Looks very interesting! Presumably this wouldn't just work directly with osquery due to a ton of code being gated by compile time flags?
t
theopolis
12/28/2020, 7:23 PM
It definitely won’t work
t
terracatta
12/28/2020, 7:53 PM
One thing they don't cover here is compilation time. I wonder if there is a big difference compared to a normal C executable.
terracatta
12/28/2020, 7:57 PM
oh wow the hack they use to make this work is actually hilarious
terracatta
12/28/2020, 7:58 PM
it all hinges on the fact the original Thompson Shell was written before shebangs were used. So you they can format the first bytes as a windows PE with MZ