I am currently reading the "Malware Analyst's Cookbook and DVD". There is a chapter "Dynamic Analysis" and there are also some recipes about hooking and monitoring API calls of process but it is for Windows. I want to do the same thing like recipe 9-10 explains but for Linux. 9-10 is called "Capturing process, Thread, and Image Load Events". In this receipe it is showed "how to implement a driver that alerts you when any events occure on the system while your malware samlpe executes". It uses the API functions of the Windows Driver Kit (WDK) to call a user-defined callback function. It uses the callback functions: - Process creation callback function called PsSetCreateProcessNotifyRoutine(...) - Thread creation callback function called PsSetCreateThreadNotifyRoutine(...) - Image load callback function called PsSetLoadImageNotifyRoutine(...). And when any events occur it will display them as a debug message which can then be viewed in e.g. DebugView. It seems well documented for Windows and it is easy to find information for this, but I have a bit of a problem in finding information for Linux. I've found some general introduction to drivers and a one for hooking, but I still haven't found any that are not so general or at least are a bit more focused on malware analysis. I would be happy for tips for further readings or recommended tutorials on this topic.

How do I find out, since which Linux version a kernel API function/macro is availible, or have undergone breaking changes (was removed, change of the type or number of arguments). For example while looking through recent version of scatterlist.h I stumbled upon sg_alloc_table_from_pages_segment, which has exactly required functionality for my kernel module (driver). However, the function, to my disappointment, is not yet availible in version in 5.10 that the kernel module is developed for, and I will have to find a workaround. Still I wish to support future kernel versions in case we perform an upgrade. Usually, such cases are dealt with preprocessor fences #if LINUX_VERSION_CODE >= KERNEL_VERSION(...) /*Version-specific implementation*/ #endif But in order to apply this pattern, I need to find kernel version in which the function was added. Manually scanning through all intermediate versions of the header file would be a sisyphean task.

I have noticed that some drivers are more difficult to find for certain distributions of Linux. Is it possible to make a driver interface or driver API that is the same for multiple Linux distributions? Has this been done? A common driver API for multiple Linux OS?

I've been searching for a while but I haven't found anything that 100% matches what I would like to achieve. I'm submitting data to an API and getting a response. I can see the submission is successful and I need to redirect to a url that's contained within the response. Example of the response...

{ "status": "OK", "redirectUrl": "https:\/\/blalabla.com" }

These are the things I've tried...

$decodedarray = json_decode($response,true);

if($decodedarray['status'] == "OK") {
	header("Location: ".$decodedarray['redirectUrl']);
}

if($response->response->header->status == 200)
	{
		$redirect_url = $result->response->body->redirectUrl;
		
		header("Location: ".$redirect_url);
		die();
	}

if($response->response->body->status == 200)
	{
		$redirect_url = $result->response->body->redirectUrl;
		
		header("Location: ".$redirect_url);
		die();
	}

The page looks like its refreshing after the submission and sometimes I see the response in the browser. But it won't automatically redirect to the given url. The url is dynamic and changes so I can't hard code it. I'd appreciate any pointers please. Thanks

I have a some internally available servers (all Debian), that share a LetsEncrypt wildcard certificate (*.local.example.com). One server (Server1) keeps the certificate up-to-date and now I'm looking for a process to automatically distribute the .pem-files from Server1 to the other servers (e.g. Server2 and Server3). I don't allow root logins via SSH, so I believe I need an intermediary user. I've considered using a cronjob on Server1 to copy the updated .pem-files to a users directory, where a unprivileged user uses scp or rsync (private key authentication) via another cronjob to copy the files to the Server2/3. However, to make this a more secure process, I wanted to restrict the user's privileges on the Server2/3 to chroot to their home directory and only allow them to use scp or rsync. It seems like this isn't a trivial configuration and most methods are outdated, flawed or requite an extensive setup (rbash, forcecommand, chroot, ...). I've also considered to change the protocol to sftp, which should allow me to use the restricted sftp environment, via OpenSSH but I have no experience. An alternative idea was to use an API endpoint (e.g. FastAPI, which is already running on Server1) or simply a webserver via HTTPS with custom API-Secrets or mTLS on Server1 to allow Server2/3 to retrieve the .pem-files. At the moment, the API/webserver approach seems most reasonable and least complex, yet feels unnecessarily convoluted. I'd prefer a solution that doesn't require additional software. Server1 has .pem-files (owned by root) and Server2/3 need those files updated regularly (root-owned location). What method can I use to distribute those files automatically in a secure manner?

I'm trying to learn UNIX programming and came across a question regarding fork(). I understand that fork() creates an identical process of the currently running process, but where does it start? For example, if I have code int main (int argc, char **argv) { int retval; printf ("This is most definitely the parent process\n"); fflush (stdout); retval = fork (); printf ("Which process printed this?\n"); return (EXIT_SUCCESS); } The output is: ~~~lang-text This is most definitely the parent process Which process printed this? Which process printed this? ~~~ I thought that fork() creates a same process, so I initially thought that in that program, the fork() call would be recursively called forever. I guess that new process created from fork() starts after the fork() call? If I add the following code, to differentiate between a parent and child process, if (child_pid = fork ()) printf ("This is the parent, child pid is %d\n", child_pid); else printf ("This is the child, pid is %d\n", getpid ()); after the fork() call, where does the child process begin its execution?

If I am correct, a process waits for its children to terminate or stop by calling the waitpid() or wait() function. What is the relation between SIGCHLD signal and the waitpid() orwait() functions? - Is it correct that when a process calls the waitpid() or wait() functions, the process suspends itself until a child process terminates/stops, which is the same as until a SIGCHLD signal is sent to it? (pause() suspends the current process until any signal is sent to it. So I wonder if waitpid() is similar, except that until SIGCHLD is sent to it?) - When SIGCHLD is sent to a process which has been suspended by calling waitpid(), what is the order between executing SIGCHLD handler and resuming from suspension by waitpid()? ( In the following example from Computer Systems: a Programmer's Perspective, the SIGCHLD handler calls waitpid().) Thanks.

void handler(int sig)
{
  int olderrno = errno;

  while (waitpid(-1, NULL, 0) > 0) {
    Sio_puts("Handler reaped child\n");
  }
  if (errno != ECHILD)
    Sio_error("waitpid error");
  Sleep(1);
  errno = olderrno;
}

int main()
{
  int i, n;
  char buf[MAXBUF];

  if (signal(SIGCHLD, handler1) == SIG_ERR)
    unix_error("signal error");

  /* Parent creates children */
  for (i = 0; i < 3; i++) {
    if (Fork() == 0) {
      printf("Hello from child %d\n", (int)getpid());
      exit(0);
    }
  }

  /* Parent waits for terminal input and then processes it */
  if ((n = read(STDIN_FILENO, buf, sizeof(buf))) < 0)
    unix_error("read");

  printf("Parent processing input\n");
  while (1)
    ;

  exit(0);
}

I have multiple phones I am trying to obtain the up time for phones. I have enabled REST API for all phones and am looking to run CURL scripts to get the value of uptime. I have a script to get the value off of a Polycom phone. The below command works but I have over 3000 devices I would like to do this with. When I run a script of 100 commands I get the output but it is all jumbled together. I have a txt and excel file with all of the IP Adresses of the phones, the username and passwords are the same for all 3000 devices. I am looking for a way to run all commands and then get a text file with the IPADDRESS and return result of the request( IPADRESS:"Status": "2000"" or something similar). I mostly want an easy way to see the results of each curl line per IP address. ***Command*** curl -d "{\"data\": [\"UpTimeSinceLastReboot\"]}" -H "Content-Type: application/json" -k https://USERNAME:PASSWORD@IPADDRESS/api/v1/mgmt/config/get ***Output*** {“Status”: “2000”, “data”: {"UpTimeSinceLastReboot": ""} I was able to add >> /tmp/filename.txt to output a txt file with all of the responses but there was no way to accurately coorilate that to the phone's IP address..

I want to write a program that can get information about a user, specifically last login time in unix timestamp format using kernel API (not using any shell cmd). What function do I need to call to get that information?

I have a file called /etc/chromium.d/apikeys which has the following contents,

# API keys assigned to Debian by Google for access to their services like sync and gmail.
 
export GOOGLE_API_KEY="AIzaSyCkfPOPZXDKNn8hhgu3JrA62wIgC93d44k"
export GOOGLE_DEFAULT_CLIENT_ID="811574891467.apps.googleusercontent.com"
export GOOGLE_DEFAULT_CLIENT_SECRET="kdloedMFGdGla2P1zacGjAQh"

Why does Debian ship Google API keys though to begin with? You don't need an API to go to gmail.com? What happens if I nuke this file? You can see it's part of upstream chromium,

$ dpkg -S /etc/chromium.d/apikeys
chromium: /etc/chromium.d/apikeys

What part of chromium functionality requires these keys?

What specifically needs to be changed in the below in order for a program running on an Ubuntu-latest GitHub runner to successfully connect to a Twisted web server running on localhost of the same GitHub runner? The same code works on a Windows laptop, with only minor changes like using where twistd on Windows versus which twistd on Ubuntu as shown below. **SOME RELEVANT CODE:** The code to start the Twisted web server on localhost is in a script called twistdStartup.py that reads as follows: import subprocess import re import os escape_chars = re.compile(r'\x1B\[[0-?]*[ -/]*[@-~]') def runShellCommand(commandToRun, numLines=999): proc = subprocess.Popen( commandToRun,cwd=None, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, shell=True) while True: line = proc.stdout.readline() if line: if numLines == 1: return escape_chars.sub('', line.decode('utf-8').rstrip('\r|\n')) else: print(escape_chars.sub('', line.decode('utf-8').rstrip('\r|\n'))) else: break print("About to create venv.") runShellCommand("python3 -m venv venv") print("About to activate venv.") runShellCommand("source venv/bin/activate") print("About to install flask.") runShellCommand("pip install Flask") print("About to install requests.") runShellCommand("pip install requests") print("About to install twisted.") runShellCommand("pip install Twisted") ##Set environ variable for the API os.environ['PYTHONPATH'] = '.' print("Done updating PYTHONPATH. About to start server.") twistdLocation = runShellCommand("which twistd", 1) startTwistdCommand = twistdLocation+" web --wsgi myAPI.app &>/dev/null & " print("startTwistdCommand is: ", startTwistdCommand) subprocess.call(startTwistdCommand, shell=True) print("startTwistdCommand should be running in the background now.") The code in a calling program named startTheAPI.py that invokes the above twistdStartup.py is: myScript = 'twistdStartup.py' print("About to start Twisted.") subprocess.Popen(["python", myScript], stdout=subprocess.PIPE, stderr=subprocess.STDOUT) print("Just finished starting Twisted.") The logs produced by that step in the GitHub Action job are as follows: About to start Twisted. Just finished starting Twisted. The results of running the curl command on the same Ubuntu-latest GitHub runner in the next step of the same job after waiting 30 seconds for startup are as follows: $ curl http://localhost:1234/api/endpoint/ % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 curl: (7) Failed to connect to localhost port 1234 after 1 ms: Connection refused The contents of a callTheAPI.py program that runs the curl command would look like: import subprocess import re import os escape_chars = re.compile(r'\x1B\[[0-?]*[ -/]*[@-~]') def runShellCommand(commandToRun, numLines=999): proc = subprocess.Popen( commandToRun,cwd=None, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, shell=True) while True: line = proc.stdout.readline() if line: if numLines == 1: return escape_chars.sub('', line.decode('utf-8').rstrip('\r|\n')) else: print(escape_chars.sub('', line.decode('utf-8').rstrip('\r|\n'))) else: break print("About to call API.") runShellCommand("curl http://localhost:1234/api/endpoint/") print("Done calling API.") **SUMMARY:** The twistdStartup.py script is running, but is failing to provide any output to the logs despite all the print() commands. The curl command fails to connect to the correctly-stated http://localhost:1234/api/endpoint/

For example the Samsung Galaxy S10 has an Exynos 9820 CPU with integrated NPU. We all know Android is based on Linux. So where can I find the Linux API documentation about how to interact with the NPU? For example there must be a way to get the frequency and core count of the NPU. Maybe they are listed in /proc/cpuinfo? Also I want to load a program into the NPU and execute it. All this must be documented somewhere. Where can I find the Linux NPU documentation? I already know where to find the Android AI documentation. But I am looking for the Linux NPU documentation which is on a lower level.

A bit related to [this previous question of mine](https://unix.stackexchange.com/questions/723777/how-do-you-use-keyboard-driven-programs-with-non-latin-alphabet-keyboards) , I wonder if there's a way to query what is the current layout. Say I have run

setxkbmap -layout it,ru -variant ,phonetic -option 'grp:caps_toggle'

and that I've presset CapsLock a few times. How can I tell programmatically what of 2 states I'm in? Interactively I can simply type some characters to check, but I want to do it programmatically, so I can have that state printed in a status bar or something. --- I was also thinking of some hack, like synthetically hitting CapsLockfCapsLockf, and then checking whether the output is фf or fф, which would tell me the current layout is it or ru respectively. [xdotool seemed the correct tool for this](https://unix.stackexchange.com/questions/267704/command-to-simulate-keyboard-input) , but unfortunately Caps_Lock corresponds to the _function_ of the ordinary CapsLock key, and not to what the setxkbmap command above has set it to, so this

xdotool key Caps_Lock f Caps_Lock f

results in Ff regardless of what layout is active.

There is a path to the file, I make a write disk cache request via ioctl - ioctl(fd, SG_IO, &ioHdr). printk: sending ioctl 2285 to a partition!? how to find out which block device a partition belongs to ? I want to replace partition path with path to disk.

I have the latest version of Empire: Total War in Steam on Arch Linux x86_64. I have followed this Reddit guide to install DME. I have gone through each and every step (except the optional ones) and the game failed to start on launch. --- Here are my specs: **$ inxi -SPARM -GCDN -v1 -xGCRS** System: Host: archlinux Kernel: 4.12.4-1-ARCH x86_64 (64 bit gcc: 7.1.1) Desktop: Gnome 3.24.3 (Gtk 3.22.18) Distro: Arch Linux Machine: Device: desktop Mobo: ASUSTeK model: P5Q PRO TURBO v: Rev 1.xx BIOS: American Megatrends v: 0701 date: 10/08/2012 CPU: Quad core Intel Core2 Quad Q6600 (Core 2 rev.11) (-MCP-) cache: 4096 KB flags: (lm nx sse sse2 sse3 ssse3 vmx) bmips: 19207 clock speeds: max: 2403 MHz 1: 2403 MHz 2: 1603 MHz 3: 2136 MHz 4: 1603 MHz Graphics: Card: Advanced Micro Devices [AMD/ATI] Juniper XT [Radeon HD 5770] bus-ID: 01:00.0 Display Server: N/A driver: radeon tty size: 131x87 Audio: Card-1 Advanced Micro Devices [AMD/ATI] Juniper HDMI Audio [Radeon HD 5700 Series] driver: snd_hda_intel bus-ID: 01:00.1 Card-2 Intel 82801JI (ICH10 Family) HD Audio Controller driver: snd_hda_intel bus-ID: 00:1b.0 Sound: Advanced Linux Sound Architecture v: k4.12.4-1-ARCH Network: Card: Qualcomm Atheros AR8121/AR8113/AR8114 Gigabit or Fast Ethernet driver: ATL1E port: cc00 bus-ID: 02:00.0 Drives: HDD Total Size: 1500.3GB (4.3% used) ID-1: /dev/sda model: WDC_WD5000AAKS size: 500.1GB ID-2: /dev/sdb model: ST1000LM024_HN size: 1000.2GB Partition: ID-1: / size: 457G used: 60G (14%) fs: ext4 dev: /dev/sda3 ID-2: /boot size: 202M used: 58M (31%) fs: ext4 dev: /dev/sda1 ID-3: swap-1 size: 0.54GB used: 0.06GB (11%) fs: swap dev: /dev/sda4 RAID: No RAID data: /proc/mdstat missing-is md_mod kernel module loaded? Info: Processes: 247 Uptime: 1 day Memory: 2934.5/7987.4MB Init: systemd Gcc sys: 7.1.1 Client: Shell (fish) inxi: 2.3.27 --- I ran the game from a terminal and I got: **$ ./.steam/steam/steamapps/common/Empire\ Total \ War/Empire.sh** ~/.local/share/Steam/steamapps/common/Empire Total War/bin/game.i386: error while loading shared libraries: libvorbis.so.0: cannot open shared object file: No such file or directory Apparently, I was missing some 32-bit libraries, some pacman magic and symbolic linking gave the game the libraries it needed. However, when I ran the game it returned: **$ ./.steam/steam/steamapps/common/Empire Total War/bin/game.i386** Setting breakpad minidump AppID = 10500 Steam_SetMinidumpSteamID: Caching Steam ID: 76561198044159024 [API loaded no] Dumped crashlog to /home/pradana/.local/share/feral-interactive/Empire/crashes//772c6081-0a79-298b-2c7a8124-23190ade.dmp fish: “./game.i386” terminated by signal SIGSEGV (Address boundary error) I have tried to read the .dmp file (core dump) using **$ gdb ./game.i386 ~/.local/share/feral-interactive/Empire/crashes/4ab1b7fb-8cb4-b5b2-58c0ddd9-6767d769.dmp** However, it returns the error: "~/.local/share/feral-interactive/Empire/crashes/4ab1b7fb-8cb4-b5b2-58c0ddd9-6767d769.dmp" is not a core dump: File format not recognized I tried to figure out the encoding of the file using **$ file --mime 4ab1b7fb-8cb4-b5b2-58c0ddd9-6767d769.dmp** 4ab1b7fb-8cb4-b5b2-58c0ddd9-6767d769.dmp: application/x-dmp; charset=binary and **$ chardetect-py2 4ab1b7fb-8cb4-b5b2-58c0ddd9-6767d769.dmp** 4ab1b7fb-8cb4-b5b2-58c0ddd9-6767d769.dmp: Windows-1254 with confidence 0.299704567453 I have also used **$ iconv -c -f WINDOWS-1254 -t utf-8 4ab1b7fb-8cb4-b5b2-58c0ddd9-6767d769.dmp > dmp.txt** to try and read the log but I had no progress here. I can't seem to progress without trying to find out what lies in hte code dump file. In any case, I'm trying find why the Steam game crashes at this point.

So I have this curl command. But I want to store the API-key in a file called api.txt and have it load where the value is in the curl command. api.txt files contains 'X-Api:' This command works. curl -H 'X-Api:' -T file.zip "https://URL " Tried: curl -H “Content-Type: text/plain” -d “api.txt” -T file.zip "https://URL " Got error: "errors" : [ { "status" : 401, "message" : "Unauthorized" } ] }% Question: 1. How can I load either the actual api key or the expected line from api.txt to parse it into the curl command? 2. is this the way to do this? or a better way?

I'm using the Ansible module for Bluecat to make an authorized API call to get some information about a subnet. The response looks something like this:

"result": {
        "changed": false,
        "failed": false,
        "json": "b'{\"id\":12345,\"name\":\"SUBNET NAME\",\"properties\":\"CIDR=10.2.2.0/24|allowDuplicateHost=enable|pingBeforeAssign=disable|inheritAllowDuplicateHost=true|inheritPingBeforeAssign=true|gateway=10.2.2.1|inheritDNSRestrictions=true|inheritDefaultDomains=true|inheritDefaultView=true|\",\"type\":\"IP4Network\"}\\n'",
        "msg": "",
        "status": 200
}

As you can see, all the useful data is in that json field, but it's some string literal abomination with escaped quotes and newlines. If I run

- debug:
      msg: "{{ result | json_query('json.name') }}"

in Ansible, it gives me back the msg field instead! I can get the entire json field, but not anything inside it. If I tinker with it a little bit and trim the b at the beginning, the inner single quotes, and the extra backslash by the newline at the end, then jq .json | fromjson parses it correctly. But I'm fairly certain b'' just means byte encoding and shouldn't break the parsing, but it does. And what's with the double backslashes at the end? Do I have any options beyond using some sed black magic to wipe out all of the escape characters? Why would a web API return a string literal like this?

File "/home/Desktop/booklib/env/lib/python3.8/site-packages/rest_framework/authentication.py", line 126, in authenticate
    self.enforce_csrf(request)
  File "/home/Desktop/booklib/env/lib/python3.8/site-packages/rest_framework/authentication.py", line 135, in enforce_csrf
    check = CSRFCheck()
TypeError: __init__() missing 1 required positional argument: 'get_response'
[21/Dec/2021 14:37:05] "GET /api/ HTTP/1.1" 500 112898

# **api/serializers.py**

rest_framework import serializers

from book.models import Book


class BookSerializer(serializers.ModelSerializer):
    class Meta:
        model = Book
        fields = ('title', 'author','summary', 'isbn')

** Create your views here :api/views.py**

django.shortcuts import render
from rest_framework import generics

from book.models import Book
from .serializers import BookSerializer


class BookAPIView(generics.ListAPIView):
    queryset = Book.objects.all()
    serializer_class = BookSerializer

**# api/urls.py**

django.urls import path
from .views import BookAPIView

urlpatterns = [
    path('', BookAPIView.as_view())
]

I am using the below command: curl -X GET 'https://.atlassian.net/rest/api/3/project/search ' This returns "header" information indicating that that command was successful: HTTP/1.1 200 OK However, it does not give me the search information. If I put this in a browser: https://.atlassian.net/rest/api/3/project/search It DOES return the information I want. I've looked at the documentation for the [project-search](https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-projects/#api-rest-api-3-project-search-get) API call, with its example for curl. I am also trying the curl command from an API Testing Tool called Talend API. It converts my browser search into that curl command. I can't understand why the curl command indicates a successful connection and yet does not produce any output to the screen in a similar way to the search command I place in the browser. Is there another way to do this perhaps, or, something obvious I am missing? I have reviewed the man pages for curl and tried adding in an output command / file but it doesn't make the output any more verbose. Thanks!

There are already many questions similar to this but all the ones I could find have answers that suggest polling methods ((https://unix.stackexchange.com/a/290073/68864) , (https://askubuntu.com/a/202145)) or seem like extreme hacks ((https://unix.stackexchange.com/a/290117/68864)) , so I want to ask the same question but with the added caveat that solutions must not use polling: What I'm looking for is some kind of API that is commonly available (or easily installable) on Linux desktop systems that lets you listen for these two events: 1. The user has been "idle" (not moving the mouse, typing on the keyboard, etc.) for N seconds (where you can specify N). 2. After (1) had previously been triggered (and only then!), the user has now performed some activity and should no longer be considered idle. After this event, (1) can be re-triggered, allowing the cycle to repeat. For (1), it is not very important to me that it happens without polling, as in my use case, the tolerance for delays when reacting to this first type of event is high enough that I'm fine with polling every 10 seconds. But for event (2), the reaction should feel instant, so with polling approaches, I'd have to poll every 0.1 seconds or so, which would be an unacceptable waste of CPU time.1 So I'd consider (1) "solved" by the suggestion to use use something like xprintidle in a polling fashion, but as the definition of (2) relies on (1), I felt it should be listed here anyway. Any ideas for APIs that implement (2)? How do screensavers etc. do it? ----- 1 To understand the motivation here, compare how you would feel if e.g. dpms turned off your screen after 10 minutes and 10 seconds rather than the 10 minutes you configured vs how you would feel if there was a 10 second delay to turning it on again after detecting activity... It seems to me like most use cases imply a greater tolerance for "idle detection" than for "un-idle detection".