon Feb 29 01:02:46 2016

     Raid Level : raid5

     Array Size : 2929893888 (2794.16 GiB 3000.21 GB)

  Used Dev Size : 976631296 (931.39 GiB 1000.07 GB)

   Raid Devices : 4

  Total Devices : 4

    Persistence : Superblock is persistent

    Update Time : Tue Mar 13 07:25:23 2018

          State : clean, degraded, recovering 

 Active Devices : 3

Working Devices : 4

 Failed Devices : 0

  Spare Devices : 1

         Layout : left-symmetric

     Chunk Size : 512K

 Rebuild Status : 0% complete

           Name : user-S5000PSL-2:my-raid

           UUID : a94ed4cc:acd0f975:28f03379:fe085d38

         Events : 3569

    Number   Major   Minor   RaidDevice State

       5       8       16        0      spare rebuilding   /dev/sdb

       1       8       32        1      active sync   /dev/sdc

       2       8       48        2      active sync   /dev/sdd

       4       8       64        3      active sync   /dev/sde

Where are my Photos!

Where are original photos kept in Mac OSX Photo Library:

They are kept under the Pictures directory in your user files.  From there navigate to a location  /Users/$USER/Pictures/Photos Library.photoslibrary/Masters.

You'll see directories named with the import date e.g.

/Users/$USER/Pictures/Photos Library.photoslibrary/Masters/2018/02/18/20180218-011927

Camera Notes

Swann makes inexpensive cameras. Here are the details for those interested in them:


UPNP SWNHD-825CAM http://www.swann.com/au/swnhd-835cam admin/ DHCP by default SwannCom_91:ce:d3 VLC stream URL: rtsp://admin:@172.16.0.12/Streaming/channels/1/ OPTIONS rtsp://172.16.0.12:554/Streaming/channels/1/
RTSP/1.0 CSeq: 2 User-Agent: LibVLC/2.2.2 (LIVE555 Streaming Media v2016.02.09)

RTSP/1.0 200 OK

CSeq: 2

Public: OPTIONS, DESCRIBE, PLAY, PAUSE, SETUP, TEARDOWN, SET_PARAMETER, GET_PARAMETER

Date:  Thu, Sep 01 1776 15:57:57 GMT

DESCRIBE rtsp://172.16.0.12:554/Streaming/channels/1/ 

RTSP/1.0

CSeq: 3

User-Agent: LibVLC/2.2.2 (LIVE555 Streaming Media v2016.02.09)

Accept: application/sdp

RTSP/1.0 401 Unauthorized

CSeq: 3

WWW-Authenticate: Digest realm="", nonce="", stale="FALSE"

WWW-Authenticate: Basic realm=""

Date:  Thu, Sep 01 1776 15:57:57 GMT

PLAY rtsp://172.16.0.12:554/Streaming/channels/1/ 

RTSP/1.0

CSeq: 6

Authorization: Digest username="admin", 

User-Agent: LibVLC/2.2.2 (LIVE555 Streaming Media v2016.02.09)

Session: 

Range: npt=0.000-

RTSP/1.0 200 OK

CSeq: 6

Session:        

RTP-Info: url=rtsp://172.16.0.12:554/Streaming/channels/1/trackID=1;seq=45740;rtptime=1573072564

Steve Jobs has the last laugh...or maybe Bill does...I guess it's all based on perspective.

Steve Jobs has the last laugh...or maybe Bill does...I guess it's all based on perspective.

This is an adventure in converting a dd raw disk image to a vmdk image suitable for vmware on Mac OSX.  Amazingly annoying so I documented it to save you the trouble.  Of course these instructions are valid for as long as all the software used stays the same.  Good Luck!

install Apples Xcode developers tools from the App Store

install macports from here:

http://www.macports.org/

This is the version I used:

MacPorts-2.3.4-10.11-ElCapitan.pkg

Then confirm it wall worked:

sudo port version

Update it, not sure what this does but you need to do it (uses internet):

sudo port selfupdate

Now install the Xcode command line tools (assuming you already installed Xcode)

sudo xcode-select --install

Now install qemu:

sudo port install emu

--->  Computing dependencies for qemu blah blah blah....

Then all the sudden I get this:

So naturally I click OK and allow massive amounts of additional code to be installed blindly on my computer...all provably secure and safe!

I also installed this

jdk-8u71-macosx-x64.dmg

It will fetch a bunch of junk and finally get it all installed.  It probably installed a bunch of rootkits and implants along the way so my computer is probably totally owned now but hey computers are disposable now right?

BTW...as the first macport I installed this process took close to 45 minutes...most of it waiting for downloads of dozens of libraries.  To be specific these are the debs:

zip2

curl

curl-ca-bundle

expat

gdbm

gettext

glib2

gperf

help2man

libedit

libffi

libiconv

libpixman

libtool

ncurses

openssl

p5.22-locale-gettext

pcre

perl5

perl5.22

pkgconfig

python27

python_select

sqlite3

texinfo

xz

zlib

So now qemu is installed and I can now convert a raw dd disk image to a vmdk

qemu-img convert -O vodka original-disk.dd converted.vmd

/var/db/vmware/vmnet-dhcpd-vmnet1.leases

/var/db/vmware/vmnet-dhcpd-vmnet8.leases

These files contain current leases issued by the built in vmware DHCP server...helpful in finding the IP of a box you can't login to.

Notes from my OpenIndiana file server experiment with ZFS 

zpool create -f data-pool raidz c4t1d0 c4t2d0 c4t3d0 c4t4d0 usermod -G 

zfs set sharesmb=on 

cat /etc/dfs/sharetab 

smbadm join -w passwd 

smbadm list 

idmap remove -a 

So far so good with 4 1TB WD Blue disks (Although RHEL 6 smbclient has some serious issues with OpenIndiana SMB impl..hint hint) 

NAME USED AVAIL REFER MOUNTPOINT 

data-pool 11.0M 2.59T 10.4M /data-pool 

rpool 21.7G 892G 196K /rpool 

rpool/ROOT 5.15G 892G 144K legacy 

rpool/ROOT/openindiana 668K 892G 3.79G / 

rpool/ROOT/openindiana-1 5.14G 892G 3.73G / 

rpool/dump 8.00G 892G 8.00G - rpool/export 1.72M 892G 152K /export rpool/export/home 1.57M 892G 152K /export/home 

rpool/swap 8.50G 900G 136M -

Wonder how the 6 million dollar man would fare today.

Why do I still have to do this stuff when CentOS decides I need a kernel update?

#!/bin/sh
service vmware stop
rm /lib/modules/$(uname -r)/misc/vmmon.ko
vmware-modconfig --console --build-mod vmmon /usr/bin/gcc /lib/modules/$(uname -r)/build/include
depmod -a
service vmware start

Fix database errors in OpenPBX

 mysqlcheck -u root --check asteriskcdrdb
mysql -b -u root -D asteriskcdrdb -e "REPAIR TABLE cdr" -u root

service mysqld restart

Was watching 'Halt and Catch Fire' and caught a reference to the 80s hacking circle:

http://en.wikipedia.org/wiki/The_414s

Which lead to this:

http://www.amazon.com/Interface-Effect-Alexander-R-Galloway/dp/0745662536/ref=la_B001H9W646_1_1?s=books&ie=UTF8&qid=1405392604&sr=1-1

As a group this reminds me we are and always will be the most innovative society.

KVM, virsh and virtual machine manager r0ck!

Just bought a sweet little 2x4 xeon server with vtx and 16GB of ECC RAM from ebay. First off you get what you pay for. It took me 5 hours of messing around to realize the bios switch setting for vtx was backwards. E.g. ON==OFF. Uggh The box in question is made by Rackable Systems and its got an Intel® Server Board S5000PSL. Its really a great machine but the bios is a little like...messed up. Anyway....if you are patient it all works great. My next task was to install Ubuntu and get some virtualization software up. I first started with my own copy of vmware 8, but turns out vmware8 workstation isn't supported well with ubuntu 14. So then I tried VirtualBox..which worked great. What I really wanted though was to run a couple of vms headless and after doing some research decided that KVM with the virsh tools was really the way to go for a quick win. I had a pre-built vmware image of free-pbx which I had used a couple years ago to run a VOIP phone system in the house. I decided that would be the first image I got running.

 1. Convert the image to a qemu compatible one qemu-img convert -p "CentOS 64-bit.vmdk" pbx.qcow2

2. Move the image to /var/lib/libvirt/images 

3. Install an entry for the new machine using the disk image you made sudo virt-install --import -n fee-pbx1 -r 2048 --disk path=/var/lib/libvirt/images/pbx.qcow2,bus=virtio --network network=default,model=virtio --graphics vnc,listen=0.0.0.0 --noautoconsole -v

 4. Make sure it autostarts when the host reboots virsh -c qemu:///system autostart fee-pbx1

After this I found a cool tool called Virtual Machine Manager which lets you ssh into the host machine and manager all your runnning images. This is on par with Vmware ESXi but it's free and really easy to install. You should ideally install virt-manager on your regular development workstation and remote into the vm host. I run centos on my dev box and virt-manager can be installed with yum.  Screenshots attached to highlight how sweet these tools are for a light user who wants persistent vms.

Undocumented NtQuerySystemInformation Structures (Updated for Windows 8)

Regarding this guys disclosure about more undocumented NtQuerySystemInformation options.


http://www.exploit-monday.com/2013/06/undocumented-ntquerysysteminformation.html


....Isn't it about time Microsoft realized that the emperor wears no clothes?  I mean seriously.....high school students are reversing win8 now.....there is nothing that is undocumented any-more.

FFS....give it up....document everything on MSDN and move on guys.   You waste everyone's time  and make stupid AV companies Rich.  Let worry about embedded systems and all the chinese crap that never gets updated or is back-doored with vulns (uhhhhhh  Huawei anyone....)