From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Wed, 24 Jun 2026 10:57:20 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-qv1-f63.google.com (mail-qv1-f63.google.com [209.85.219.63]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 65O8vJkx029588 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 24 Jun 2026 10:57:19 +0200 Received: by mail-qv1-f63.google.com with SMTP id 6a1803df08f44-8e0dfafa41fsf17517196d6.3 for ; Wed, 24 Jun 2026 01:57:19 -0700 (PDT) ARC-Seal: i=3; a=rsa-sha256; t=1782291434; cv=pass; d=google.com; s=arc-20240605; b=dYvosv2GbAKTPEVrz5ujTK4haP5a2tkeryx5crkXNxFPZDftajhOGd5QQUoE6Q8+ft 9aFYZMn4fTNM5Mi90sxaMXT4DH9X9SFgYikk8/AYycc9c+fbW2CWvneRSZY1K0xfBIek 0/qYgZdHSUTaP72kUISOcpfimikyRiYG0mnfC5EVds4TUqQgXZT0g2lhcQqvaM0ZdWQ+ vPvlnyLSJrdkORn/uEwRH8jSiooxUrqTdyc6Alxfsj+PGl7CR1jWyClk8LzY3SWjkMvW 5Bo8/hFRqqRJ9rVYZXTPzzF0vLrOZJhMLaXaLEkGod0vcTI/oid1xOzR92NmdCIORj1T gQuw== ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:to:subject:message-id:date:from :mime-version:sender:dkim-signature:dkim-signature; bh=58lnxYpGq1Q+pwvkB8bEB2Doj5paVTE0tYLZhDQshZI=; fh=xn19lvgcJVnY3USM7arGatwo4yPUKjJ4jd6fdXYVir4=; b=Gn/k4LuEhlrfKioyfx2sOIEu8T7r6vc1D2cmKaPbUvAiYrrJR5pVxZh3ip1w4eAh5P wxlQwL1SzL0dqRvPohKZP95MObscAvh+0h/gNxfbZOwLIQdba+ztxF1jA9NLVvbuf2Km XgfGsfuh9MO1lPkRkX8syg2bOLtkqYAIVC9bSwhSqnc+1YrJg2WgXNnVpBpBlkuZ90Zf ox1jRbcpDnRFETd4p2tonBkgHzlU2f05xuH5RDeXBKmrUvbs4QMqf3HjOLDGDUT3L/2u 4NdjoJyqi2BzmtSuCJyg9nrUrokmW94Rg533nndYVGMlrxgTcdXr6OQWR8FAyBLLRdcc V9vg==; darn=ilbers.de ARC-Authentication-Results: i=3; gmr-mx.google.com; dkim=pass header.i=@gmail.com header.s=20251104 header.b=OaPrQXcx; arc=pass (i=1); spf=pass (google.com: domain of roberto.foglietta@gmail.com designates 2607:f8b0:4864:20::b135 as permitted sender) smtp.mailfrom=roberto.foglietta@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com; dara=pass header.i=@googlegroups.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1782291434; x=1782896234; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:to:subject:message-id:date:from:mime-version :sender:from:to:cc:subject:date:message-id:reply-to; bh=58lnxYpGq1Q+pwvkB8bEB2Doj5paVTE0tYLZhDQshZI=; b=hR92Pfu4pvH2NWgJ8PZVd2+yCBiKYN8gBvBK0IKb18c1C8nunlJsNsLP8R5UOrhNbA mjK8J9e8FPzzX9zAHdk3wbDjtE0fykq9Hk2WKtYn2dy5a9U6KStyIs6TMHL6gLkETZ4R TokkTEH9aewyay29ZAUNjsKNgsO7NKF8jHBLqRIt9i1WvG5xv/azTpdTFCwhgTjsWedj vOvnwMWsxcD+pDV8EMcoUfRSl6nk7HJg06PU9Y74ssntGV5tp+cWY5ljQLiD0LCeTDqC Q8fK/2z184Mnq88FUWhAa7PDTLQS3zEblLrXMqEzWqgdgdFNOci890/0m9pZWtWlcAJI aqUQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782291434; x=1782896234; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:to:subject:message-id:date:from:mime-version:from :to:cc:subject:date:message-id:reply-to; bh=58lnxYpGq1Q+pwvkB8bEB2Doj5paVTE0tYLZhDQshZI=; b=n6EJlLptc5uUdZdarBVz+RVZutC6vixl4L9RYAazXvLHkgi55trED0mHQ1oNRhO47r CczsoQvhBzeXLJJbylUqJsY7cs5H/6qq7CuBh4IqLUhe85+Q4W3l3eIgh2PUAY7hirQ6 FCaunsRH8RyJjyJrNf+tdB8OfuqyLun1q4le4o9sNF7UH7JC9/3CVbATzR4ZVWMOk0wj s/q+ZNX8YzQRVidrcb3kGHqJrdnIc+dvTCBNZx+iMpjIPzVG9+8kkaq4uoyvXb0TkZAs OYxJZ5eC54sSm818R64sjwYlX5upHNOwHsVkJoL3wjHlHvXndRDEX94j5U/8xECvIxzu Q8Kw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782291434; x=1782896234; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :x-original-authentication-results:x-original-sender:to:subject :message-id:date:from:mime-version:x-gm-gg:x-beenthere :x-gm-message-state:sender:from:to:cc:subject:date:message-id :reply-to; bh=58lnxYpGq1Q+pwvkB8bEB2Doj5paVTE0tYLZhDQshZI=; b=Sf1PHJSEdb1VyeKDWvCTT0IFPCyQtfHHswhVMOtTAJ9vVthT2ML9APp92d/scsLCGp 49vEVR/a+IKYUcjsHL+mFV4aWJOJ2CpbeHfdyxvStnQimN7PiLZcflKhi/lTOMc2uAy9 7N0ZVRMW2nbpgPnAetJT9jpdCAg7kYkqz/I77qMrEVLh4JKzKQzaG0w0TS69P0NWcndW ozwM1apvDHVs3PG03m187Tg4hAOysCW+mD7YIrLoYpIXVAxLr2SgaVDIptPYDALZV0VT Hi6x3ruAamfZaISoZLvbq1bBNQNG30xrhX22r3QshUTcBvUkJnT+aORHHs1FnfMR+92X YQCA== Sender: isar-users@googlegroups.com X-Forwarded-Encrypted: i=3; AHgh+RpuPApYGllcEI1ufmnDS2JB+EjvIQOGciFQknT37+mc7+Y0sZEufkITyc+hQey+B3SoAvY9@ilbers.de X-Gm-Message-State: AOJu0YyrG1mL0fFqTQ8GawGFA0c7i+1uLHF/C51vL4vfBoRlLUwtqmyt 8+KOtoLf4C3EmVrsFGYGbZq5ixqF98cgx5k+oWm6OwnshyTZdoRyHBSZ X-Received: by 2002:a05:6214:5913:b0:8dc:2c21:32bd with SMTP id 6a1803df08f44-8e5331380fcmr40248096d6.1.1782291433431; Wed, 24 Jun 2026 01:57:13 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="AX0PUUcrxEpZS/ucrPVTYn7fXHvIkrXK4LNjY2A3ALVIwZoIew==" Received: by 2002:ad4:5ce5:0:b0:8ce:adbf:4fda with SMTP id 6a1803df08f44-8dce0bada1els29599436d6.2.-pod-prod-07-us; Wed, 24 Jun 2026 01:57:12 -0700 (PDT) X-Received: by 2002:a05:6102:5049:b0:650:94b2:b209 with SMTP id ada2fe7eead31-73112dbd0eemr1003711137.4.1782291432337; Wed, 24 Jun 2026 01:57:12 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1782291432; cv=pass; d=google.com; s=arc-20260327; b=ryU6ohZv60DUi1iO8XYOEigEIXjyu+CbS8Rzj7VaklYU18bFIE2n6XHhY20aFVjTgn A9xBPXtufc68cqPOWRrdNjljo/iQ0IK8JXJOBUPrBxqFliYKfGLt3uWkGMVmTIj9n88j HYl+E/bL6faDELIm2Nrxv0m6myXxTQ9kzfNU9KBbYxAy8C5EQDiX7bUK3x/m9CilvB9o Ik149Wl1WZxJW7qxLhOtHpBTrwpIvuRSYqV4+DVIEfizikPMxYdxp2fx4gF3MmPCsWnY m3RN2yiGnDg4EU+RnEf/TK0TeZp0cEwRzTwavPtQiO9DIFQbhvaNu0hHYzoJJ6I81/BW GqCw== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=to:subject:message-id:date:from:mime-version:dkim-signature; bh=AfTOFusDV1wMDF5eqRTMUQP3g4KZUJCQlz/yzAYPqvk=; fh=hOBXq6nisExkIRIwN8IDOmOCLKwX8PM0ANlxQbNMEqA=; b=K8jE1BPpMqTVB/zRwDA3jOPMD6byRKNRfL9WtPcvjUtZRcVuJiDtFskMY9Ntou7Cx6 egzVtH+fsoGkQXSJ7Cu/3d0o/X3Oq7iVsJr7aoYO0mGXnrSS/g6QadAgBdxm3kwZs4oG 7AWknl0qz/VKvRnAUJY2d1PidDkfoECSMxP+ymihBrpPqrGy33iPgwKluRrndRmaVOyb vVEcPj3jrO0nj3bTTlPlwXtvzQfP67ycDu3KRp6c9RxyMNdm/iBk6NTV3yuBuxAqcJhq gqEozqYQnAhlDs9TY1QefW6NiysvBxdmeJkt5CXtKr41ohkTvJ7niPZaCGTfeoDSjHAw wCrg==; dara=google.com ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@gmail.com header.s=20251104 header.b=OaPrQXcx; arc=pass (i=1); spf=pass (google.com: domain of roberto.foglietta@gmail.com designates 2607:f8b0:4864:20::b135 as permitted sender) smtp.mailfrom=roberto.foglietta@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com; dara=pass header.i=@googlegroups.com Received: from mail-yx1-xb135.google.com (mail-yx1-xb135.google.com. [2607:f8b0:4864:20::b135]) by gmr-mx.google.com with ESMTPS id ada2fe7eead31-730ded80faesi77999137.0.2026.06.24.01.57.12 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 24 Jun 2026 01:57:12 -0700 (PDT) Received-SPF: pass (google.com: domain of roberto.foglietta@gmail.com designates 2607:f8b0:4864:20::b135 as permitted sender) client-ip=2607:f8b0:4864:20::b135; Received: by mail-yx1-xb135.google.com with SMTP id 956f58d0204a3-662bcc30fafso738926d50.2 for ; Wed, 24 Jun 2026 01:57:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1782291432; cv=none; d=google.com; s=arc-20240605; b=DnsSLoL2v3+wL7iONX0cT/NG31pw+PBhUx98f8TKytWVdrqqE3Cf4nf2s/LQ0CiWiN Rp73q9nlMkAGbWFWpqIKUJ06bqgOoGz/BCHTOXdEaJKCLRsJGoHAfQIR8MyzN9sZduPE Cay3fjUWzAcr8+RV7ESinFgy+Bz3KI7KRO7hzGaPo49fYDtTyqV51IWV9trJjmjy6dBd KdUk4kDkjIBDn36+dLn7rM/6LIp0uvv6dmuynpFidrp3HKj4IHrZq9hlk+/ME1Bep6E1 JH0S7luZGmGo+4XwZ66o9l9aIki3s7iwoOfjfUPxJDJMsDzVPfVIHVBfcLUKno/c/U3y FHlA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=to:subject:message-id:date:from:mime-version:dkim-signature; bh=AfTOFusDV1wMDF5eqRTMUQP3g4KZUJCQlz/yzAYPqvk=; fh=hOBXq6nisExkIRIwN8IDOmOCLKwX8PM0ANlxQbNMEqA=; b=lPRj3Zb9WJei0Tm2tWFZCCclb0r/GEeKpVpkk4z9CHyxZgBahFk8D5T4dJomrxasMT +fllE+tWyFcJEmdbGaoBWIOJEUHQGI6Zo9W8R59DRDJ26sOVt4Qi/MVaQ5pSSfMUJMud UTSCM1zZu9FGjgr5ypOE5gnw9E9bz2G0iv9zsQ9RWrv690iCllFj6FSpGeEcAXoX84AW 1NwBsj8dUyWhBtPMQissXiRYkUmQh/+jQG7zLZ00Vh8/u4Izj42oTgD8KelvKUb4omOg 53tL43Q7It3Z8GTUdVqGV36aLdFf9whu32x9sZ3lf0F/OGPQr/HP3f44KjaH3fnNlq7R eMVA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; arc=none X-Gm-Gg: AfdE7ckZ1UCnAToUF94lPDg9oFLHD4aU4Zqad6cT3JLTQ2X8hjow9vh2P4ywEfGVIA6 tn192+0c8nXyL6rUSWrVqPAhGDvD8BSF2AOe2SUyy4BGlHC3ghjwncpyQRxsJI1BhE6qk0wsf6x 22InzusFSQlXk11bqDIjU2WndUk1Su5DKHGTNBauFcyJQHfW6sjGNDzgOZqMG0w+U5M415pcTj6 4cBxDw0L+cgEN2cYU3glkfBWK7SRwvoH9R4AoRJxeE9Cm7LhwpLkzNL/whHpaneMLeX3LuMti2a m82EpX9z7YDc3vg2dX+PWbdRnKPxSBwFImIDb6RQCy0ig9z6EczL9L1wVM8Q0Cv+Xx57g53ycTu 97P8SlSZ9u3BaUVTwdb4XSB3kP8rUe6flSq8vXkxGWGGns7c= X-Received: by 2002:a05:690e:4196:b0:663:122a:e13b with SMTP id 956f58d0204a3-6636e2a115amr1916438d50.1.1782291431747; Wed, 24 Jun 2026 01:57:11 -0700 (PDT) MIME-Version: 1.0 From: "Roberto A. Foglietta" Date: Wed, 24 Jun 2026 10:56:35 +0200 X-Gm-Features: AVVi8Cf_NFTiVmj92pzqjcatUV2wQJHi9FhvYn_u7iGBZsLsguPDdTS9oupuqAQ Message-ID: Subject: OT: A self-extracting executable tiny ELF32 payload To: isar-users Content-Type: text/plain; charset="UTF-8" X-Original-Sender: roberto.foglietta@gmail.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@gmail.com header.s=20251104 header.b=OaPrQXcx; arc=pass (i=1); spf=pass (google.com: domain of roberto.foglietta@gmail.com designates 2607:f8b0:4864:20::b135 as permitted sender) smtp.mailfrom=roberto.foglietta@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com; dara=pass header.i=@googlegroups.com Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-3.7 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DKIM_VALID_EF,FORGED_GMAIL_RCVD, FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-TUID: 8TqfLXdcyERq # uzpexec https://github.com/robang74/gzcmd.sh/blob/main/README.md#uzpexec > [!NOTE] > > Suggested file extension: **`.uzp`** Utility for executing an ELF binary directly from stdin pipe: - it runs binary via SSH/wget - it runs gzip compressed binary - it self-extract and execute without writing it on the remote/local systems (memfd_create). ```sh make clean tests ``` The [uzpexec](uzpexec.asm) (micro gzip pipe exec, written in Assembler) replaces the previous `upexec` comparison which offers as extra the integrated support for `gzip` inflate on the standard input pipe. Pre-compiled v0.68 elf32 available [here](https://github.com/robang74/working-in-progress/raw/refs/heads/main/uchaosys.qemu/uzpexec). #### USAGE - `{ cat uzpexec; gzip -7c $elf; } > $elf.uzp` - `cp uzpexec $elf.uzp; gzip -c $elf >> $elf.uzp` - `wget $url/$elf[.gz] -O- | uzpexec [args]` It works as a single block 512-bytes self-inflating executable payload replacing also `gzcmd.sh` with the sole requirement of `/bin/zcat` available. --- ### Quick customisations Quick customisations by `sed` and other stings-based editor is supported: - `{ cat uzpexec | sed 's/zcat\x00/xzcat/'; xz -7c $elf; } > $elf.uxp` Alternative to `zcat` are `xzcat` for XZ compression, or `lzcat` for LZMA. The alternatives that are natively compatible with `-f -` are fully supported. ``` ; ===================================================================== ; COMPACT DATA SECTION (Appended to code) ; ===================================================================== copy_vers: db "(c) 2026 robang74 l.MIT v0.68 git.new/ttRvFBu", 0 ; filename can be changed by sed up to 7 chars + ending \0 ; zcat -f is cat when input isn't gzip, options up to -6c\0 ; /bin/zcat can be changed by sed up to 31 chars + ending \0 ; - for example: /usr/local/bin/xzcat is 20 chars + ending \0 ; eof_strng helps to find the EOF, and where \0 padding starts filename: db "uzpexec", 0 zcat_path: db "/bin/zcat", 0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0 force_arg: db "-f", 0,0, 0,0,0,0 dash_arg: db "-", 0,0,0, 0,0,0,0 eof_strng: db "elf_eof", 0 ; ===================================================================== ; PADDING: Aligned exactly to 512 bytes (as per skip request) ; ===================================================================== file_end: ; Physical end of the binary file! times (512 - ($ - $$)) db 0 ; Padding to 512 bytes for skip=1 ``` Since `zcat` is a shell script, it can be changed to pair the input with the proper decompressing tool. While a tiny `xcat` binary in ASM would be much faster in properly pairing the matches. Best regards, -- Roberto A. Foglietta +49.176.274.75.661 +39.349.33.30.697 -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/CAJGKYO6ak7TT1OKcYHFmomJnRt_2ovEUfLENa5SOYPh0%2BNY6jg%40mail.gmail.com.