#round 2ab

[les-mis-guy-supreme]

ROUND 2-AB

[tdp-fandom]

Rarepair Rumble Round 2AB

(Info about the event) (List of participating ships) (1D results)

Click here to cast your vote for your favorite ships!

Welcome back to Rarepair Rumble! We are finally entering round 2, which means 64 ships out of our initial 128 have left the competition.

Round 2 will be divided into two parts: 2AB and 2CD (the letters stand for different blocks of the tournament table).

The voting will go as usual with one alteration - I added a third voting option - “I don’t want to vote for either of these ships. A friend on on Discord pointed out that although you can skip the pairs you don’t care about or don’t like, the power of the binary choice makes it hard to skip them, getting the person stuck on making a choice. And it does make sense - I definitely feel that I want to make a choice whenever I’m presented with it, even if I don’t have an opinion on the subject matter.

The extra option also gives me some statistics on which ship pairs people don’t want to vote for.

Here’s an example of a ship pair with three possible answers:

Everything else will be done as usual.

This week, the voting will close on Monday, 22 June, 2020 at:

03:00 (3AM) PDT

06:00 (6AM) EDT

12:00 (12PM) CEST

17:00 (5PM) ICT

Click here to check for your time zone.

You can see this round’s competing ships under cut. This time, there aren’t any ships I would consider problematic, however some of the ships have been the subject of heated debates.

The ships in question are Ruren (Runaan x Soren) and Calren (Callum x Soren). I don’t see these ships as problematic, but I respect people’s decision not to interact with them.

[beardedllamaoafwombat]

Lava headcanon

I think Kai is good at algebra while Cole at geometry. Cole is a good artist and he likes draw circle, triangles, cubes and other. When they were teachers students always tried draw perfect round by hand like Cole.

For Kai geometry is boring because at algebra he can find very interesting and different ways of right solution while at geometry just look at formulas and give an answer. Also Kai doesn't like sin with cos, he can't draw beautiful shapes and always forgot formules. Kai still doesn't understand why triangles have so many formulas of area.

And just imagine how they talked with each other when Lloyd did math tasks.

Kai: Use Herons Formula.

Cole: C'mon, Kai. We can find the right solution with S= 1/2ab*sin a

Lloyd: I don't like this stupid sin a!

Kai: THAT'S MY CHILD!

Or

Kai: What are you doing?

Lloyd: I try to find the right solution of Quadratic formula.

Kai: But you did mistakes at here.

Lloyd: ARGH!!

Cole: Come with me and geometry, poor child!

Lloyd: ok. *opens a geometry book*

Kai: HOW DO YOU DARE?!

[whatdoesshedotothem]

Friday 17 July 1840

6 ¼

10 10/..

Oni .

very fine morning – all packed while A- finished dressing having been sewing yesterday and this morning for me – she and I and took George and Adam out at 8 ¼ to the bazaar – amusing assemblage crowd in the little bazaar of Montagnards – some of the women afraid when we noticed (touched) their things – A- returned in about ¾ hour – I remained – home at 10 10/.. – bought cherries black and red small wild 6 or 8lbs. a great many (all the stalks picked off) for ./20 copper or rather Adam paid 26 paras – then bought 9 trout all gutted and cleaned ready for cooking – the man asked 1ab. took 1/2ab. .:. the price must still have been large enough to give up his masters’ dinner the merchant just behind us who had or probably could easily get as many more for 1/4ab. – printed calicos and handkerchiefs to be sold – saw no silks – little trinkets small ear-rings, and round or ovalish silver hollow balls (bulla) set with glass-stones, womens neck ornaments – 2 working jewellers at work making rings much worn by the people men and women here – large square etc. tops set with glass rubies etc. Rock salt in large pieces from and looking as at Tiflis like spar (blue John or black Jack of Derbyshire) – some soap a few round balls and a few oblong pieces like Greek soap at Tiflis – a few little things – blue vitriol – henna – and I know not what – the cakes [?] wheaten and of Indian cord in the womens’ basket did not seem regularly for sale tho’ Adam bought one for 9 paras (he said 10 kopeks but 5 paras = 4 kop. cop.) aside (behind) the great bazaar street women with baskets of such cherries as I bought and little green apples – and one woman with 3 little white cheeses for which I gave 1ab. – the man that came here the other day (was it not our Jew or a friend of his) asked 1ab. a piece for such like – a few horses and cows to sell – for a largeish grey horse (about 14 ½ hands) for these parts the man asked 40/. silver – c’est à rien (said I) and walked off – my nice little about 13 ½ hands chesnut 3 years old colt that I ride cost 21/. silver at Koutaïs where horses are dear – a little cow (all the cows here little) 15ab. = 3/. silver – there were parcels of tobacco leaves to sell – 2 princes were sauntered [sauntering] up and down the bazaar (I now know them from the rest) dirty and ordinary as they seem to us, they looked (when mingled with their scarfs)high above them all – few marchés more interesting to us than that at Oni – I back at 10 10/.. breakfast and long over it, that is eating one and picking out 2 saucers full of black cherries from the rest which gave to the servants – from 1 to now 3p.m. had written out the whole of yesterday and today thus far – dinner at 4 in ½ hour tea and cheese and bread and a few cherries and 2 trout and A- had 6 and a boiled egg – better yesterday and today – her bowels seem right again – R18° in the shade in our cool room at 4 p.m. and in the west window now at 4 40/.. in the sun R31° and F102°   20 July    - A- so long in being ready not off till 6 ½ instead of 5 – no baggage thinking to be back tomorrow night – my little horse not to be found – rode Georges’ saying if my own was not at Oni this evening I should take a days’ pay from the Jew – in 25 minutes (at 6 55/..) cross wood bridge over the Garoula – our company was A- and myself the Cossack George and Adam and a guide from here and the Mourave of Outséré [Utsera] where we sleep tonight – on crossing the Graoula the villages of Sāk-kă-ō (Sakaou, left, and Zeglévi and Tchdrārĭ right) – at 7 ¼ top of hill plateau – beautiful view down Rion, and up (left) Lagomātă Sākāŏ and Skaoora river at bot[tom] (of valley of Rion) smallish bushy Scotch fir, and spruce sides of hill mixed with the other wood – fine air but quite warm now at 7 35/.. maple everywhere and some ash – this should have been noted down before – should have been suffocated here at noon – charming valley de Rion – much corn, bearded wheat

SH:7/ML/E/24/0156

Off from Outséré [Utsera]

and barley and some oats – no Indian corn since near Oni and that irrigated – the Phase Rion as about as big here as the biggest Djedjora – [medlars] common – at 7 55/.. frail, shaking-[?]-[?] wood bridge over Rion deep and rapid and wide as Ouse at York – not quite – ½ way at this bridge and near village of Akiéti [Nakieti] and soon dark – what a pity at Outséré [Utsera] at 9, in the dark – our mourave got us a sâcle to ourselves 9x8 yards – a fire made (on our arrival) in the middle of it [?] us or said George to drive out the mosquitos – nothing in the place this large mud-floored room but a few boards divan-wise large enough for A- and myself to lie feet to feet – our people in the court – shut the door opening on to them and left the opposite one open – lay down at 10 10/.. I took nothing off – very fine day -  

[roman-catholic-mass-readings]

20th September >> Mass Readings (USA)

Saints Andrew Kim Taegon, Priest, and Paul Chong Hasang, and their Companions, Martyrs

on Friday, Twenty Fourth Week in Ordinary Time.

Friday, Twenty Fourth Week in Ordinary Time

(Liturgical Colour: Red)

(Readings for the feria (Friday))

(There is a choice today between the readings for the ferial day (Friday) and those for the memorial. The ferial readings are recommended unless pastoral reasons suggest otherwise)

First Reading

1 Timothy 6:2c-12

But you, man of God, pursue righteousness.

Beloved: Teach and urge these things. Whoever teaches something different and does not agree with the sound words of our Lord Jesus Christ and the religious teaching is conceited, understanding nothing, and has a morbid disposition for arguments and verbal disputes. From these come envy, rivalry, insults, evil suspicions, and mutual friction among people with corrupted minds, who are deprived of the truth, supposing religion to be a means of gain. Indeed, religion with contentment is a great gain. For we brought nothing into the world, just as we shall not be able to take anything out of it. If we have food and clothing, we shall be content with that. Those who want to be rich are falling into temptation and into a trap and into many foolish and harmful desires, which plunge them into ruin and destruction. For the love of money is the root of all evils, and some people in their desire for it have strayed from the faith and have pierced themselves with many pains.

But you, man of God, avoid all this. Instead, pursue righteousness, devotion, faith, love, patience, and gentleness. Compete well for the faith. Lay hold of eternal life, to which you were called when you made the noble confession in the presence of many witnesses.

The Word of the Lord

R/ Thanks be to God.

Responsorial Psalm

Psalm 49:6-7, 8-10, 17-18, 19-20

R/ Blessed the poor in spirit; the Kingdom of heaven is theirs!

Why should I fear in evil days

when my wicked ensnarers ring me round?

They trust in their wealth;

the abundance of their riches is their boast.

R/ Blessed the poor in spirit; the Kingdom of heaven is theirs!

Yet in no way can a man redeem himself,

or pay his own ransom to God;

Too high is the price to redeem one’s life; he would never have enough

to remain alive always and not see destruction.

R/ Blessed the poor in spirit; the Kingdom of heaven is theirs!

Fear not when a man grows rich,

when the wealth of his house becomes great,

For when he dies, he shall take none of it;

his wealth shall not follow him down.

R/ Blessed the poor in spirit; the Kingdom of heaven is theirs!

Though in his lifetime he counted himself blessed,

“They will praise you for doing well for yourself,”

He shall join the circle of his forebears

who shall never more see light.

R/ Blessed the poor in spirit; the Kingdom of heaven is theirs!

Gospel Acclamation

cf. Matthew 11:25

Alleluia, alleluia.

Blessed are you, Father, Lord of heaven and earth;

you have revealed to little ones the mysteries of the Kingdom.

Alleluia, alleluia.

Gospel

Luke 8:1-3

Accompanying them were some women, who provided for them out of their resources.

Jesus journeyed from one town and village to another, preaching and proclaiming the good news of the Kingdom of God. Accompanying him were the Twelve and some women who had been cured of evil spirits and infirmities, Mary, called Magdalene, from whom seven demons had gone out, Joanna, the wife of Herod’s steward Chuza, Susanna, and many others who provided for them out of their resources.

The Gospel of the Lord

R/ Praise to you, Lord Jesus Christ.

————————————

Saints Andrew Kim Taegon, Priest, and Paul Chong Hasang, and their Companions, Martyrs 

(Liturgical Colour: Red)

(Readings for the memorial)

(There is a choice today between the readings for the ferial day (Friday) and those for the memorial. The ferial readings are recommended unless pastoral reasons suggest otherwise)

First Reading

Wisdom 3:1-9

As sacrificial offerings he took them to himself.

The souls of the just are in the hand of God,

and no torment shall touch them.

They seemed, in the view of the foolish, to be dead;

and their passing away was thought an affliction

and their going forth from us, utter destruction.

But they are in peace.

For if before men, indeed, they be punished,

yet is their hope full of immortality;

Chastised a little, they shall be greatly blessed,

because God tried them

and found them worthy of himself.

As gold in the furnace, he proved them,

and as sacrificial offerings he took them to himself.

In the time of their visitation they shall shine,

and shall dart about as sparks through stubble;

They shall judge nations and rule over peoples,

and the Lord shall be their King forever.

Those who trust in him shall understand truth,

and the faithful shall abide with him in love:

Because grace and mercy are with his holy ones,

and his care is with his elect.

The Word of the Lord

R/ Thanks be to God.

Responsorial Psalm

Psalm 126:1bc-2ab, 2cd-3, 4-5, 6

R/ Those who sow in tears shall reap rejoicing.

When the Lord brought back the captives of Zion,

we were like men dreaming.

Then our mouth was filled with laughter,

and our tongue with rejoicing.

R/ Those who sow in tears shall reap rejoicing.

Then they said among the nations,

“The Lord has done great things for them.”

The Lord has done great things for us;

we are glad indeed.

R/ Those who sow in tears shall reap rejoicing.

Restore our fortunes, O Lord,

like the torrents in the southern desert.

Those who sow in tears

shall reap rejoicing.

R/ Those who sow in tears shall reap rejoicing.

Although they go forth weeping,

carrying the seed to be sown,

They shall come back rejoicing,

carrying their sheaves.

R/ Those who sow in tears shall reap rejoicing.

Gospel Acclamation

1 Peter 4:14

Alleluia, alleluia.

If you are insulted for the name of Christ, blessed are you,

for the Spirit of God rests upon you.

Alleluia, alleluia.

Gospel

Luke 9:23-26

Whoever loses his life for my sake will save it.

Jesus said to all, “If anyone wishes to come after me, he must deny himself and take up his cross daily and follow me. For whoever wishes to save his life will lose it, but whoever loses his life for my sake will save it. What profit is there for one to gain the whole world yet lose or forfeit himself? Whoever is ashamed of me and of my words, the Son of Man will be ashamed of when he comes in his glory and in the glory of the Father and of the holy angels.”

The Gospel of the Lord

R/ Praise to you, Lord Jesus Christ.

[xpnsec]

Radare2 - Using Emulation To Unpack Metasploit Encoders

Radare2 is an open source reverse engineering framework, and is quickly becoming one of my favourite tools when picking apart malware or looking at CTF binaries.

I was recently introduced to Radare’s ESIL (Evaluable Strings Intermediate Language), which is a way of representing instructions in a forth like language, and allows emulation of machine instructions in Radare’s ESIL VM. To help understand this functionality, lets look at some examples from the radare2 book:

push ebp

If we take this x86 instruction, we find that it can be translated to the following ESIL representation:

4,esp,-=,ebp,esp,=[4]

I won’t go through the syntax of ESIL, as that isn’t too important for what we are trying to achieve today, but if you are interested there is plenty of documentation available in the Radare2 book here.

If you are a visitor to /r/netsec, you may have recently seen this post from the radare.today blog on unpacking Metasploit's "shaketa-ga-nai” encoder. What I liked was the power of emulating instructions during a disassembly without having to revert to debugging, and I wanted to apply the same concepts to other Metasploit encoding techniques to see just how easy this was.

Starting Easy - x86/countdown

To start with, we will look at the "x86/countdown” encoder, which is described as a "Single-byte XOR Countdown Encoder”. We can find the source code for the decoder in the Metasploit github repo here.

Reviewing the Ruby code from the ‘decoder_stub’ method, we find the following:

decoder = Rex::Arch::X86.set( Rex::Arch::X86::ECX, state.buf.length - 1, state.badchars) + "\xe8\xff\xff\xff" + # call $+4 "\xff\xc1" + # inc ecx "\x5e" + # pop esi "\x30\x4c\x0e\x07" + # xor_loop: xor [esi + ecx + 0x07], cl "\xe2\xfa" # loop xor_loop

This decoder stub looks quite straight forward, it is a basic XOR decoding method with a decrementing key, used to deobfuscate the original payload. Let’s encode a simple payload and see what the resulting disassembly looks like in Radare2:

msfvenom -p linux/x86/exec CMD=ls -e x86/countdown -f elf -o payload_countdown

As we can see, our disassembly matches the decoder in terms of byte values. You may notice however that the disassembly description looks slightly odd, this is due to the way in which the ‘call $+4’ jumps into the middle of an instruction. To stay on track, we can ignore this for now, however "e asm.middle=true” setting will help you to spot these kinds of tricks in future by adding a “middle” comment alongside these kinds of instructions.

Lets set up our ESIL VM and start stepping through the encoder which will help us to understand how this works, and what we must do to extract the raw payload. We can do this with the following Radare2 commands:

aei - Used to initialise the ESIL VM

aeim 0xffffd000 0x2000 stack - Used to initialise a 0x2000 byte stack for our ESIL VM to use

aeip - Sets the instruction pointer of the ESIL VM to our current location

e io.cache=true - Allows modification of the file (required by our decoder routine) without persisting to disk

Once we have set up the ESIL VM, we can check the emulated registers values before we start stepping through the decoder with the “aer” command:

[0x08048054]> aer oeax = 0x00000000 eax = 0x00000000 ebx = 0x00000000 ecx = 0x00000000 edx = 0x00000000 esi = 0x00000000 edi = 0x00000000 esp = 0xffffe000 ebp = 0xffffe000 eip = 0x08048054 eflags = 0x00000000

Looks good, we have a stack and our EIP value is set to our current function. Now we can switch into Visual mode and step through the code to watch the magic happen:

Comparing this to the original disassembly, we can see that we are now presented with a different set of bytes after the ‘loop’ instruction. This is the unencoded version of "linux/x86/exec" payload.

Knowing this, we can look to port this into an r2pipe python script which will complete the following steps:

Set up the ESIL VM

Emulate instructions until we land after the ‘loop’ opcode

Dump the unencoded payload after the ‘loop’

The final python script can be found here: https://gist.github.com/xpn/9dbc8aea2ea53d92f9fca08f0a1e4fa7

Lets do that again - x86/jmp_call_additive

Lets look at another encoder, “x86/jmp_call_additive”, and see if we can apply the same concepts as those above to decode a payload. First we look at the source of the decoder:

https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/jmp_call_additive.rb

We find the decoder stub as:

"\xfc" + # cld "\xbbXORK" + # mov ebx, key "\xeb\x0c" + # jmp short 0x14 "\x5e" + # pop esi "\x56" + # push esi "\x31\x1e" + # xor [esi], ebx "\xad" + # lodsd "\x01\xc3" + # add ebx, eax "\x85\xc0" + # test eax, eax "\x75\xf7" + # jnz 0xa "\xc3" + # ret "\xe8\xef\xff\xff\xff", # call 0x8

As before, we generate our payload:

msfvenom -p linux/x86/exec CMD=ls -e x86/jmp_call_additive -f elf -o payload_countdown

..then disassemble:

.. and finally, initialise and run against the ESIL VM:

Again, we can see that our payload is decoded, and the original payload is placed at the end of the decoder. This means we can simply amend our previous r2pipe python script to execute the ESIL VM until we have passed the final ‘call’ instruction, and then dump the unencoded payload.

The final script can be found here: https://gist.github.com/xpn/83c0b6b45a260d0d24408377ecd8bb55

Something a little more complicated - x86/alpha_mixed

Now that we have the basics, lets move onto something slightly more difficult, the “x86/alpha_mixed" encoder. This encoder takes a payload, and converts the binary into an ASCII charset.

Again, lets take a look at the decoder stub found at https://github.com/rapid7/rex-encoder/blob/master/lib/rex/encoder/alpha2/alpha_mixed.rb:

"jA" + # push 0x41 "X" + # pop eax "P" + # push eax "0A0" + # xor byte [ecx+30], al "A" + # inc ecx 10 | "2AB" + # xor al, [ecx + 42] | "2BB" + # xor al, [edx + 42] | "0BB" + # xor [edx + 42], al | "A" + # inc ecx | "B" + # inc edx | "X" + # pop eax | "P" + # push eax | "8AB" + # cmp [ecx + 42], al | "uJ" + # jnz short ------------------------- "I" # first encoded char, fixes the above J

As before, we generate an encoded payload using:

msfvenom -p linux/x86/exec CMD=ls -e x86/alpha_mixed -f elf -o payload_alpha

As you can see, the disassembly has an extra set of bytes above what we were expecting, including FPU instructions. If we refer back to the Radare2 article in which the shaketa-ga-nai encoder was unpacked, we know that FPU instructions are not yet supported by ESIL, which means we are forced to mock these instructions to have our ESIL VM work correctly.

This is actually a lot easier than it sounds, as in this case, the ‘fnstenv’ FPU opcode is simply being used to retrieve the current instruction pointer. All our mock code has to do is to retrieve the EIP pointer and add this to the stack to emulate this FPU instruction.

Another odd thing that you will notice, is that the final ‘jne’ instruction at address 0x0804808d jumps forward within our disassembly, whereas the source code of the decoder stub clearly shows this should be a jump back into the decoder. This is one of the cool things about emulating code, strange things like this become clear without the need to fire up a debugger.

Again, lets set up our ESIL VM and begin emulating the decoder:

aei aeip aeim 0xffffd000 0x2000 stack e io.cache=true

We first step through the code until our EIP value points to just after the "fnstenv" opcode. At this point, we want to put the address of the last FPU instruction on the stack, which in this case is the ‘fld’ opcode at 0x08048056. We can do this with the following r2 command:

wv 0x08048056 @ 0xffffe000

Once we have mocked this instruction, we can continue on with our stepping. You will quickly notice that after the first round of ‘xor’ instructions, the ‘jne’ location has been updated to something more recognisable:

This was due to the "4a" byte value which was updated by the decoder to "e9" to fit in with the ‘alpha_upper’ requirement, and also explains the comment in the decoder source that we saw:

"uJ" + # jnz short ------------------------- "I" # first encoded char, fixes the above J

Our final r2pipe script can be found here: https://gist.github.com/xpn/da4a497288d6e1ed066d47ff1b2ce2d7.

Hopefully the above gives you some idea over the power of ESIL, and Radare2's emulation capability. If you have any feedback, feel free to comment in the usual places.

[les-mis-guy-supreme]

ROUND 2-AB

[les-mis-guy-supreme]

ROUND 2-AB

[les-mis-guy-supreme]

ROUND 2-AB

[les-mis-guy-supreme]

ROUND 2-AB

[les-mis-guy-supreme]

ROUND 2-AB

[les-mis-guy-supreme]

ROUND 2-AB

[les-mis-guy-supreme]

round 2!!!!

matchups under cut! [round 1]

PART AB

grantaire vs m. fauchelevent

bossuet vs cosette fauchelevent

mother plutarch vs m. mabeuf

robojean from arm joe vs madeleine's guinea pig

joly vs the elephant from the movie

babet vs enjolras and r death scene pool table

the candlesticks vs the bridge

sid story javert vs catherine the doll

PART CD

javert vs bread

bread guy vs sister simplice

enjolras vs chou chou from shoujo cosette

combeferre vs jean 'jehan' prouvaire

bahorel's mistress vs fantine's neighbour marguerite

javert's singular braincell vs bahorel

discojolras from the french concept album vs gavroche thenardier

eponine thenardier vs valjean the nun from 24602 releases a sammich on parole

[les-mis-guy-supreme]

ROUND 2-AB

[tdp-fandom]

RPR: Round 2AB results

About the event · Round 2CD · List of participating ships

Welcome back! Last round we had 72 participants! Thank you all for sticking with the event and casting your votes c: I hope you’ve been enjoying it as much as I have so far!

Here are the results for 2AB:

Click here for the pie charts

(gives % + total votes)

Click here for the updated tournament table

Quick results as pictures under cut 👇🏻

[tdp-fandom]

Welcome to Rarepair Rumble!

About the event

It’s a new TDP shipping event, where rare ships compete against each other in a tournament. Each week, a new round will open and people will be able to cast their vote for their favorite rarepair.

The aim of the event is to have fun, which is why there are some funny crackships in the mix.

Participating ships

There are 128 participating ships (Why so many?), which have been paired up using Random.Org. This step is critical, so I made sure the list gets shuffled up well (here’s how). Also, here’s the alphabetical list of participating ships.

(Please read my note on problematic ships)

Tournament rounds

The tournament will consist of 7 rounds, the first two of which will be broken down into sub-rounds, resulting in the total number of rounds being 11. The participants will have one week to cast their vote in a single round.

Round 1 will be broken into A, B, C and D because of the sheer number of participating ships.

Round 2 will be broken into AB and CD for the same reason.

Rounds 3-7 will not be broken down.

Here is the tournament table:

(bigger version)

After each round, I will publish the results as a text post on this blog and enter the winning ships’ names into the table above.

Starting from Round 3 (which means, after Rounds 1A, 1B, 1C, 1D, 2AB, and 2CD) I will make a smaller, more manageable tournament table.

The voting

I will create a separate google forms document with competing ship names and pictures grouped in two. Here’s an example:

You will be able to choose one of the two competing ships which you would like to get to the next round of the tournament. If there’s any pair where you don’t like either of the ships, you can simply skip it.

Fan activity during the event

This blog will not host any fan content of rare ships. Any fan content (art, fics, meta, head canons, cosplay, etc.) related to any of the participating ships will be reblogged by @rareshipshack​.

If you want your content reblogged, you can @ that blog, because not all posts tagged with “rarepair rumble” appear in the search.

What happens at the end?

We vote for a winner and I will make a list of rarepairs according to popularity (as ironic as it is). I will also try to draw some of the top scoring rare ships myself.

In case you have any questions

Please contact me either through this blog or on my main @avtoservis​

I’m also on twitter as avtoservis3.

Happy shipping and good luck to your favorite rarepairs!

Lumi