https://jan.stancek.eu/ 2026-06-09T01:11:47+00:00 https://jan.stancek.eu/ https://jan.stancek.eu/_media/wiki:dokuwiki.svg text/html 2011-09-20T18:43:41+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/bash_mix?rev=1316544221&do=diff <http://tldp.org/LDP/abs/html/> echo ${PATH#*:} # Parameter substitution, not a comment. echo $(( 2#101011 )) # Base conversion, not a comment. echo ${param1:-DEFAULT} echo "whatever" | cat - file - let "z = 5 % 3" echo ~+ a="23456"; echo ${a/23/BB} echo $(ls -l) type '[' type '[[' echo $((RANDOM%16)) str="123abc"; echo ${#str}; expr length $str; expr "$str" : '.*' expr match "$string" '$substring' expr "$string" : '$substring' echo ${str:2:3} echo ${*:2}; echo ${@:2} expr match "$st… text/html 2025-04-11T09:30:44+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/c_brain_teasers?rev=1744363844&do=diff #include <stdlib.h> #include <stdio.h> class B { public: B(int b) : m_b(b) {} operator int() { return m_b; } int operator()() { return m_b*2; } private: int m_b; }; class A { public: A(int i) { printf("Output is: %d\n", i); } }; int main() { int k = 6; A a( B(k) ); // what is the output of this program? return 0; } text/html 2016-12-08T14:28:36+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/contact?rev=1481207316&do=diff Contact --- <jan.stancek@gmail.com> text/html 2014-07-09T22:30:39+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/cross_compile?rev=1404945039&do=diff ===== binutils # cd build-binutils # cat a.sh BUILD=`gcc -v 2>&1 | grep Target: | sed 's/.*: //'` PREFIX=/opt/toolchain-le TARGET=ppc64le-redhat-linux-gnu ../binutils-2.24.51/configure --target=$TARGET --prefix="$PREFIX" --disable-nls --disable-werror --with-sysroot="$PREFIX" sh a.sh make make install ===== gcc core # cd build-gcc # cat a.sh BUILD=`gcc -v 2>&1 | grep Target: | sed 's/.*: //'` PREFIX=/opt/toolchain-le TARGET=ppc64le-redhat-linux-gnu #../gcc-4.8.2-20140409/configure --target… text/html 2011-09-20T18:43:41+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/cv?rev=1316544221&do=diff <note warning>Access to this page is restricted</note> text/html 2014-08-30T13:51:35+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/delo_notes?rev=1409406695&do=diff # cat /boot/grub/grub.cfg # # DO NOT EDIT THIS FILE # # It is automatically generated by grub-mkconfig using templates # from /etc/grub.d and settings from /etc/default/grub # ### BEGIN /etc/grub.d/00_header ### if [ -s $prefix/grubenv ]; then load_env fi set default="2" if [ "${prev_saved_entry}" ]; then set saved_entry="${prev_saved_entry}" save_env saved_entry set prev_saved_entry= save_env prev_saved_entry set boot_once=true fi function savedefault { if [ -z "${boot_once}" ]… text/html 2017-10-02T19:52:55+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/energie?rev=1506973975&do=diff Studena Tepla Elektrika April 2014 0.608 0.317 20.4 August 2014 2.264 0.646 65.3 September 2014 3.146 0.870 118.3 Oktober 2014 4.04 1.19 175.7 November 2014 4.7 1.47 216 December 2014 5.6 1.8 273 Februar 2015 7 2.3 345.5 text/html 2011-09-20T18:43:42+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/gdb_syscall_mips_patch?rev=1316544222&do=diff <http://sourceware.org/ml/gdb-patches/2010-03/msg00935.html> uClibc syscall() is macro which modifies stack before syscall instruction, gdb is only looking at function prologue and misses the stack modification made in syscall(). Because of this unwind doesn't work. Attached is a patch, which is looking at actual $pc and $pc-4, and in case of syscall it modifies $sp, so mip32_scan_prologue finds correct values. text/html 2025-04-11T09:29:31+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/gitarch.py?rev=1744363771&do=diff #!/usr/bin/python # gitarch.py # # Copyright (C) 2012 Jan Stancek <jan@stancek.eu> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A… text/html 2011-09-20T18:43:42+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/javacert?rev=1316544222&do=diff This is an official communication providing instructions for verifying Ján Stanček's Sun credentials. Steps to view the Sun credentials Ján Stanček has authorized Sun to verify to you: 1.Click on the URL link below 2.A web-browser window will open 3.Enter the authorization code provided below 4.Agree to the privacy policy terms by checking the box 5.Click the "submit" button 6.The authorized credential verification for Ján Stanček will be displayed. The URL and Authorization Code are speci… text/html 2011-09-25T16:00:06+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/krb_notes?rev=1316966406&do=diff [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = AUTOBKR.COM dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true [realms] AUTOBKR.COM = { kdc = kvm-guest-04.rhts.eng.bos.redhat.com admin_server = kvm-guest-04.rhts.eng.bos.redhat.com } [domain_realm] kvm-guest-04.rhts.eng.bos.redhat.com = AUTOBKR.COM text/html 2025-04-11T09:30:24+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/mips_function_runtime_detour?rev=1744363824&do=diff patch.c /* * detour for malloc on mips * (c) Jan Stancek, May 2010 * * At runtime, malloc beginning is overwritten to jump to my_malloc, * libc_malloc will jump to trampoline and then back to malloc+XX * to provide standard malloc functionality * * * +---------------------------------------------+ * | | * 0x2ab68964 - malloc | 0x30000000 - trampoline (libc_malloc) … text/html 2025-04-11T09:29:51+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/old_gitarch.py?rev=1744363791&do=diff # gitarch.py # # Copyright (C) 2011 Jan Stancek <jan@stancek.eu> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOS… text/html 2011-09-20T18:43:41+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/old_programming?rev=1316544221&do=diff Old programming Here are few projects I made. They look pretty funny nowadays :-), but back then I enjoyed working on them. You can see larger picture if you click on one. Also some projects has links to executables and sources. HLsaver OpenGL screen saver, showing the reception room from Half-life game. Camera is flying across the room around Barney and Scientist, who are working behind computer on something important (the alarm is on). Written in MSVC 6. text/html 2011-09-20T18:43:41+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/openstage_fbcon?rev=1316544221&do=diff This page shows a framebuffer console and usb keyboard running on OpenStage HI with 2.6.20 kernel. A fun project I was working on for about 2 weeks after office hours. Framebuffer was missing some functionality, and USB HID driver had some endian issues. text/html 2011-09-20T18:43:42+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/pastebin?rev=1316544222&do=diff Root privileges through vulnerability in GNU C loader <http://code.google.com/p/i7z/> <http://kolbusa.livejournal.com/71066.html> <https://bugzilla.kernel.org/show_bug.cgi?id=15064> <https://help.ubuntu.com/community/HdaIntelSoundHowto> <http://ubuntuforums.org/showthread.php?t=1324555> <http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob_plain;f=Documentation/sound/alsa/HD-Audio-Models.txt> bash mix text/html 2017-10-24T09:44:18+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/projects?rev=1508838258&do=diff Projects Various projects, useful bits of code, etc. * Patches/contributions * upstream linux kernel * marc.info archive (incomplete) * My github page * Linux Test Project * LTP archive on linux.it * selinux-testsuite * libhugetlbfs * kpatch * centerim * patch: fix stack unwind through uClibc syscall() on mips * objdump fix for three byte instruction at the end of a function * Linux exploits * udp sendmsg exploit x86 RHEL3 * sock_sendpage exploit fo… text/html 2011-09-20T18:43:41+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/root_privileges_through_vulnerability_in_gnu_c_loader?rev=1316544221&do=diff <http://www.kernel.org/doc/man-pages/online/pages/man8/ld.so.8.html> <http://www.h-online.com/open/news/item/Root-privileges-through-vulnerability-in-GNU-C-loader-1110182.html> The GNU C library dynamic linker expands $ORIGIN in setuid library search path From: Tavis Ormandy <taviso () cmpxchg8b com> Date: Mon, 18 Oct 2010 12:17:25 +0200 The GNU C library dynamic linker expands $ORIGIN in setuid library search path ----------------------------------------------------------------------------… text/html 2011-09-26T08:04:52+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/self_signed_ssl_cert?rev=1317024292&do=diff openssl genrsa -des3 -out server.key 1024 req -new -key server.key -out server.csr openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt cp server.key server.key.secure openssl rsa -in server.key.secure -out server.key text/html 2025-04-11T09:19:11+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/sock_sendpage_exploit_for_mips?rev=1744363151&do=diff Based on existing exploit, modified for use on mips. /* ** ** 0x82-CVE-2009-2692 ** Linux kernel 2.4/2.6 (32bit) sock_sendpage() local ring0 root exploit (simple ver) ** ** -- ** Discovered by Tavis Ormandy and Julien Tinnes of the Google Security Team. ** spender and venglin's code is very excellent. ** Thankful to them. ** ** Greets: Brad Spengler <spender(at)grsecurity(dot)net>, ** Przemyslaw Frasunek <venglin(at)czuby(dot)pl>. ** -- ** ** mips port by jan.stancek(at)g… text/html 2025-04-11T12:31:22+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/start?rev=1744374682&do=diff Welcome * Projects * Private Pastebin text/html 2011-09-20T18:43:41+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/temp?rev=1316544221&do=diff blah text/html 2011-09-20T18:43:42+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/toshiba_x500-11z_cpuinfo_lspci_lsusb?rev=1316544222&do=diff processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 30 model name : Intel(R) Core(TM) i7 CPU Q 720 @ 1.60GHz stepping : 5 cpu MHz : 1600.000 cache size : 6144 KB physical id : 0 siblings : 8 core id : 0 cpu cores : 4 apicid : 0 initial apicid : 0 fpu : yes fpu_exception : yes cpuid level : 11 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep … text/html 2011-09-20T18:43:42+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/toshiba_x500-11z_ethernet?rev=1316544222&do=diff Kernel 2.6.32 gotchas: it was eth1 0b:00.0 Ethernet controller: Atheros Communications AR8131 Gigabit Ethernet (rev c0) Subsystem: Toshiba America Info Systems Device ff50 Flags: bus master, fast devsel, latency 0, IRQ 35 Memory at f0400000 (64-bit, non-prefetchable) [size=256K] I/O ports at 5000 [size=128] Capabilities: [40] Power Management version 3 Capabilities: [48] Message Signalled Interrupts: Mask- 64bit+ Queue=0/0 Enable+ Capabili… text/html 2011-09-20T18:43:41+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/toshiba_x500-11z_sound?rev=1316544221&do=diff 01:00.1 Audio device: nVidia Corporation High Definition Audio Controller (rev a1) Subsystem: Toshiba America Info Systems Device ff50 Flags: bus master, fast devsel, latency 0, IRQ 17 Memory at cdefc000 (32-bit, non-prefetchable) [size=16K] Capabilities: [60] Power Management version 3 Capabilities: [68] Message Signalled Interrupts: Mask- 64bit+ Queue=0/0 Enable- Capabilities: [78] Express Endpoint, MSI 00 Kernel driver in use: HDA Intel … text/html 2011-09-20T18:43:41+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/toshiba_x500-11z_wireless?rev=1316544221&do=diff custom driver from net: rtl8192se_linux_2.6.0015.0127.2010.tar.gz 0a:00.0 Network controller: Realtek Semiconductor Co., Ltd. RTL8191SEvB Wireless LAN Controller (rev 10) Subsystem: Realtek Semiconductor Co., Ltd. Device 8181 Flags: bus master, fast devsel, latency 0, IRQ 16 I/O ports at 4000 [size=256] Memory at f0600000 (32-bit, non-prefetchable) [size=16K] Capabilities: [40] Power Management version 3 Capabilities: [50] Message Signalled Interr… text/html 2011-09-20T18:43:41+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/toshiba_x500-11z?rev=1316544221&do=diff Wireless Ethernet Sound cpuinfo lspci lsusb text/html 2025-04-11T09:16:20+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/udp_sendmsg_exploit_x86_rhel3?rev=1744362980&do=diff Based on existing exploit, modified for RHEL3. /*********************************************************** * hoagie_udp_sendmsg.c * LOCAL LINUX KERNEL ROOT EXPLOIT (< 2.6.19) - CVE-2009-2698 * * udp_sendmsg bug exploit via (*output) callback function * used in dst_entry / rtable * * Bug reported by Tavis Ormandy and Julien Tinnes * of the Google Security Team * modified by jano for RH 3.1 * * * THIS FILE IS FOR STUDYING PURPOSES ONLY AND A PROOF-OF- * CONCEPT. THE AUTHOR CAN NOT … text/html 2011-09-20T18:43:41+00:00 Anonymous (anonymous@undisclosed.example.com) https://jan.stancek.eu/vmlinuz_to_vmlinux?rev=1316544221&do=diff > od -A d -t x1 vmlinuz | grep '1f 8b 08 00' 0024576 24 26 27 00 ae 21 16 00 1f 8b 08 00 7f 2f 6b 45 so the image begins at 24576+8 => 24584 . Then just copy the image from the point and decompress it - >dd if=vmlinuz bs=1 skip=24584 | zcat > vmlinux 1450414+0 records in 1450414+0 records out 1450414 bytes (1.5