BinBashBanana

Easy debugging of Geode mods with HWASan

ASan (and it's younger brother, HWASan) are incredible tools for debugging memory integrity bugs in native applications. This guide explains how to set up HWASan for Geode mods on Android and how to analyze crashes.

Requirements:

Device running Android 14+, lower is possible but only with ASan, which has a slightly different way of setting up. See here
Android Studio or any other way of building the launcher

Build the mod

The original snippet no longer works!

On 02/09/2024 at around 8pm UTC, Discord flipped an experiment (2023-09_mobile_redesign_override_toggles) which ignores the layout toggle that this script relied on.

If you want to continue using the old layout, you can either use a modded mobile client (such as Vendetta) to disable that experiment, or downgrade to an old version of the app.

Method 1 - Downgrading (Android)

Tip

Use this one if you want a fast, beginner-friendly solution and don't mind using a version from November 2023

Download version 205.15 of Discord mobile app from ApkMirror

Updated Version:

If you want to download an older version ive heard 205.15 works well, i reccomend ApkMirror

Using a modified app (Android & IOS friendly):

Follow the instructions from https://github.com/vendetta-mod/Vendetta
After the client is installed, navigate to Settings > Plugins, then click the +, and finally paste https://vd-plugins.github.io/proxy/maisymoe.github.io/strife/Experiments into the input and click Install
Once the experiments plugin is enabled, reload the app then go to Settings > Experiments > Tabs V2 - redesign opt-out/in for all and select Control Bucket.

Ive also heard enmity works well for IOS.

Short guide on how to bypass this:

If you haven't disabled rootfs verification, switch to vt-2 and run /usr/libexec/debugd/helpers/dev_features_rootfs_verification. Then reboot.

Inside crostini, download minioverride.c and compile it with gcc minioverride.c -o minioverride.so -shared (make sure gcc is installed)

In the files app, move minioverride.so into your downloads folder.

Log4J CVE Advisory

The Problem

Log4J has a feature called Java Naming and Directory Interface (shortened to JNDI in this document), which allows a Java program to reach out to an external source to gather data.
If you put a section of text containing ${jndi:query} into the log, the Log4J library will try to resolve the query.
This can be combined with the Lightweight Directory Access Protocol (LDAP) to connect to a remote server.

However, because JNDI is built for retrieving data, and JNDI is a Java program, if you put a JNDI query using LDAP into a log, it will connect to the given site, download a file, and then execute it.
This is called Remote Code Execution.

ANSI Escape Sequences

Standard escape codes are prefixed with Escape:

Ctrl-Key: ^[
Octal: \033
Unicode: \u001b
Hexadecimal: \x1B
Decimal: 27

	#!/bin/python3


	# ------------------------------------
	# For easy execution, run the command:
	# curl https://gist.githubusercontent.com/itsmaxymoo/3ffd38ed8f4d896e67e7c5af25b40173/raw \| python3 -
	# ------------------------------------


	import os

	#!/bin/bash

	red="\E[1;31m";
	green="\E[1;32m";
	yellow="\E[1;33m";
	plain="\e[0m";

	error() {
	echo -e "${red}${1}${plain}";
	}


	#define LIBCO_C
	#include <libco.h>
	#include <stdlib.h>
	#include <pthread.h>

	#ifdef __cplusplus
	extern "C" {
	#endif