Looks very interesting! Presumably this wouldn't just work directly with osquery due to a ton of code being gated by compile time flags?
t
theopolis
12/28/2020, 7:23 PM
It definitely won’t work
t
terracatta
12/28/2020, 7:53 PM
One thing they don't cover here is compilation time. I wonder if there is a big difference compared to a normal C executable.
oh wow the hack they use to make this work is actually hilarious
it all hinges on the fact the original Thompson Shell was written before shebangs were used. So you they can format the first bytes as a windows PE with MZ