linux-kernel - RE: RFC: WMI Enhancements

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 9 May 2017 19:16:01 +0000
From:   <Mario.Limonciello@...l.com>
To:     <andy.shevchenko@...il.com>
CC:     <pali.rohar@...il.com>, <dvhart@...radead.org>,
        <rjw@...ysocki.net>, <luto@...capital.net>, <len.brown@...el.com>,
        <corentin.chary@...il.com>, <luto@...nel.org>,
        <andriy.shevchenko@...ux.intel.com>,
        <linux-kernel@...r.kernel.org>,
        <platform-driver-x86@...r.kernel.org>, <linux-pm@...r.kernel.org>
Subject: RE: RFC: WMI Enhancements

> -----Original Message-----
> From: Andy Shevchenko [mailto:andy.shevchenko@...il.com]
> Sent: Tuesday, May 9, 2017 2:04 PM
> To: Limonciello, Mario <Mario_Limonciello@...l.com>
> Cc: Pali Rohár <pali.rohar@...il.com>; dvhart@...radead.org; Rafael J. Wysocki
> <rjw@...ysocki.net>; Andy Lutomirski <luto@...capital.net>; Brown, Len
> <len.brown@...el.com>; Corentin Chary <corentin.chary@...il.com>; Andy
> Lutomirski <luto@...nel.org>; Andy Shevchenko
> <andriy.shevchenko@...ux.intel.com>; linux-kernel@...r.kernel.org; Platform
> Driver <platform-driver-x86@...r.kernel.org>; linux-pm@...r.kernel.org
> Subject: Re: RFC: WMI Enhancements
> 
> On Tue, May 9, 2017 at 9:10 PM,  <Mario.Limonciello@...l.com> wrote:
> 
> >> > > Then took relevant decompression code and it really decompressed that
> >> > > binary MOF WMI buffer. But still decompressed format is binary, but I
> >> > > now see all WMI GUID encoded in UTF-16. Decompressed BMF file has again
> >> > > "FOMB" magic header.
> >> >
> >> > Well that's great.  Is it possible that this compression is used for every time
> >> > a class was declared?
> >>
> >> Looks like not. That decompressed output seems to be not compressed
> >> anymore. Just use same magic header.
> > Actually it looks like a new magic header to me after decompressed.
> >
> > 46 4f 4d 42 54 15 00 00  01 00 00 00 01 00 00 00
> > That's now FOMBT
> 
> I think you just mistakenly take 0x54 as letter when it looks more like
> 
> 0x00001554
> 0x00000001
> 0x00000001
> 
> from the above dump.
Ah, that's true, but second word is different than original was main point.
We didn't know what that represented (maybe it's part of magic header).

46 4f 4d 42 01 00 00 00  ed 04 00 00 d8 15 00 00
0x00000001

> --
> With Best Regards,
> Andy Shevchenko