5
points
colanderman
Joined 16,187 karma
chris@pacejo.net
- colandermanNo, but all MeshCore radios operating in Companion Radio mode do, which is what my post is about.
- Agreed – and MeshCore follows a similar "security on the radio" design.
With the "cell phone + companion radio" setup which is currently very popular, it would seem the correct solution is to perform encryption on the phone – using the Signal protocol – and use the companion radio only to send/receive these blobs.
This has the added benefit that you can pair with _any_ arbitrary companion radio, rather than your identity being tied to one specific radio you own.
- Ah TDoA might not have the resolution you need for that, unless you are working with very wideband signals. Probably ~100 m resolution is the best you can get from it.
- Oh wow that's a fantastic resource thank you!
- https://khanfar-spectrum-analyzer.web.app/ also has some phase-based direction-finding software and upcoming hardware.
For triangulation though, if you have a reference signal at a known location, TDoA (time difference of arrival) requires less hardware (just a single receiver at each location, e.g. an RTL-SDR). I don't know of any open-source software which does that though I've been slowly building some for my own use (it's pretty janky at the moment).
- Oh I really like this idea! If you do make this please post it here.
This would be a great learning tool for those of us who are trying to learn it also.
- Not a bug, it was an explicit change they made about a year ago. I used to enjoy the recommendations based on my likes and they took that away.
- The common guidance I've seen is en dash with spaces, em dash without.
- Terminology nit: "file descriptor" is the reference itself. "Open file description" is the thing referenced. dup(2) and fork(2) create new file descriptors which reference the same underlying open file descriptions.
- Not all reals are expressible: to be expressible is to have a finite representation in some language. Definable numbers [1] are that (countably infinite) subset of the reals which can be expressed individually. Almost all reals are not definable and therefore cannot be individually named.
- Why, in your own words, is the jump supposed to be there? (Keep in mind this code is in between two functions.)
And why, in your own words, is it OK for the jump to be a conditional backwards jump?
- From your own link:
> The trapsleds implemented in this diff convert NOP sleds longer than 2 bytes from a series of 0x66666690 instructions to a 2 byte short JMP over a series of INT3 instructions that fill the rest of the gap.
The BMI instructions in the article are not jumping over breakpoint (INT3) instructions. They're conditionally jumping backwards by some amount.
Why in your belief is this? Please use your own words or a relevant direct quote to state your understanding of how a trapsled works.
- Hex D4xxxxxx is indeed (almost) BRK... on ARM64 [1].
Being ARM32, these should be BKPT (hex BExx). [2]
[1] https://developer.arm.com/documentation/ddi0602/2025-06/Base...
[2] https://developer.arm.com/documentation/ddi0597/2024-09/Base...
- You are misunderstanding the purpose of the initial jump in a trap sled. It is to redirect code which expects to flow through the sled past the traps, while leaving the traps for anything else which lands in that range.
The padding the article is talking about lives between functions. It is not meant to be executed, nothing is needed to jump over it. (The unconditional bx lr before it is the return at the end of the function.)
- The instructions have to be trap instructions for it to work.
The conditional branch-backward instruction it is is almost as bad as the series of NOPs, since it is still likely to redirect an attacker to functioning code. (If the attacker can clear the mi flag first, these are just NOPs!)
Hence yes, this is a broken exploit mitigation.
- Instead now, you throw everything away when moving to a new language ecosystem. Would love to see parts of languages become aligned in the same manner that CPUs did, so some constructs become portable and compatible between languages.
- (Having pondered this a day) this is a good question and I do not know! I think this would be straightforward to perform a waveguide simulation of though.
- > translations […] always fail to do justice
I agree with you, yet sometimes, serendipity prevails, and a frying pan becomes a drying pan. [1]
[1] https://knowyourmeme.com/memes/ill-use-my-trusty-frying-pan-...