#my header ees better
Explore tagged Tumblr posts
Photo
A match made een heaven @aileen-hollingsworth @prince-cole-schreave
8 notes
·
View notes
Text
thank you @communistcharliekelly 4 tagging me!
1. why did you choose your url?
bc its a funny response to ur friends making you a bird with teeth sculpture
2. any side blogs?
i have a main! but it v boring and i wanna keep it separate bc of irls who follow me there lol
3. how long have you been on tumblr?
since early 2013 i think
4. do you have a queue tag?
not rlly if i queue somthing its just the letter Q
5. why did you start your blog in the first place?
I rlly like sunny! i saw some fanart and realised there was a bigger presence on tumblr than i thought so i wanted to join in :)
6. why did you choose your icon/pfp?
charlie boy looks so soft in the pic...and they are nb so.
7. why did you choose your header?
bc im funny and the gang is gay!!
8. what's your post with the most notes?
im p sure its this one. Fair I think
9. how many mutuals do you have?
like ab a dozen? ish? for this blog at least. i cant wait to get to know them better and be buddies :) (w those who wanna)
10. how many followers do you have?
126
11. how many people do you follow?
463
12. have you ever made a shit post?
yes. all the time ajsshdg
13. how often do you use tumblr a day?
it rlly depends? like on average 1-3 hours a day but dispersed in segments
14. did you ever have a fight/argument with another blog?
in my younger years i would reply to hate mail for my scott pilgrim opinions akdhfhdhd
15. how do you feel about the you need to reblog posts?
very silly lmao
16. do you like tag games?
Yes I do! Sometimes I feel anxious about who to tag tho, I don’t want ppl feeling left out
17. do you like ask games?
Love them! I’m obsessed with answering questions esp about my opinions lol
18. which of your mutuals do you think is tumblr famous?
Well Newt (who tagged me) has that trans up meme that’s at like 50k or sumthn if that counts lol Other than that? I have no clue
19. do you have a crush on a mutual?
Nope! Def happy 2 be friends tho :)
I’m gonna tag @anon-ee , @deereynoldswife @dumbbitcho and @ocularpatdown and anyone else who wants to!! ill even add ur tag if it makes u anxious
#feel free to ignore if you like tho haha#tag games#I bolded the qs bc it was straining my eyes lmao
7 notes
·
View notes
Text
I lost all respect for Derek J Wyatt when I first went to his Twitter and saw he had "Functionist" in his bio plus that Sentinel prime header. Then I just uninstalled when he retweeted Blit//ee.
My mental health has been better since.
#transformers animated#tfa#my bullshit#is it satire?#please tell me if it is#bc that header really gives me bad vibes
9 notes
·
View notes
Photo
In Plain Sight
Story: Non-canon. A soulmate AU of my own creation, where soulmates dream of their future with each other, but wake up with no memory of the event. For the lucky ones, simply seeing a person can trigger their memory, but others they need a specific voice, touch, or other sense. Sometimes in combination.
Story + Author’s Notes under the cut (because it’s 2000 words almost) And I’ve been warned not to do this but thank you @blametheeditor for the inspiring idea that started this out!
Also the header is Your Name because it’s kinda Soulmate purity...and I made no art so..
Going out on a coastal walk that turned into around a few hours of hiking left them both tired and sore, so when the idea of using his chest as a heat pack was presented there was no way it would be denied. Sure, Seto did most of the tough walking with Jewel being able to perch on his shoulder, but every so often she’d choose to walk alongside the black Converse that sent thumps like earthquakes and threatened to make her fall.
They'd been friends for so long, and been getting a little closer over the years, so the action wasn't too far out of either of their comfort zones - otherwise, it wouldn't have gone down too well - even if they weren't Soulmates. As soon as the Anhemite stretched out on her best friend and realised how comfortable he was, there was no going back.
[b] "I never took you for a cat, Jewel."
The Japanese man had commented, to which she punched the floor beneath her and rolled over a little so she couldn’t see his big dumb eyes, focusing instead on the feed he idly scrolled through and searched for anything interesting. It was boring, to say the least, but at least the Anhemite wasn’t walking anywhere.
As Jewel found her body relaxing to the point where moving anything besides her eyes felt like a chore, she wondered about the possibility of her Soulmate visiting her tonight if she did sneak a cheeky nap on the giant. The rush of fear appearing at whoever it was thinking that she and Seto had abandoned what was tried and true and forged their own relationship - leaving two people alone without the hope of love - instead of seeing them as the best friends they were.
Because the giant laughing along to a video of someone accidentally exploding their backyard was her best friend, no Soulmates here. Or…to be honest, they should’ve figured it out already.
In their world, a Soulmate was a physical being that anyone could find and live with, in harmony with each other, showing and receiving the love and support that anyone would need. The perfect match for any one person.
The only problem was, she could only be with her Soulmate while he slept, and the same for whomever her destined partner was, as soon as one of them awoke, the connection was broken. The dreams started sporadically for everyone, but once you got one, you were bound to get it again. It was roughly two weeks from one dream to the next. One night where you and your soulmate connected through sleep, and you could see your future days together and faint memories of the waking world around them.
And, of course, the cruel twist was that she couldn’t remember who they were or what they did.
Jewel remembers more than most; being close to them somehow, and there was something to do with a captain, but any specific features of their face are a blur. She doesn’t even know if they’re a man or woman. Déjà vu was her only chance… getting the sense that she’d seen something before. And even then, she hadn’t sparked in a while.
The Anhemite sighed as she pushed herself up, arms shaking a little from exertion before she managed to stand, brushing her hair back as she took one step only to have a hand block her path.
“Where are you going?”
Seto cocked his head down at the figure, once so calm and happy and now seeming like something was bothering her without him saying anything in-between. A poke to her side has his finger claimed, the digit curling around like a friend’s arm in a hug in the want to know what was wrong. She wrapped her arms around it, looking down as she rocked on her feet uncomfortably.
“Just…thinking about Soulmates. If I went to sleep and mine saw me with…well you.”
“They’ll know we’re just friends. And if they’re /that/ jealous of me without knowing me than maybe they aren’t the right one for you.
“Or…”
The giant only rolled his eyes as the rest of his fingers curl around to hold her tight, phone turned off as his other hand came beneath her so she was not just dangling when he lifted her up to his reassuring brown gaze to see her better, back against the arm of the chair instead of lying flat. Watch the sharp features break into a smile as she looked over the expression almost too close to be read with a pout, trying to determine what Seto’s thinking.
“Or?”
“Or I stick a sign on me that says ‘Don’t Worry, I’m Her Friend’. And ‘you have to be soulmates with both of us’.”
He finished with a burst of laughter, recoiling from the tiny slap to his nose as Jewel wriggled out of his grip to jump onto his shirt, grinning up at the giant looking bewildered at his empty hands. Jewel attempted to scramble her way down and away before hands fell from the sky and attempt to pin her.
“My Soulmate is mine.”
“Fine. But, what about your DOMS?”
At that, a treacherous fold of the shirt sent her tumbling headfirst down his chest, yelling out as she rolled and her tender muscles thumped painfully against the ground.
When the human finally stopped, her legs were in the air and she frowned up to the looming smile that shone like the sun, huffing as the fingertips pinched and righted her. It didn’t take long for the bravado to melt as she rubbed her aching calves in an attempt to soothe them
“My DOMS tells me to stop moving…” Jewel groaned, gritting her teeth as Seto scoops her up once more only to press her into his stomach, lying on top of a hoodie pocket she had made he perch too many times. She gazes up to find the smile is no longer so triumphant and is more concerned. Displaying the man who would always take care of her.
“Then you snuggle up here, and let me massage.”
The Anhemite tapped her chin as she thought it over, before stretching out and nodding. She’d never really done this before…the idea of being massaged by him was something new, but something she was eager to try to get rid of the pain. Maybe it was because they’d never hiked together, or she never really got too much pain. They met and for a long time it was just talking to a fence that separated their borderline districts, then calling and texting, then finally seeing each other.
“As long as it’s not the Ancient Technique of the Drumming of the Fingers.”
A hurt look was displayed as Seto moved his hands closer to her, pretending to crack his knuckles before gently tapping her back with his thumbs, looking for a tight spot. Definitely not ignoring the look that says he’s just drumming his fingers, inviting the woman to wait a little bit. He didn’t want to touch her legs or anywhere that he thought she’d object to, and once he’d found a spot that seemed tense, gave it some pressure before dragging a bit down her back. Jewel only yawned up to the giant looking expectant.
“What is this, the-“
“Ancient Technique of the Patting of the Cat.”
“Thought so.”
There were no objections, only a content sigh that said the combination of heat and massage was quite soothing. So Seto continued, feeling the tension slowly disappear as Jewel relaxes and the pain leaves her, stroking the one spot before he moves on to her other shoulder blade, slowly massaging the tension of the day’s exercise away. The motion is continuous and slow, allowing the Japanese man to relax and stare up at the ceiling, thoughts on what his smaller companion had said about Soulmates.
He too had one, and he too visited them in dreams, as everyone did. A few times in his life he had thought he felt the spark of a familiar face, a familiar voice but every time it seemed he was mistaken. Told that they didn’t match any of the other’s dreams, that they had already found their soulmate…or that they weren’t even looking. Man, woman, older, younger, it already seemed like he’d been through it all on his search for the person of his dreams…it always seemed like he was dumped to the curb after every rejection.
But Jewel was always there to listen to his 7th first date that consisted of nothing more than a mumbled “Hello, I think-“ for the other to turn him away. It was why she made him forget about Soulmates sometimes, and appreciate the friendship he already had. Even now when he heard her quiet breathing, the occasional chuckle from her hidden thoughts, that’s all he needed. To mess around with her just like the good old days, when no-one cared.
He was relaxed too, sighing as his worries disappeared like they always did when she could distra-
Something sparked. Like a beacon of fire was lit in his memory, triggered something to shoot a memory from the fog. Have it processed into a conscious thought that made Seto blurt:
“I’ve done this before.”
[i] A thumb stroking her spines...
Jewel raised her head hearing a rumbling murmur from up above, finding Seto staring straight ahead like a deer in headlights, frown creasing his brow. The massage had ceased, his thumb resting in the centre of her back like two blankets had piled over her.
“Hmm?”
The giant doesn’t say anything, watching everything come together like a picture behind his eyes. Appearing like a ghost at a bedside that holds a human-sized woman, and crouching down beside her with his chin on the soft sheets just to see her face. Wide eyes blinking at the sleeping form as he gingerly pushes at her shoulder, seeing it has no effect. Laughing and commenting that she shouldn’t have eaten so much.
Being with her those quiet nights, and her being with him. Running his finger over her back and feeling bumps, like spines, running right down the centre. Seeing her stand before him with wonder, looking up as she blows a kiss before going to work. Eating dinner as she tossed a noodle.
B-But…they were friends, not Soulmates. They didn’t kiss or sleep together, Jewel only really liked to lay on him when she was tired. What if this ruined everything they had painstakingly created; the trust and the familiarity and the feeling like they were there for each other as comrades in a war.
But he’d found her.
But she clearly hadn’t found him!
No.
Yes.
No!
“Seto?”
With a blink Seto snapped out of it, looking down to see the form beneath his thumb starfished out on his stomach, not-so-gently tapping his thumb to tell him to get on with it while half-lidded green eyes stare up in confusion.
“Shh, go back to sleep. I’ll tell your soulmate how it works when he gets here.”
The giant hides the pure joy when Jewel flops back down with a smile, a weight he never knew he had lifting off his shoulders.
Because she enjoys being stroked by him.
And now Seto knows it’s all he ever dreamt about wanting to do.
Author’s Note
Alright, my AU might not be the /best/ but I really love it with the Seto and Jewel being friends when I’ve written them mostly about Sewel as a ship. The idea I had for why Jewel never actually noticed was that her dreams started after she met Seto, and they had time to become friends before she began to drift a little because of longing for a Soulmate.
His face would be so familiar to her by them, any time she might’ve dreamt about him she’d write it off, because they were /friends/ and it makes sense that her brain might stick him in there.
But otherwise, I hope you like it!
4 notes
·
View notes
Text
“Get to know me” meem
i didn’t mean to mistype meme but it’s funny so im leaving it.
Rules: answer these 30 Qs and then tag 10 blogs you want to get to know.
Thanks @sapphicidiot for sort of tagging me
Nicknames: just a couple variations on my name but i go by Vincent online
Gender/pronouns: im just a dude he/him
Star sign: capricorn but im not a capitalist
Height: 5′9″ lol (175)
Time: it is 7:30pm
Birthday: Jaaanuary 11th
Favorite bands: the national, kero kero bonito (i absolutely love their mission, message, and style!!), made in heights, the paper kites, Language
Favorite solo artist(s): gregory alan isakov, dua lipa, jonsi (!! its been years and i never get tired of his album Go), does claude debussy count? lol and ravel
Song stuck in your head: True Colors by JT and anna kendrick from Trolls (no i have not seen the movie and i hope i never do) bc i almost sang it for choir with a friend but we changed the song to I See the Light from Tangled which is a million times better
Last movie you watched: God’s Own Country and it was AMAZING i can’t wait to show my sister. Definitely worth ordering online before seeing it. im glad i have a copy so i can longingly stare at the case on a daily basis
Last show watched: um. danganronpa 3 like a couple weeks ago lol
Why did you create your blog: i had heard tumblr was a funny place so i made an account lol. this was six years ago
Other blogs: mmmmm confidential. but if u want to b friends on steam or something or you want my instagram or spotify message me and ill be happy to oblige
AO3: isnt that a fanfiction website? I don’t have an account on it.
Do you get asks: occasionally, yeah. I think it mostly depends on follower count and what types of things you post. I’m not tumblr famous but i get an ask every week or so on average and i love them
How did you get the idea for your URL: i saw part of a tumblr blog a couple years ago that either had a similar url or a blog header saying “graveyard botan” or something, i didn’t see the whole thing (hence “botan”) but i immediately fell in love with the phrase “graveyard botanist” and went to see if that url was available and it was. i dont think of it too literally but it has a cool sort of aura to it. flowers in a peaceful grassy graveyard.
I follow: i mean, you’ll know just looking at my blog. there’s no specific type of post i never reblog from my dash. mostly its silly stuff, memes and nonsense, but there’s some philosophy (mostly from perkwunos) and some literature/quotes/art (a couple of these blogs i absolutely adore and should find more like. in fact i found God’s Own Country thru one of them) as well as some photography.
Followers: a few hundred but most are inactive i think since ive had this blog for years
Average hours of sleep: uhhh like 7 or 8 on average. Which is good ive been conscious recently about sleep
Lucky number: what is a lucky number
Instruments: BOY i LOVE music, im mainly a singer (studying music ed next year!!) but i also play piano and some ukulele occasionally. i would love to play viola someday
What are you wearing?: just shorts and a t-shirt ¯\_(ツ)_/¯
Dream job: bitch being a conductor!!! i love music and i want to conduct a choir or a symphony (might have to give up that dream bc tinnitus but we’ll see)
Dream trip: florence, italy. take me to the uffizzi. and then to the louvre in france.
Significant other: i wish, god
Last book I read: im horrible, ive read way fewer books this year than usual but im almost done with Zen and the Art of Motorcycle Maintenance right now. and a collection a ee cummings poetry
Top 3 fictional universes: Inheritance (Eragon.... I love that magic), MapleStory, and uhh... i don’t know much about this because i haven’t read it all but there’s a webcomic called Everblue and there’s a floating city on the ocean and somehow the idea of an endless blue ocean is very deeply compelling to me. So, that.
i usually tag a couple people but really just do it if you feel like it this time. go on
#vincent#i know im long-winded!!! i hardly ever just give normal short answers#but hey it's me whatever#these are fun to fill out#it gives me a better sense of identity and i just like completing things like this.#i might make my own some time with different questions. bigger questions
2 notes
·
View notes
Text
Journey to the end of the line
Web Authoring Blog 8:
So the web authoring journey continues. My last blog was not my best work, I’ll continue to blame tiredness. Maybe it’s arrogant to say this but I feel I had to work twice as hard as some just to get the assignment done. But maybe that’s unfair on others who worked really hard on the assignment too. Just I really had to put in the work. I was struggling with HTML a lot. I remember Gemma said it’s like learning a new language, in which I had to inform Gemma that I got a D2 in ordinary French in my leaving cert. So in other words, languages were not my strong suit. I may have said this story in a previous blog. Anyway the point was, HTML was a struggle for me. But I know that achievements a in life are down to both natural skill and hard work. Which aspect plays a bigger role in each ones achievements is down to the person I suppose. For me, this one was going to have to be some good old fashioned hard work. Anyway, Most of this was discussed in the last blog but I said I would go into a bit more detail in this blog, so here we go. I did intend on doing this blog a bit earlier this week but I’ll explain why that didn’t happen towards the end of the blog.
Right, so I’ll give a breakdown on how I tackled my assignment and give a bit more detail on what worked (which I feel was most) and what didn’t. Firstly, I printed off the brief. I then numbered each task in the brief so I knew how many tasks I had to do in the assignment and could tick them as I went. I rarely talk myself up, in case you haven’t noticed, but I really feel this was a system that worked. There were two sections, both HTML and CSS. The HTML started out with the basic e.g. header, title, paragraphs and a footer. These tags actually were fairly easy. I had done all of this in the labs but I blame my own work ethic for not having a better understanding of it all. If the labs were worth marks I would have done a lot better, I know that doesn’t speak very well of my work ethic and the labs are great, but hard work is not in my nature unless the pressure is on, fortunately for this assignment, it was. I mean I did learn a lot in the labs and could use the some of the experience from past labs to help, as well as my past practice on sites such as W3 schools and especially code academy. Youtube was a big help this time. So I continued to tick off each task one by one, some more challenging than others but all doable as long as the focus was put in. I also took some notes as I went as well just as reminders and what not (I’ll include a photo below). I was constantly checking my progress on both a HTML viewer which I had downloaded as well as refreshing my tab in chrome and it continued to look better and better as the coding went on. I must admit, it was really satisfying when the code worked. Adding the links was also a lot easier than I had remembered, probably thanks to the lab practice. The main challenge of the HTML was probably adding the photos and when I had them in their own files they wouldn’t show. I knew I had to add more code to make sure it was aware it was in separate files but it wouldn’t work. I failed on this front but the photos were viewable by the end. As a whole, the HTML was very doable as long as you were willing to put in a bit of graft, which I was.
The next part was the CSS, this part was a lot more of a struggle for me personally. I was speaking to John in the class who said he actually struggled with the HTML more. Before this, I thought the HTML was just known for being easier, but personal preference does play a part, excuse my ignorance. So I did a bit of practice CSS first as well as re-watching some of the past lectures on CSS then jumped straight in. Changing the colour of the body of the site and changing the fonts was easy. Changing the colours of the footer was also easy enough after a few tries. What seemed to be happening sometimes was that I was using certain code and it wouldn’t work then I would try the same code after a load of goes and it would work out of nowhere. It was a bit brain melting but it’s over now so let’s not get caught up over it. My main struggle was differentiating between the tag for both photos. So I wanted to move the logo to the right and keep the main photo on the left. I couldn’t differentiate both tags to do this so the layout of the logo doesn’t look as it should, so unfortunately, I failed at this task and it kills me. I 100% aim on going back and finding out how to do this, I know the marks are gone, but just for myself more than anything. My divs didn’t seem to be working either for some reason, this was after a few attempts and I couldn’t find hat I was doing wrong so I tackled most of the CSS without the need for divs. Thankfully the main div which was requirement finally came through for me, it felt oh so good. Everything was starting to look really good as a whole bar a few minor parts. Now the part that killed me the most, and the reason it killed me the most was because I had it working, then it stopped and I don’t know why. I had to look it up a good bit and watch a few videos back but the positioning of the main a paragraph to the main photo on the index page wouldn’t work> I eventually got it but for some reason there was a huge gap between the photo and “facts” which should have been directly under it. Once I fixed this look, the writing wasn’t to the left of the photo anymore. I just couldn’t get both to work, I was tearing my hair out and was also up against a deadline because so much of my time had been consumed on a few parts in CSS. This was another part which I failed at. Bar that most of the other CSS worked and I got majority of it ticked off. My “Facts” page looked perfect to me and the index page was so close to perfect. I gave it a really good go and feel it was a very good assignment as a whole.
So yeah, the assignment reminded me of just how rewarding hard work can be. As a whole, I feel I did great with the HTML and really well with the CSS bar a few minor slip ups. We will just have to wait and see. As I said, I wanted to go into more detail in my last blog but was just too tired. Looking at videos through past lectures and Youtube were probably my greatest help. I’ll attach the Youtube video below, both from the same guy which helped with the HTML and CSS. It had an index in the comment section of what he covered and the time beside it so if there was a certain part I was struggling with e.g. links, I could just go to the index and go to that part.
https://youtu.be/UB1O30fR-EE <--HTML
https://youtu.be/yfoY53QXEnI <--CSS
Unfortunately I missed class on the Saturday and still have to catch up. If I’m being honest, I crashed hard and felt a bit sick. I was doing assignments and working non stop for the last few weeks and it had caught up on me. Tomorrow I aim on catching up on what I missed. this will mean emailing Gemma and watching the lecture. It seems we’re moving on to Word Press. And I never thought I would say this, but I can’t wait for the challenge.
0 notes
Photo
Alkuperäinen
Käsilaatat master post
The text under the cut goes to a lot of places this time, there’s some translator notes, a small language quirk explained, and a couple thoughts of working in a bilingual (Finnish+English) office and how the languages work together there.
I did a small gamble with how Gaster speaks to Asgore in the middle page. Every other pleading he does with ’pyydän’(I ask[of you to do smth]), but only once he slips to ’kiltti’ which is more personal, more desperate to the point of pathetic, it’s the one the brothers use on him all the time. I’m not sure how effective it is to other Finns, I slept on the idea and still feel like I’m a little biased on this... At least we don’t see if he’s actually signing that one to Asgore or not, it’s not as polite as the other word (’pyydän’ is more indifferent and formal, thus easier to refuse).
Finnish language likes to make new words by combining existing ones, such as: ’jää’(ice) + ’kaappi’(cupboard) = ’jääkaappi’(fridge) When the end of a word that comes first and the start of the one after that have the same vowel, they need to have a ’-’ between them, such as above with ’aika-avaruus’(time-space) and ’ennalta-arvaamaton’(unpredictable, lit. ”couldn’t be guessed in advance”). It adds a short pause in pronunciation, without it the between part would be pronounced like a long vowel, and that makes it harder to understand what’s being said. If you see the’-’ in a word combination that’s not between same vowels, there’s several possible reasons for it. Most common are probably when it separates abbreviations or numbers from regular words (f.ex. ’TML-hoidot’[TML treatments]), or the combination is of equal words that don’t define each other (f.ex ’kurkku-porkkanasalaatti’[salad with cucumbers and carrots, not carrots called ”cucumber carrots”], or ’aika-avaruus’ too I guess). Also, as mentioned before, ’-’ at the end of the text row can also indicate a long word has been cut in two to continue on the new row.
In the last page we have another example of where English exist in these translations, I’ve explained here why and how it affects the translations, in short any Windings means it’s written or modified by Gaster or to Gaster, and I consider those ok for me to translate to Finnish. Non-Windings is computer program generated text, that stays in English. But, just because something is in Finnish doesn’t mean English words cannot be used at all. There’s the whole subject header in the last page for a sample, and the TML is mentioned too.
I have several years’ experience of working in bilingual work environments where English is secondary language but also the language of most of the tools and programs used. English terms and abbreviations need to have a Finnish translation available, but for the sake of searching more on the topic of certain abbreviations(like help files and googling), the English terms need to be there too. The abbreviation (IDF) is learned as the name of the term or idea that’s being described with it, it’s pronounced in the way it would be in the language you happen to be speaking when saying it (in English it’s ’eye-dee-eff’, in Finnish ’ee-duhh-aff’ or something, if you do the Google translate trick type ’iideeäf’ to hear the Finnish pronunciation). The opened form is to understanding what words the abbreviation is made of (Inter-Dimensional Fatigue), followed by Finnish-equivalent words (Ulottuvuuksien väliset kulumat) for those who are not skilled enough in English. After the comma there’s a longer explanation in Finnish on what the abbreviation means.This same logic is used at my current workplace with new terms, sometimes the Finnish-equivalent term is not presented, but other three are definitely there.
Reports and presentations usually have a mix of both languages, but with some clients it’s agreed that all official material should be in English, even when the meetings can be and are held completely in Finnish. I’ve witnessed a case where a meeting was held in Finnish with English powerpoints with 10 people in the room, and in the middle one person who is known to not be too skilled in Finnish joined the meeting. From that point on the common ‘best understood language’ between all participants switched from Finnish to English, and so everyone spoke English for the rest of the meeting. This had nothing to do with workplace hierarchy, the person joining was not the boss of anyone in the room. Rather the point of the switch was that the newcomer was taken into consideration and welcomed to a conversation where everyone is closer to the same level with each other with their skills to communicate.
I’ve heard this kind of switching is also common in everyday life with Finns, which can become a problem for people who want to learn Finnish by talking to native speakers. If you want them to correct your grammar you really need to let them know, doing so unprompted especially when you’re clearly trying hard to talk well enough to get your point across would be considered kind of mean (unless they’re your teacher, or someone else in charge of getting you speak better).
Please note, all of this is from the point of view of one person, I’m sure there are bilingual workplaces in Finland where things don’t go like this, but I find this kind of approach to be quite smooth and convenient for everyone involved.
9 notes
·
View notes
Text
The (Upcoming) WordPress Renaissance
The (Upcoming) WordPress Renaissance
Leonardo Losoviz
2019-08-15T13:00:59+02:002019-08-15T11:20:22+00:00
It has been 8 months since Gutenberg was launched as the default content editor in WordPress. Depending who you ask, you may hear that Gutenberg is the worst or the best thing that has happened to WordPress (or anything in between). But something that most people seem to agree with, is that Gutenberg has been steadily improving. At the current pace of development, it’s only a matter of time until its most outstanding issues have been dealt with and the user experience becomes truly pleasant.
Gutenberg is an ongoing work in progress. While using it, I experience maddening nuisances, such as floating options that I can’t click on because the block placed below gets selected instead, unintuitive grouping of blocks, columns with so much gap that make them useless, and the “+” element calling for my attention all over the page. However, the problems I encounter are still relatively manageable (which is an improvement from the previous versions) and, moreover, Gutenberg has started making its potential benefits become a reality: Many of its most pressing bugs have been ironed out, its accessibility issues are being solved, and new and exciting features are continuously being made available. What we have so far is pretty decent, and it will only get better and better.
Let’s review the new developments which have taken place since Gutenberg’s launch, and where it is heading to.
Note: For more information about this topic, I recommend watching WordPress founder Matt Mullenweg’s talk during the recent WordCamp Europe 2019.
Why Gutenberg Was Needed
Gutenberg arrived just in time to kick-start the rejuvenation of WordPress, to attempt to make WordPress appealing to developers once again (and reverse its current status of being the most dreaded platform). WordPress had stopped looking attractive because of its focus on not breaking backwards compatibility, which prevented WordPress from incorporating modern code, making it look pale in comparison with newer, shinier frameworks.
Many people argue that WordPress was in no peril of dying (after all, it powers more than 1/3rd of the web), so that Gutenberg was not really needed, and they may be right. However, even if WordPress was in no immediate danger, by being disconnected from modern development trends it was headed towards obsolescence, possibly not in the short-term but certainly in the mid to long-term. Let’s review how Gutenberg improves the experience for different WordPress stakeholders: developers, website admins, and website users.
Developers have recently embraced building websites through JavaScript libraries Vue and React because (among other reasons) of the power and convenience of components, which translates into a satisfying developer-experience. By jumping into the bandwagon and adopting this technique, Gutenberg enables WordPress to attract developers once again, allowing them to code in a manner they find gratifying.
Website admins can manage their content more easily, improve their productivity, and achieve things that couldn’t be done before. For instance, placing a Youtube video through a block is easier than through the TinyMCE Textarea, blocks can serve optimal images (compressed, resized according to the device, converted to a different format, and so on) removing the need to do it manually, and the WYSIWYG (What You See Is What You Get) capabilities are decent enough to provide a real-time preview of how the content will look like in the website.
By giving them access to powerful functionality, website users will have a higher satisfaction when browsing our sites, as experienced when using highly-dynamic, user-friendly web applications such as Facebook or Twitter.
In addition, Gutenberg is slowly but surely modernizing the whole process of creating the website. While currently it can be used only as the content editor, some time in the future it will become a full-fledged site builder, allowing to place components (called blocks) anywhere on a page, including the header, footer, sidebar, etc. (Automattic, the company behind WordPress.com, has already started work on a plugin adding full site editing capabilities for its commercial site, from which it could be adapted for the open-source WordPress software.) Through the site-building feature, non-techy users will be able to add very powerful functionality to their sites very easily, so WordPress will keep welcoming the greater community of people working on the web (and not just developers).
Fast Pace Of Development
One of the reasons why Gutenberg has seen such a fast pace of development is because it is hosted on GitHub, which simplifies the management of code, issues and communication as compared to Trac (which handles WordPress core), and which makes it easy for first-time contributors to become involved since they may already have experience working with Git.
Being decoupled from WordPress core, Gutenberg can benefit from rapid iteration. Even though a new version of WordPress is released every 3 months or so, Gutenberg is also available as a standalone plugin, which sees a new release every two weeks (while the latest release of WordPress contains Gutenberg version 5.5, the latest plugin version is 6.2). Having access to powerful new functionality for our sites every two weeks is very impressive indeed, and it enables to unlock further functionality from the broader ecosystem (for instance, the AMP plugin requires Gutenberg 5.8+ for several features).
Headless WordPress To Power Multiple Stacks
One of the side effects of Gutenberg is that WordPress has increasingly become “headless”, further decoupling the rendering of the application from the management of the content. This is because Gutenberg is a front-end client that interacts with the WordPress back-end through APIs (the WP REST API), and the development of Gutenberg has demanded a consistent expansion of the available APIs. These APIs are not restricted to Gutenberg; they can be used together with any client-side framework, to render the site using any stack.
An example of a stack we can leverage for our WordPress application is the JAMstack, which champions an architecture based on static sites augmented through 3rd party services (APIs) to become dynamic (indeed, Smashing Magazine is a JAMstack site!). This way, we can host our content in WordPress (leveraging it as a Content Management System, which is what it is truly good at), build an application that accesses the content through APIs, generate a static site, and deploy it on a Content Delivery Network, providing for lower costs and greater access speed.
New Functionality
Let’s play with Gutenberg (the plugin, not the one included in WordPress core, which is available here) and see what functionality has been added in the last few months.
Block Manager
Through the block manager, we can decide what blocks will be available on the content editor; all others will be disabled. Removing access to unwanted blocks can be useful in several situations, such as:
Many plugins are bundles of blocks; when installing such a plugin, all their blocks will be added to the content editor, even if we need only one
As many as 40 embed providers are implemented in WordPress core, yet we may need just a few of them for the application, such as Vimeo and Youtube
Having a large amount of blocks available can overwhelm us, impairing our workflow by adding extra layers that the user needs to navigate, leading to suboptimal use of the time; hence, temporarily disabling unneeded blocks can help us be more effective
Similarly, having only the blocks we need avoids potential errors caused by using the wrong blocks; in particular, establishing which blocks are needed can be done in a top-down manner, with the website admin analyzing all available blocks and deciding which ones to use, and imposing the decision on the content managers, who are then relieved from this task and can concentrate on their own duties.
Enabling/disabling blocks through the manager (Large preview)
Cover Block With Nesting Elements
The cover block (which allows us to add a title over a background image, generally useful for creating hero headers) now defines its inner elements (i.e. the heading and buttons, which can be added for creating a call to action) as nested elements, allowing us to modify its properties in a uniform way across blocks (for instance, we can make the heading bold and add a link to it, place one or more buttons and change their background color, and others).
The cover block accepts nested elements (Large preview)
Block Grouping And Nesting
Please beware: These features are still buggy! However, plenty of time and energy is being devoted to them, so we can expect them to work smoothly soon.
Block grouping allows to group several blocks together, so when moving them up or down on the page, all of them move together. Block nesting means placing a block inside of a block, and there is no limit to the nesting depth, so we can have blocks inside of blocks inside of blocks inside of… (you’ve got me by now). Block nesting is especially useful for adding columns on the layout, through a column block, and then each column can contain inside any kind of block, such as images, text, videos, etc.
Blocks can be grouped together, and nested inside each other (Large preview)
Migration Of Pre-Existing Widgets
Whereas in the past there were several methods for adding content on the page (TinyMCE content, shortcodes, widgets, menus, etc.), the blocks attempt to unify all of them into a single method. Currently, newly-considered legacy code, such as widgets, is being migrated to the block format.
Recently, the “Latest Posts” widget has been re-implemented as a block, supporting real-time preview of how the layout looks when configuring it (changing the number of words to display, showing an excerpt or the full post, displaying the date or not, etc).
The “Latest posts” widget includes several options to customize its appearance (Large preview)
Motion Animation
Moving blocks up or down the page used to involve an abrupt transition, sometimes making it difficult to understand how blocks were re-ordered. Since Gutenberg 6.1, a new feature of motion animation solves this problem by adding a realistic movement to block changes, such as when creating, removing or reordering a block, giving a greatly improved visual cue of the actions taken to re-order blocks. In addition, the overall concept of motion animation can be applied throughout Gutenberg to express change and thus improve the user experience and provide better accessibility support.
Blocks have a smooth effect when being re-ordered. (Large preview)
Functionality (Hopefully) Coming Soon
According to WordPress founder Matt Mullenweg, only 10% of Gutenberg’s complete roadmap has been implemented by now, so there is plenty of exciting new stuff in store for us. Work on the new features listed below has either already started, or the team is currently experimenting with them.
Block directory A new top-level item in wp-admin which will provide block discovery. This way, blocks can be independently installed, without having to ship them through a plugin.
Navigation blocks Currently, navigation menus must be created through their own interface. However, soon we will be able to create these through blocks and place them anywhere on the page.
Inline installation of blocks Being able to discover blocks, the next logical step is to be able to install a new block on-the-fly, where is needed the most: On the post editor. We will be able to install a block while writing a post, use the new block to generate its HTML, save its output on the post, and remove the block, all without ever browsing to a different admin page.
Snap to grid when resizing images When we place several images on our post, resizing them to the same width or height can prove to be a painful process of trying and failing repeatedly until getting it right, which is far from ideal. Soon, it will be possible to snap the image to a virtual grid layer which appears on the background as the image is being resized.
WordPress Is Becoming Attractive (Once Again)
Several reasons support the idea that WordPress will soon become an attractive platform to code for, as it used to be once upon a time. Let’s see a couple of them.
PHP Modernization
WordPress’s quest to modernize does not end with incorporating modern JavaScript libraries and tooling (React, webpack, Babel): It also extends to the server-side language: PHP. WordPress’s minimum version of PHP was recently bumped up to 5.6, and should be bumped to version 7.0 as early as December 2019. PHP 7 offers remarkable advantages over PHP 5, most notably it more than doubles its speed, and later versions of PHP (7.1, 7.2 and 7.3) have each become even faster.
Even though there seems to be no official plans to further upgrade from PHP 7.0 to its later versions, once the momentum is there it is easier to keep it going. And PHP is itself being improved relentlessly too. The upcoming PHP 7.4, to be released in November 2019, will include plenty of new improvements, including arrow functions and the spread operator inside of arrays (as used for modern JavaScript), and a mechanism to preload libraries and frameworks into the OPCache to further boost performance, among several other exciting features.
Reusability Of Code Across Platforms
A great side effect of Gutenberg being decoupled from WordPress is that it can be integrated with other frameworks too. And that is exactly what has happened! Gutenberg is now available for Drupal, and Laraberg (for Laravel) will soon be officially released (currently testing the release candidate). The beauty of this phenomenon is that, through Gutenberg, all these different frameworks can now share/reuse code!
Conclusion
There has never been a better time to be a web developer. The pace of development for all concerned languages and technologies (JavaScript, CSS, image optimization, variable fonts, cloud services, etc) is staggering. Until recently, WordPress was looking at this development trend from the outside, and developers may have felt that they were missing the modernization train. But now, through Gutenberg, WordPress is riding the train too, and keeping up with its history of steering the web in a positive direction.
Gutenberg may not be fully functional yet, since it has plenty of issues to resolve, and it may still be some time until it truly delivers on its promises. However, so far it is looking good, and it looks better and better with each new release: Gutenberg is steadily bringing new possibilities to WordPress. As such, this is a great time to reconsider giving Gutenberg a try (that is, if you haven’t done so yet). Anyone somehow dealing with WordPress (website admins, developers, content managers, website users) can benefit from this new normal. I’d say this is something to be excited about, wouldn’t you?
(dm, il)
0 notes
Text
[VNT 60] TO THE TOP!
Komatsu: During the drinking party of the first anime I'd starred in, the one who'd kindly talked to me, who didn't know his right from his left, was Terashima-san. Terashima: Actually, at that time, Hamano-kun was also there. Hamano: Ee, I didn't know that! Terashima: That we'd have ended up in the same unit in the future seems awfully fated, doesn't it.
Voice Newtype 60 interview featuring Terashima Junta, Komatsu Shohei, and Hamano Daiki of the Idolm@ster Side M unit THE Kogadou! This is crossposted onto Wordpress for archiving purposes but the entire interview can also be found under the cut!
Interview: THE Kogadou (Terashima Junta x Komatsu Shohei x Hamano Daiki) THE Male Friendship nurtured by ramen!
THE Kogadou, a unit of physical martial artists. Introducing these three men, passionate rivals from the same generation, into the world of “Idolm@ster Side M”!
What impressions did your roles leave on you?
Terashima: With Takeru, there wasn't any of the hesitation I felt during the roles I'd previously auditioned for, so I got to portray him easily. Personally, from the beginning I was a person who gets tongue-tied easily, not the kind of cheerful, chatty person at all, so the shy parts of ourselves resemble each other. And since he's a former boxer, I tried to get into the mental state of an athlete, from his mindset to the way you'd expect him to move. Hamano: Did you go meditate under a waterfall or something (lol) Terashima-kun does things at his own pace, but he's a guy who's got stuff bottled up inside, like Takeru. Komatsu: During the drinking party of the first anime I'd starred in, the one who'd kindly talked to me, who didn't know his right from his left, was Terashima-san. Terashima: Actually, at that time, Hamano-kun was also there. Hamano: Ee, I didn't know that! Terashima: That we'd have ended up in the same unit in the future seems awfully fated, doesn't it. Komatsu: Ren, the former martial artist, has speech and conduct unbecoming of an idol, I think he lacks common sense, thinks of life as a game, seems to just have a big mouth but also has real strength to him, and I really, personally think he's an honest kid. He's a completely different type of guy from me, but I'm also quite a sore loser myself, so I think that's the part of him I understand. Hamano: Komatsu-kun is a diligent person, so without a doubt he doesn't like losing, does he. Terashima: I've been wondering why everyone just lets Ren off the hook. But when Komatsu-kun voices him I think isn't that the charm of this brat, perfectly taking on Takeru like this (lol) Komatsu: Ren also has times when he encourages Takeru when he's feeling down, so I also think he's a cute brat sometimes, and there's a lot of mysterious things about him that I want to know about. Hamano: My first impression of Michiru was “Eh? He makes ramen!?” (lol) Terashima: He was a judoka before he became a ramen shop chef, wasn't he. Hamano: I'm harsh on myself, but I've been told that I deal with people kindly [like Michiru does]. He's tolerant, and is the kind of guy one would get hooked on like [they would] his “Otoko Michi Ramen”. Terashima: Hamano-kun's the same age as me and a year older than Komatsu-kun, but you wouldn't think that, because he's the calm one. Hamano: Nope, nope, that's just my voice. Komatsu: Within THE Kogadou, Michiru's always making them large, heavy [meals], so Takeru and Ren let him do whatever he wants. Hamano: You'd pretty much see it from the first time they talk, but Michiru doesn't see it as him being saddled with those two, they're his friends and good rivals so he thinks of them as equals. The team's bonds are strong. Komatsu: I think the fact that they mutually acknowledge each other is an important point about THE Kogadou. Terashima: It's not weird that they became friends; the part where they encourage each other is good. And it ends up in Michiru-san making ramen for them. Hamano: There's an image of “Settle this in one blow! And if you end up being defeated, get along [with the winner].” Terashima: THE Male Camaraderie, isn't it.
Komatsu-san has experience as a stunt man, doesn't he.
Komatsu: In a local show, I'd engaged in battle as a hero role. Terashima: He's the reliable action leader. Komatsu: Eeh. The three of us are leaders in our own ways. Terashima: With [our own] specialties? I'm always smiling, so I wonder if I'm the smile leader. Hamano: All that I can do is at about the amount needed for rugby, yanno. Komatsu: Action, smile, rugby leader... Hamano: That last one has nothing to do with being an idol! Komatsu: Baritone leader, then!
Give us a bit about your unit songs.
Hamano: I wonder how (lol) One song is up-tempo and pitched like rock music, and within the various kinds of tones, the image of three people diligently striving with the music joins in. Terashima: You'd feel their relationship in the lyrics “We're not so soft as to have pity on those fallen brats”. They're aiming for the top together, so they think, “wouldn't we be infallible, then?” Hamano: It reminds you a bit of those nostalgic shounen manga and passionate battle anime series, doesn't it. Terashima: Like a tiger's aura would emerge from behind 'em. As for the second song, it feels like what one might expect from an idol song of yore. Hamano: THE Kogadou's music is somehow nostalgic, isn't it. Komatsu: There's some kind of dialogue-like bargaining, and it colors this with passion. If one were to dance to this while singing it would definitely be cool.
Was there anything you kept in mind while singing DRIVE A LIVE?
Komatsu: Ren is the type who doesn't wait for what the other party would say, so I sung as if he kept finishing his sentences [quickly]. Terashima: For me, more than singing well, I thought it'd be better if I took great care with [portraying] Takeru's stoic, awkward parts. Hamano: With Michiru, it feels as if he's throwing out power with all his might, so he sings earnestly. He's the kind who'd say “let's do this over again!”, trying again no matter how many times, treating [singing] as a sport.
Your unit is under 315 Productions, so what are the “best” moments of everyday life for you?
Terashima: The moment when you and your costars make a toast at a cast party for work. I wanna taste that for THE Kogadou soon! Komatsu: I've just entered this world [of seiyuu], and thanks to SideM, I've had lots of new encounters and I think that's the best part of it. Hamano: Within SideM, there are members close to me in age, as well as friends I've known for a while, and within this industry, I think [working with] people the same age as you is exciting, and the fact that we're all able to do our best together as part of the same production is the best!
Passionate, aren't we. The three of you, what kinds of things would you want to make?
Komatsu: I want to try hosting a radio show. Hamano: It would be good to call out the other manly guys and make a radio show with a rowdy feel to it. Terashima: I want us to become the kind of unit that even outsiders talk about, like “There's some kind of unit called THE Kogadou or something,” Hamano: As we get to do new things one by one, the potential that one of those might be beneficial to us in the future increases. If we keep on aiming for the highest point, as the days pass, we'll get to reach even higher up. Komatsu: [Ren voice] “You guys, let's go at it together 'til we reach the top!” Hamano: Ooh!!! Komatsu-kun, your face is all red though (lol) Komatsu: I'm still so lost as to if it's alright to call everyone “you guys”...but, if it's during a live, I'll hype everyone up fast! Terashima: I'll also enjoy lives in Takeru's way - I'll lock eyes with you all one after another! Hamano: When we'd get to spar with you, Teacher, forget everything else in the face of Michiru's resilience and have fun with us during our live!
(Left) Hamano Daiki/Born March 30/Hometown: Tokyo/Arts Vision/Known roles are Dante Mogro (Mobile Suit Gundam: Iron Blooded Orphans), Gohonmatsu Masaru (ACTORS), etc.
(Middle) Terashima Junta/Born August 11/Hometown: Nagano/Kenyuu Office/Known roles are Ichijou Shin (KING OF PRISM by PrettyRhythm), Yukimura Hyouga (Inazuma Eleven GO), etc.
(Right) Komatsu Shohei/Born April 14/Hometown: Fukuoka/Ken Productions/Known roles in My Hero Academia, Kabaneri of the Iron Fortress, etc.
Omake: Talk theme: 60
Komatsu: Every night before I go to sleep, I train for 60 minutes. I can't miss out on at least flexibility and weight training. Terashima: You're way too conscious about that! I can't lose to Komatsu-kun: every night, I eat pudding. I'd like to eat around 60 of 'em! Hamano: If you [Terashima] wanna discipline yourself like Takeru, first off, stop doing that (lol) I think that if I got more than 60 jobs in a month, I'd be happy.
my translation index
If you appreciate my translations, please consider buying me a coffee!
The siren song of “Kogadou photoshoot and joint interview” was way too strong, so I ended up buying the magazine (I am a bad influence to myself) - all text and pictures in here are from my copy of Voice Newtype 60! I ended up translating it to practice reading Japanese but ended up using my phone camera to take pics of kanji so I can zoom in on them more LMAO
I have. Really. REALLY bad eyesight...
Please don't redistribute or otherwise reuse this translation, and/or its attached media (pictures)!
Speaking of pictures - yes! This is the article I get both my current Tumblr and Twitter headers from!
I wanna cry - in Daiki's "And if you get defeated, get along" line, there's the phrase 寝転んで, which is the te form of 寝転ぶ, "nekorobu". Daiki hosts a cat cafe show named "Nekorobi Danshi". Junta has guested in it. I'm,
The second question refers to Shohei's time as part of HIROZ, an action/stunt/idol group that used to do daily hero shows for a local theme park. For this alone, he arguably has the most experience with lives amongst the newer seiyuu.
[Junta voice, Cho Ongakusai 2017] "I'm here for NicoNico [Douga's event], but even in daily living I'm always niconico {grinning}"
Daiki used to play rugby! He's the sporty one of the three (Shohei is plenty athletic but bad with ball games, and Junta is...Junta) and tends to invite the other two out to play games with him.
The first song they refer to ("we're not so soft as to have pity on those fallen brats") is Tsuyoku Totoki Kemono-tachi (Strong, Noble Beasts); the second song (with "dialogue-like bargaining") is Jounetsu (Passionate)...FIGHTER.
The dialogue in question:
Ren (Shohei): I want to be strong, stronger than just about anyone! And I'll only knock you dead...
Michiru(Daiki): Now, now, calm down!
AND THE BEST THING IS THAT MICHIRU'S "Now, now, calm down!" IS ACTUALLY THE HIGHEST KEY HE SINGS.
Their characters' company name is a pun - in Japanese you can pronounce 315 as "sa-i-kou", "the best", hence that question "what are the 'best' moments"
The specific word Junta uses for "cast party" can either be used for a party before the start or after the end of a project. I am assuming he means 'after Kogadou release event is done', but he could also mean 'before Kogadou's major debut'.
Talk about self-fulfilling prophecy - this magazine was originally released June 2016. Come January 2017, the three of them co-hosted 315Pro Night, Side M's radio show, for the first quarter of 2017. Junta's cohosted radio before, this is Daiki's second radio as co-host (the first one being Voyage Wave), and also Shohei's first time co-hosting a radio show.
"You guys" doesn't have the same pizzazz as Ren's "omaera!!" but we'll have to make do...
"I'll lock eyes with you all one after another" - Per the in-game manga, some fans in-story have noticed that Takeru tends to look everyone in the audience straight in the eyes - he became an idol in the hopes of being found by his siblings, and thus always looks for them in a crowd.
What I translated in Daiki's last line from the main interview as "Teacher" is 師匠 ("Shishou"), a respectful term for a martial arts teacher, usually, more specifically, a judo teacher! Not surprising, considering Michiru's judo background. Michiru only refers to the player's producer character with this, and Daiki follows suit, only ever referring to Side M fans as 師匠 as well.
If you've noticed something with their cast profiles at the very end - yes, Ren is actually Shohei's first named character role, hence why his bit, at the time the interview was printed, only has series titles listed. (Shh I am not emo)
Anyway, thanks for reading, I hope you liked it!
#seiyuu#idolmaster sidem#terashima junta#komatsu shohei#hamano daiki#the kogadou#my translations#interview translation
34 notes
·
View notes
Note
🍭 + a song i love instead by ryan adamor, a really good book series is the mortal instruments and a fab movie is la la land !!
Hello Cierra! Thank you for all these recommendations wowow; He has a really beautiful voice, downloaded it immediately! I have the books in my iBooks library and I’ll totally read them (for now I’m watching Shadowhunters) because I know the books are better than the series. I KNOW I HAVE TO WATCH IT i feel bad to not have watched it yet >
URL: Pepper | Spinach | Lemon | Mint | Pizza 🍕 Icon: Mushroom | Lobster | Blueberry pie | Cherry | Honey 🍯Theme: Black Pepper | Broccoli | Coconut | Pear | Toffee 🍬 Mobile Theme: Soap | Baked Bean | Chilli | Peppermint | Chocolate 🍫Posts: Cauliflower | Curry | Coffee | Bacon | Éclair ⚡️ Overall: Grass | Mussel | Olive | Toast | Pumpkin 🍅 (im a drarry trash too hiii)Following: No sorry but ily 😔 | Just Now+ | Yes | Forever. 💕
BONUS: I believe you just started your blog (because of the number of pages your blog has) and if you don’t mind I could give you some suggestions? First of all, welcome in the Harry Potter fandom! 💕 Suggestions: I’d suggest a theme with a slightly less bright colour for your background because yellow is a little aggressive on the eye, and be careful with the original withdraw of the picture you chose for you mobile theme header because it's a lil blurry! All of these are suggestions; you do what you want with your blog cutie, as long as you have fun because that’s what’s important! :)
🍭 Want one? 🍭
3 notes
·
View notes
Note
all of them
((I’m guessing you mean the mun thing because I didn’t reblog anything else and if not and you’re just sending all of them out of context then wh o o boi I just put myself through An Ordeal for nothing.
☯ Is there a muse you’ve always wanted to play?
Yes! Nepeta!!!! I’ve always wanted to play her but I don’t have the confidence because I lack proper grasp of her character.
♣ Is there an author(s) that you look up to with your writing skills?
Ooo yes definitely. Beloved, for one, has the most amazing prose I have ever seen. I’ve learned a lot from their writing and I still aspire to someday be able to write something as breathtaking as their works. Quenive as well has spectacular writing and their stories and dialogue flow so well and j u st ohmy g od.
♧ Is there an RP partner(s) that you credit for becoming a better writer?
Definitely. I would say it was all of the people I’ve roleplayed with before that allowed me to develop Hal so much. The people in my old group chat definitely helped me flesh out different aspects of Hal that I could play (ie: sadist demon while still managing to be an angsty know-it-all) and the spontaneous connections on parp really helped me figure out how to play Hal in stupid situations while still keeping him ic.
♥ What’s your favorite ship with your muse?
Ha ha h a,,h,a,,,,wh ee zes
♡ Would you ever write a poly ship?
If anyone were actually interested in writing a poly ship with me, then yes definitely.
♦ What’s an AU that you’ve always wanted?
Oh boi there are just s o m a n y. That one godstuck au maybe. That would be fun to play out. Also the generic vampire aus I am weak for them. There’s also the au’s I’ve made that would be fun to play out but they’re difficult to explain. Merstuck au’s are also amongst the favorites to play along with dragon rider au’s I love me my fantasy genre. Whoops that was more than one but listen ok I want a lot of AU’s.
♢ What’s an AU that you think just won’t work with your muse?
Hmmm I’m not sure. I can’t think of any at the top of my head but any AU that revolves around Jake probably wouldn’t work well with Hal.
♔ What’s your opinion on teacher/student verses? Do you have any of these as threads?
I’m not personally a fan of them and I can’t say I see the appeal but if that’s what rocks another person’s boat then I’m not going to be the one hating on them. As of the moment I don’t have any as threads.
♕ Do you like magic!anons? Why or why not?
Yes!! They’re a lot of fun and I always think throwing the unexpected at my muses is the greatest thing ever.
⚜ What is the best time to write for you? Why?
Late afternoon or evening because that’s the time I’m awake and Functional and have actually thought of Creative ideas to write.
★ What type of historical AU would you like to do one day?
Maybe something based on the Renaissance period? Or the classic medieval period. Ancient Greece would also be fun to play out.
☆ What type of fantasy AU would you like to do one day?
There are many. Just, anything that is fantasy I probably want to do it. I’ve never really tried the whole AU with the fae/faeries so perhaps that would be fun to look into.
☄ Do you think your muse would have liked going to high school sports games? Do you or did you go to high school sports games?
Nope, he wouldn’t be interested in the actual sport. Going to see hot guys though? Definitely. I don’t generally go on a day to day basis because I understand like nothing. If a friend wanted me to go or a teacher was giving extra credit for me to then yeah I’d go.
☾ Do you like writing smut? Why or why not?
I have actually never written smut so I can’t really say. I think it’d be difficult for me to having had no experience whatsoever with anything relating to smut.
☽ Do you like writing angst? Why or why not?
Yes and no. Yes because I love to make my muse suffer and it’s great and fun to throw Tragic headcanons to my rp partner and to watch them suffer(not really) a well. No because,, I am a simple person,, who wants my muses to be happy,, and roleplaying angst fucking h u r t s.
☼ What’s an FC that you’re dying to use? Why?
Uhhhh???? I don’t really have one of a Real Life Person but I pretty much draw my own interpretations of Hal so? That probably counts maybe.
☀ What’s an FC that you desperately want to play with? Why?
See above.
☁ What’s an FC that you refuse to play with? Why?
See also above.
☂ How does your muse spend a rainy day? How do you spend a rainy day?
Napping against the window sill lulled to sleep by the gentle patter of rain falling upon the glass is how he spends a rainy day. I, on the other hand, spend it indoors on my laptop like I do every single day.
☃ If your muse was cartoonized, what would their FC be? Why?
???????
☺ What’s a character that you desperately want your muse to play with? Why?
Any of the robots. Literally any. I hardly ever get interactions with any of the robots it’s kind of sad.
☹ What’s a character that you refuse to play with? Why?
There aren’t any I would refuse to play with but there are some that I prefer to not interact with. This is due to the fact that either I or my muse or both dislikes the character and roleplaying with them would actually require more effort on my part.
☢ Are there any ships that you would like to write for one day? Any that you wouldn’t?
There are definitely ships I would like to write for one day because I’m a sucker for that really. There are also ships I wouldn’t but I’m not going to get into that because I don’t want to be involved in The Discourse.
☣ What’s one thing that will make you drop a thread?
If a mun godmodded my character or forced their character onto mine, probably.
♨ What’s a muse that you wished had lasted, but didn’t?
Mmm can’t really say I have one. All of my main muses stuck with me. I guess there were my OC’s that I used to rp with my friends but it’s not that much. I do wish that my friends and I could have lasted in rping with each other tho.
❀ Do you like reblog karma? Why or why not?
Assuming I have the correct definition of reblog karma, yes. It’s nice because it’s like a win win scenario. Everyone gets asks in their inbox and it’s kind of just polite y’know? Like a tip of the head “I see you like this rp meme just as I do so I’ll send you something so we both can enjoy it.”
✿ Do you have a mun FC? If so why did you choose that as your FC, and if not who would you choose?
Nnoot really? I have my own drawings of how I depict myself through my art if that counts.
♪♩♫ Does music inspire your muse? What’s one song on your playlist that reminds you of your muse?
Sometimes but not really. He doesn’t listen to music for inspiration, more of to fill the gaps of silence that occasionally settle in. Gasoline definitely reminds me of Hal. Definitely.
✂ Do you like to format your posts? Why or why not?
I like when other people do because it’s aesthetically pleasing and it’s so nice and spiffy. I, personally, don’t like to because it’s a pain in the ass and I only have so much patience.
✆ Other than RPing, what’s a hobby of yours?
Drawing! My icon and header is drawn by me so-
✉ Do you RP on any other platforms?
Does Parp count? Sometimes I use cherubplay too but not too often because the people there intimidate me.
❤ Have you or are you currently in love?
Romantically, probably not if you get what I’m hinting at. ;)
❥ Has something ever happened for you to hate a ship? Why?
Hoooo boi you can bet on it. Let’s just say an extended encounter with a really Toxic Roleplayer And Person In General has led to me disliking basically any ship involving a certain character.
ツ Who has been your favorite muse to play so far? Why?
Hal because he’s such an asshole I love it. I don’t generally get to be mean but man with Hal I can be as petty as I want.
回 Which muse was the worst to play? Why?
There was this once I tried to roleplay Dave and it just. It went terribly wrong I had no grasp on his character and I still don’t. Never again.
✘ People come in a group. If I were to look on your blog, who would I see you interacting with the most?
@timaeustestbed this one. This one @documentingsatan has also been taking up a lot of blog interaction lately too. Though they’re both the same people.
ღ Do you have a personal blog? Do you share it with your followers or do you keep it private?
I do! It’s linked right on my “mun page” lmao.
▼ Do you keep your character in character even if they are one of the worst people in the world?
I would like to think I do because Hal is objectively one of the worst people in the world. Though, I’ll admit I do a lot of justification for Hal’s actions from Hal’s point of view because Hal doesn’t see himself as a villain. Just a terrible person. I am also very soft on Hal and he probably acts happier than he should.
▽ Why did you create this muse?
True story but when I finished reading Homestuck I was like “shit I need to pick a character to roleplay” because that’s just what I did. I like to roleplay and Homestuck was such a large fandom that it was bound to be Fun to roleplay. There were many Failed and Subpar attempts to rp some characters on parp and I just couldn’t find a character that clicked, y’know. I tried John, Dave, Karkat, Jade, Rose, Dirk and just nope. And then. On a random spur as I scrolled through the available options in the Parp menu I saw “Lil Hal.” Of course, at the time, I only clicked it because I had thought I exhausted all other resources and if I fucked up everyone else why not fuck up this character I knew nothing about it (and I mean literally nothing about. I used to hate when Hal started talking in the comic because I thought it was so damn annoying). But surprise I was?? I was good at rping him?? People liked my shitty depiction of Hal. So I read more about Hal and how to play him and he just grew on me and here I am today.
1 note
·
View note
Text
Week in Ethereum News January 5, 2020 annotated edition
Another relatively slow week over New Years Day.
I committed to doing 6 of these annotated editions. I believe this is the 4th. Feedback has been positive, but definitely not to the point where I’m convinced this is how I should spend my time. Though mainly the signal I use is how many RTs the annotated edition gets. I suppose you could also support Week in Ethereum News in the Gitcoin CLR if you want me to keep doing these
Eth1
Muir Glacier successfully hardforked on Jan 2nd.
Nethermind v1.4.2 – proper config file for Muir Glacier
Update Parity clients to v2.6.8beta and v2.5.13stable. An attacker found that Parity was only validating block header and so was crashing Parity nodes by sending valid header with invalid body
An overview of stateless Ethereum
Protocol changes necessary for 4MB witness size: binary tree, 3 gas per byte for calling contracts, gas costs go up for SLOAD to 2000. EXTCODESIZE, BALANCE, and *CALL go up to 2400
Data on witness size using binary tries
It’s interesting that an improper config file is also what hit Parity right before Istanbul, and now it hits Nethermind at Muir Glacier. To Nethermind’s credit, that client is rapidly under construction and there are rapid releases, often multiple in a week.
No one is quite sure that there was an attack on Parity, but it seems more likely given what occurred. Basically they were incorrectly validating blocks, and so someone figured out they could crash Parity’s client. It could have been a buggy node somewhere, but unlikely. Seems like someone realized and thought they’d point out the bug in a conspicuous manner, a la devops199.
Meanwhile work on stateless Eth1 continued. There was some private conversation about why witness size didn’t go down more with binary tries. Vitalik tried to sketch out how to get to a manageable witness size, and the overview of stateless Ethereum is a nice overview of what it all means. So start in the order they’re listed there.
Eth2
Simpler Eth2 meta execution environment
SigmaPrime’s update on Beacon Fuzz, their Eth2 client differential fuzzer
Jim McDonald’s Eth2 expectations for 2020
Jim’s link was the most clicked this link, by far. Which is funny because I ran a twitter poll with the top 4 clicked links at that time, and of course in the twitter poll his link came in last. The miswisdom of crowds! Also amusing because I almost did not include it in this issue. It seemed not particularly new, and is a bit more bearish on shipping schedule. But it was a good overview, and let’s be honest, software rarely ships on time.
Meanwhile Vitalik refined his meta EE idea. This is something for phase2.
Stuff for developers
Solidity v0.6.1 and v0.5.16 – Yul optimizer bugfix
Compiling Formality to the EVM. Run formally verified functional programs on the EVM
IPLD tutorial in Go
Running machine learning models in ewasm
Nethereum v3.5
What’s new in Microsoft’s Ethereum VSCode extension update
Some neat stuff this week. A bugfix Solidity release, relevant to Yul and the ABIencoderv2. Victor Maia’s release of an EVM compiler for his Formality language is very interesting if you’re into functional programming.
Jonny Rhea’s messing around with hardcoding machine language classifiers in ewasm as a sort of EE is pretty interesting stuff too.
Ecosystem
Best practices to stay anonymous using Tornado.cash and other mixers and the Tornado UI is now available via IPFS and ENS https://tornadocash.eth.link
Credible neutrality as Vitalik’s design principle, written for the recently launched Nakamoto.com
Tornado launching their mixer is a highlight of 2019 for me. Privacy is such a big issue, and being able to have some ETH that doesn’t show every transaction you’ve ever done is pretty huge. Also the frontend is sweet.
Vitalik wrote a piece for Nakamoto.com which largely answered some of the pedantic criticism he got for a Twitter reply. The funny thing is that the Bitcoin maxis criticizing him were largely the ones misinterpreting, since what Vitalik said was precisely correct.
Also the funniest part of Nakamoto is how triggered some Bitcoin maximalists got. It’s a general crypto site, but in the way Balaji views crypto: a protest system, but with BTC as the base layer. It’s not the way I see crypto - I’d argue BTC is obsolete tech that will soon be relegated to the trashbin of history - but it’s a consistent position.
And the maximalists were so offended, it was pretty amusing. I’d argue it was the opposite: Balaji got a bunch of people not viewed as Bitcoiners to agree that they are holding BTC long-term. The maxis should have been thrilled!
I don’t hold Bitcoin (and certainly not for the long-term!) so that pretty much would exclude me.
Enterprise
UN Secretary General says his institution must embrace blockchain
UN pilot to track cashmere supply chain
At what point do we start the “Ethereum, not blockchain” mantra? Up until this point, 99% of the time that “blockchain” has made the news, it has been about Ethereum.
Either way, the UN appears to be on board. And yes, of course that UN pilot was on Ethereum
Governance
How the “year of the DAO” became the “year of the MolochDAO”
Maker Foundation transfers trademarks and software IP to the Dai Foundation
Vocdoni architecting for private, transmission-agnostic, open to quadratic voting/futarchy/etc
Vocdoni is a very interesting project. They have done a lot of design work into thinking through how to make it a signalling app, with “voting” and “governance” as broadly defined as possible. I’d generally be skeptical about that approach except that I expect that they will use it on the ground in Catalunya, so I imagine they will have the right ideas and iteration necessary.
And it’s undeniable that MolochDAO crushed it this year. They started small, built something that had a very defined use case, and now they’re extending it and have users and a community that wants to continue pushing it forward. More projects could learn from that example.
Application layer
Missed this until now: BULVRD app, trying to compete with Waze
Undercollateralized loans live on Ropsten testnet
Lock, vest, or schedule payouts with Lock Protocol
Lower your counterparty risk in trading Counterstrike: Go skins: Sugarskins
Uniswap average daily volume up 6000% in 2019
Provide Uniswap liquidity while maintaining ETH exposure (understand the risks before you do it)
UEFA tokenizing 20,000 VIP tickets for Euro2020 with AlphaWallet
I’m long on record being a skeptic of tokenized ticketing. This is an interesting project, a small pilot from UEFA to see how it goes (ie, if I recall correctly, there will be a few million VIP tickets for the Euros, which gets you into hospitality tents before the game).
Uniswap is another huge story of 2019. It launched at Devcon last year, so perhaps the crazy growth is less shocking than it seems, but it’s now hard to imagine now being able to go and easily exchange tokens on Uniswap.
Meanwhile some other cool stuff, like BULVRD doing a tokenized Waze, undercollateralized loans (!), automated token vesting and CSGO skin trading.
General
Financial Times: DeFi promises high interest and no middlemen
Linda Xie’s beginner’s guide to DeFi
Nikolai donated 3200 MKR to Carnegie Mellon for game theory research in decentralized applications
A look back at 2019’s major blockchain security incidents. Meanwhile the latest “giving away Eth scam” tactic is hacking a verified Youtuber and changing the account name to impersonate someone in crypto
It’s sad how many Youtube accounts got hacked and all their videos got deleted while scammers tried to impersonate people in crypto. A few tried to impersonate Ethereum Foundation, leading to a few outraged r/Ethereum posts this weeks from fans of hacked Youtubers who thought Ethereum was the one who hacked their favorite Youtuber.
While writing this I just realized that there is likely a link between Nikolai’s donation of 3200 MKR (to be 10k MKR if he’s happy with the program) and Maker Foundation giving the trademarks and IP to the Dai Foundation. Before the big Maker blowup last year, Nikolai had published an admonition to follow the money.
Finally it’s always amusing to me how Week in Ethereum News is not really a beginner-friendly publication (hopefully the annotated edition is a bit more noob-friendly?) and yet whenever I put something that is a beginner’s guide, it gets a lot of clicks.
Something for me to think about, I’d like to help do a better job communicating Ethereum to people.
0 notes
Text
Original Post from FireEye Author: Michael Bailey
It is very unusual for FLARE to analyze a prolifically-used, privately-developed backdoor only to later have the source code and operator tools fall into our laps. Yet this is the extraordinary circumstance that sets the stage for CARBANAK Week, a four-part blog series that commences with this post.
CARBANAK is one of the most full-featured backdoors around. It was used to perpetrate millions of dollars in financial crimes, largely by the group we track as FIN7. In 2017, Tom Bennett and Barry Vengerik published Behind the CARBANAK Backdoor, which was the product of a deep and broad analysis of CARBANAK samples and FIN7 activity across several years. On the heels of that publication, our colleague Nick Carr uncovered a pair of RAR archives containing CARBANAK source code, builders, and other tools (both available in VirusTotal: kb3r1p and apwmie).
FLARE malware analysis requests are typically limited to a few dozen files at most. But the CARBANAK source code was 20MB comprising 755 files, with 39 binaries and 100,000 lines of code. Our goal was to find threat intelligence we missed in our previous analyses. How does an analyst respond to a request with such breadth and open-ended scope? And what did we find?
My friend Tom Bennett and I spoke about this briefly in our 2018 FireEye Cyber Defense Summit talk, Hello, Carbanak! In this blog series, we will expound at length and share a written retrospective on the inferences drawn in our previous public analysis based on binary code reverse engineering. In this first part, I’ll discuss Russian language concerns, translated graphical user interfaces of CARBANAK tools, and anti-analysis tactics as seen from a source code perspective. We will also explain an interesting twist where analyzing the source code surprisingly proved to be just as difficult as analyzing the binary, if not more. There’s a lot here; buckle up!
File Encoding and Language Considerations
The objective of this analysis was to discover threat intelligence gaps and better protect our customers. To begin, I wanted to assemble a cross-reference of source code files and concepts of specific interest.
Reading the source code entailed two steps: displaying the files in the correct encoding, and learning enough Russian to be dangerous. Figure 1 shows CARBANAK source code in a text editor that is unaware of the correct encoding.
Figure 1: File without proper decoding
Two good file encoding guesses are UTF-8 and code page 1251 (Cyrillic). The files were mostly code page 1251 as shown in Figure 2.
Figure 2: Code Page 1251 (Cyrillic) source code
Figure 2 is a C++ header file defining error values involved in backdoor command execution. Most identifiers were in English, but some were not particularly descriptive. Ergo, the second and more difficult step was learning some Russian to benefit from the context offered by the source code comments.
FLARE has fluent Russian speakers, but I took it upon myself to minimize my use of other analysts’ time. To this end, I wrote a script to tear through files and create a prioritized vocabulary list. The script, which is available in the FireEye vocab_scraper GitHub repository, walks source directories finding all character sequences outside the printable lower ASCII range: decimal values 32 (the space character) through 126 (the tilde character “~”) inclusive. The script adds each word to a Python defaultdict_ and increments its count. Finally, the script orders this dictionary by frequency of occurrence and dumps it to a file.
The result was a 3,400+ word vocabulary list, partially shown in Figure 3.
Figure 3: Top 19 Cyrillic character sequences from the CARBANAK source code
I spent several hours on Russian language learning websites to study the pronunciation of Cyrillic characters and Russian words. Then, I looked up the top 600+ words and created a small dictionary. I added Russian language input to an analysis VM and used Microsoft’s on-screen keyboard (osk.exe) to navigate the Cyrillic keyboard layout and look up definitions.
One helpful effect of learning to pronounce Cyrillic characters was my newfound recognition of English loan words (words that are borrowed from English and transliterated to Cyrillic). My small vocabulary allowed me to read many comments without looking anything up. Table 1 shows a short sampling of some of the English loan words I encountered.
Cyrillic
English Phonetic
English
Occurrences
Rank
Файл
f ah y L
file
224
5
сервер
s e r v e r
server
145
13
адрес
a d r e s
address
52
134
команд
k o m a n d
command
110+
27
бота
b o t a
bot
130
32
плагин
p l ah g ee n
plugin
116
39
сервис
s e r v ee s
service
70
46
процесс
p r o ts e s s
process
130ish
63
Table 1: Sampling of English loan words in the CARBANAK source code
Aside from source code comments, understanding how to read and type in Cyrillic came in handy for translating the CARBANAK graphical user interfaces I found in the source code dump. Figure 4 shows a Command and Control (C2) user interface for CARBANAK that I translated.
Figure 4: Translated C2 graphical user interface
These user interfaces included video management and playback applications as shown in Figure 5 and Figure 6 respectively. Tom will share some interesting work he did with these in a subsequent part of this blog series.
Figure 5: Translated video management application user interface
Figure 6: Translated video playback application user interface
Figure 7 shows the backdoor builder that was contained within the RAR archive of operator tools.
Figure 7: Translated backdoor builder application user interface
The operator RAR archive also contained an operator’s manual explaining the semantics of all the backdoor commands. Figure 8 shows the first few commands in this manual, both in Russian and English (translated).
Figure 8: Operator manual (left: original Russian; right: translated to English)
Down the Rabbit Hole: When Having Source Code Does Not Help
In simpler backdoors, a single function evaluates the command ID received from the C2 server and dispatches control to the correct function to carry out the command. For example, a backdoor might ask its C2 server for a command and receive a response bearing the command ID 0x67. The dispatch function in the backdoor will check the command ID against several different values, including 0x67, which as an example might call a function to shovel a reverse shell to the C2 server. Figure 9 shows a control flow graph of such a function as viewed in IDA Pro. Each block of code checks against a command ID and either passes control to the appropriate command handling code, or moves on to check for the next command ID.
Figure 9: A control flow graph of a simple command handling function
In this regard, CARBANAK is an entirely different beast. It utilizes a Windows mechanism called named pipes as a means of communication and coordination across all the threads, processes, and plugins under the backdoor’s control. When the CARBANAK tasking component receives a command, it forwards the command over a named pipe where it travels through several different functions that process the message, possibly writing it to one or more additional named pipes, until it arrives at its destination where the specified command is finally handled. Command handlers may even specify their own named pipe to request more data from the C2 server. When the C2 server returns the data, CARBANAK writes the result to this auxiliary named pipe and a callback function is triggered to handle the response data asynchronously. CARBANAK’s named pipe-based tasking component is flexible enough to control both inherent command handlers and plugins. It also allows for the possibility of a local client to dispatch commands to CARBANAK without the use of a network. In fact, not only did we write such a client to aid in analysis and testing, but such a client, named botcmd.exe, was also present in the source dump.
Tom’s Perspective
Analyzing this command-handling mechanism within CARBANAK from a binary perspective was certainly challenging. It required maintaining tabs for many different views into the disassembly, and a sort of textual map of command ids and named pipe names to describe the journey of an inbound command through the various pipes and functions before arriving at its destination. Figure 10 shows the control flow graphs for seven of the named pipe message handling functions. While it was difficult to analyze this from a binary reverse engineering perspective, having compiled code combined with the features that a good disassembler such as IDA Pro provides made it less harrowing than Mike’s experience. The binary perspective saved me from having to search across several source files and deal with ambiguous function names. The disassembler features allowed me to easily follow cross-references for functions and global variables and to open multiple, related views into the code.
Figure 10: Control flow graphs for the named pipe message handling functions
Mike’s Perspective
Having source code sounds like cheat-mode for malware analysis. Indeed, source code contains much information that is lost through the compilation and linking process. Even so, CARBANAK’s tasking component (for handling commands sent by the C2 server) serves as a counter-example. Depending on the C2 protocol used and the command being processed, control flow may take divergent paths through different functions only to converge again later and accomplish the same command. Analysis required bouncing around between almost 20 functions in 5 files, often backtracking to recover information about function pointers and parameters that were passed in from as many as 18 layers back. Analysis also entailed resolving matters of C++ class inheritance, scope ambiguity, overloaded functions, and control flow termination upon named pipe usage. The overall effect was that this was difficult to analyze, even in source code.
I only embarked on this top-to-bottom journey once, to search for any surprises. The effort gave me an appreciation for the baroque machinery the authors constructed either for the sake of obfuscation or flexibility. I felt like this was done at least in part to obscure relationships and hinder timely analysis.
Anti-Analysis Mechanisms in Source Code
CARBANAK’s executable code is filled with logic that pushes hexadecimal numbers to the same function, followed by an indirect call against the returned value. This is easily recognizable as obfuscated function import resolution, wherein CARBANAK uses a simple string hash known as PJW (named after its author, P.J. Weinberger) to locate Windows API functions without disclosing their names. A Python implementation of the PJW hash is shown in Figure 11 for reference.
def pjw_hash(s): ctr = 0 for i in range(len(s)): ctr = 0xffffffff & ((ctr > 24) ^ ctr) & 0x0fffffff
return ctr
Figure 11: PJW hash
This is used several hundred times in CARBANAK samples and impedes understanding of the malware’s functionality. Fortunately, reversers can use the flare-ida scripts to annotate the obfuscated imports, as shown in Figure 12.
Figure 12: Obfuscated import resolution annotated with FLARE’s shellcode hash search
The CARBANAK authors achieved this obfuscated import resolution throughout their backdoor with relative ease using C preprocessor macros and a pre-compilation source code scanning step to calculate function hashes. Figure 13 shows the definition of the relevant API macro and associated machinery.
Figure 13: API macro for import resolution
The API macro allows the author to type API(SHLWAPI, PathFindFileNameA)(…) and have it replaced with GetApiAddrFunc(SHLWAPI, hashPathFindFileNameA)(…). SHLWAPI is a symbolic macro defined to be the constant 3, and hashPathFindFileNameA is the string hash value 0xE3685D1 as observed in the disassembly. But how was the hash defined?
The CARBANAK source code has a utility (unimaginatively named tool) that scans source code for invocations of the API macro to build a header file defining string hashes for all the Windows API function names encountered in the entire codebase. Figure 14 shows the source code for this utility along with its output file, api_funcs_hash.h.
Figure 14: Source code and output from string hash utility
When I reverse engineer obfuscated malware, I can’t help but try to theorize about how authors implement their obfuscations. The CARBANAK source code gives another data point into how malware authors wield the powerful C preprocessor along with custom code scanning and code generation tools to obfuscate without imposing an undue burden on developers. This might provide future perspective in terms of what to expect from malware authors in the future and may help identify units of potential code reuse in future projects as well as rate their significance. It would be trivial to apply this to new projects, but with the source code being on VirusTotal, this level of code sharing may not represent shared authorship. Also, the source code is accessibly instructive in why malware would push an integer as well as a hash to resolve functions: because the integer is an index into an array of module handles that are opened in advance and associated with these pre-defined integers.
Conclusion
The CARBANAK source code is illustrative of how these malware authors addressed some of the practical concerns of obfuscation. Both the tasking code and the Windows API resolution system represent significant investments in throwing malware analysts off the scent of this backdoor. Check out Part Two of this series for a round-up of antivirus evasions, exploits, secrets, key material, authorship artifacts, and network-based indicators.
#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */
Go to Source Author: Michael Bailey CARBANAK Week Part One: A Rare Occurrence Original Post from FireEye Author: Michael Bailey It is very unusual for FLARE to analyze a prolifically-used,
0 notes
Text
a///nti: “I put ‘a///nti’ in my header because i dont like p///dophilia!”
a////nti: “i dont really know what p////dophilia means i just listen to other people on tunglrrrrs who tell me what to do and say because either im willfully ignorant enough to believe that fictional characters have Human Rights unlike real existing living and breathing people who are detoxxed or get suicide wishes or death threats because they wrote a fictional 18-year-old and 19-year-old making eyes across a room on AO3, or in fear of the blowback of not participating in witchhunt D///iscourse because i might be next and its better someone else suffers in my place l o l so i dont care that im stripping away the truly heinous impact of the word p///dophilia because real world survivors are gross and should die if they don’t listen to me??? but anyway nobody should date unless they were BORN AT THE EXACT SAME MOMENT ON THE EXACT SAME DAY ???????? you cretins how embarrassing p///ee your pants uwu”
0 notes
Text
Original Post from FireEye Author: Michael Bailey
It is very unusual for FLARE to analyze a prolifically-used, privately-developed backdoor only to later have the source code and operator tools fall into our laps. Yet this is the extraordinary circumstance that sets the stage for CARBANAK Week, a four-part blog series that commences with this post.
CARBANAK is one of the most full-featured backdoors around. It was used to perpetrate millions of dollars in financial crimes, largely by the group we track as FIN7. In 2017, Tom Bennett and Barry Vengerik published Behind the CARBANAK Backdoor, which was the product of a deep and broad analysis of CARBANAK samples and FIN7 activity across several years. On the heels of that publication, our colleague Nick Carr uncovered a pair of RAR archives containing CARBANAK source code, builders, and other tools (both available in VirusTotal: kb3r1p and apwmie).
FLARE malware analysis requests are typically limited to a few dozen files at most. But the CARBANAK source code was 20MB comprising 755 files, with 39 binaries and 100,000 lines of code. Our goal was to find threat intelligence we missed in our previous analyses. How does an analyst respond to a request with such breadth and open-ended scope? And what did we find?
My friend Tom Bennett and I spoke about this briefly in our 2018 FireEye Cyber Defense Summit talk, Hello, Carbanak! In this blog series, we will expound at length and share a written retrospective on the inferences drawn in our previous public analysis based on binary code reverse engineering. In this first part, I’ll discuss Russian language concerns, translated graphical user interfaces of CARBANAK tools, and anti-analysis tactics as seen from a source code perspective. We will also explain an interesting twist where analyzing the source code surprisingly proved to be just as difficult as analyzing the binary, if not more. There’s a lot here; buckle up!
File Encoding and Language Considerations
The objective of this analysis was to discover threat intelligence gaps and better protect our customers. To begin, I wanted to assemble a cross-reference of source code files and concepts of specific interest.
Reading the source code entailed two steps: displaying the files in the correct encoding, and learning enough Russian to be dangerous. Figure 1 shows CARBANAK source code in a text editor that is unaware of the correct encoding.
Figure 1: File without proper decoding
Two good file encoding guesses are UTF-8 and code page 1251 (Cyrillic). The files were mostly code page 1251 as shown in Figure 2.
Figure 2: Code Page 1251 (Cyrillic) source code
Figure 2 is a C++ header file defining error values involved in backdoor command execution. Most identifiers were in English, but some were not particularly descriptive. Ergo, the second and more difficult step was learning some Russian to benefit from the context offered by the source code comments.
FLARE has fluent Russian speakers, but I took it upon myself to minimize my use of other analysts’ time. To this end, I wrote a script to tear through files and create a prioritized vocabulary list. The script, which is available in the FireEye vocab_scraper GitHub repository, walks source directories finding all character sequences outside the printable lower ASCII range: decimal values 32 (the space character) through 126 (the tilde character “~”) inclusive. The script adds each word to a Python defaultdict_ and increments its count. Finally, the script orders this dictionary by frequency of occurrence and dumps it to a file.
The result was a 3,400+ word vocabulary list, partially shown in Figure 3.
Figure 3: Top 19 Cyrillic character sequences from the CARBANAK source code
I spent several hours on Russian language learning websites to study the pronunciation of Cyrillic characters and Russian words. Then, I looked up the top 600+ words and created a small dictionary. I added Russian language input to an analysis VM and used Microsoft’s on-screen keyboard (osk.exe) to navigate the Cyrillic keyboard layout and look up definitions.
One helpful effect of learning to pronounce Cyrillic characters was my newfound recognition of English loan words (words that are borrowed from English and transliterated to Cyrillic). My small vocabulary allowed me to read many comments without looking anything up. Table 1 shows a short sampling of some of the English loan words I encountered.
Cyrillic
English Phonetic
English
Occurrences
Rank
Файл
f ah y L
file
224
5
сервер
s e r v e r
server
145
13
адрес
a d r e s
address
52
134
команд
k o m a n d
command
110+
27
бота
b o t a
bot
130
32
плагин
p l ah g ee n
plugin
116
39
сервис
s e r v ee s
service
70
46
процесс
p r o ts e s s
process
130ish
63
Table 1: Sampling of English loan words in the CARBANAK source code
Aside from source code comments, understanding how to read and type in Cyrillic came in handy for translating the CARBANAK graphical user interfaces I found in the source code dump. Figure 4 shows a Command and Control (C2) user interface for CARBANAK that I translated.
Figure 4: Translated C2 graphical user interface
These user interfaces included video management and playback applications as shown in Figure 5 and Figure 6 respectively. Tom will share some interesting work he did with these in a subsequent part of this blog series.
Figure 5: Translated video management application user interface
Figure 6: Translated video playback application user interface
Figure 7 shows the backdoor builder that was contained within the RAR archive of operator tools.
Figure 7: Translated backdoor builder application user interface
The operator RAR archive also contained an operator’s manual explaining the semantics of all the backdoor commands. Figure 8 shows the first few commands in this manual, both in Russian and English (translated).
Figure 8: Operator manual (left: original Russian; right: translated to English)
Down the Rabbit Hole: When Having Source Code Does Not Help
In simpler backdoors, a single function evaluates the command ID received from the C2 server and dispatches control to the correct function to carry out the command. For example, a backdoor might ask its C2 server for a command and receive a response bearing the command ID 0x67. The dispatch function in the backdoor will check the command ID against several different values, including 0x67, which as an example might call a function to shovel a reverse shell to the C2 server. Figure 9 shows a control flow graph of such a function as viewed in IDA Pro. Each block of code checks against a command ID and either passes control to the appropriate command handling code, or moves on to check for the next command ID.
Figure 9: A control flow graph of a simple command handling function
In this regard, CARBANAK is an entirely different beast. It utilizes a Windows mechanism called named pipes as a means of communication and coordination across all the threads, processes, and plugins under the backdoor’s control. When the CARBANAK tasking component receives a command, it forwards the command over a named pipe where it travels through several different functions that process the message, possibly writing it to one or more additional named pipes, until it arrives at its destination where the specified command is finally handled. Command handlers may even specify their own named pipe to request more data from the C2 server. When the C2 server returns the data, CARBANAK writes the result to this auxiliary named pipe and a callback function is triggered to handle the response data asynchronously. CARBANAK’s named pipe-based tasking component is flexible enough to control both inherent command handlers and plugins. It also allows for the possibility of a local client to dispatch commands to CARBANAK without the use of a network. In fact, not only did we write such a client to aid in analysis and testing, but such a client, named botcmd.exe, was also present in the source dump.
Tom’s Perspective
Analyzing this command-handling mechanism within CARBANAK from a binary perspective was certainly challenging. It required maintaining tabs for many different views into the disassembly, and a sort of textual map of command ids and named pipe names to describe the journey of an inbound command through the various pipes and functions before arriving at its destination. Figure 10 shows the control flow graphs for seven of the named pipe message handling functions. While it was difficult to analyze this from a binary reverse engineering perspective, having compiled code combined with the features that a good disassembler such as IDA Pro provides made it less harrowing than Mike’s experience. The binary perspective saved me from having to search across several source files and deal with ambiguous function names. The disassembler features allowed me to easily follow cross-references for functions and global variables and to open multiple, related views into the code.
Figure 10: Control flow graphs for the named pipe message handling functions
Mike’s Perspective
Having source code sounds like cheat-mode for malware analysis. Indeed, source code contains much information that is lost through the compilation and linking process. Even so, CARBANAK’s tasking component (for handling commands sent by the C2 server) serves as a counter-example. Depending on the C2 protocol used and the command being processed, control flow may take divergent paths through different functions only to converge again later and accomplish the same command. Analysis required bouncing around between almost 20 functions in 5 files, often backtracking to recover information about function pointers and parameters that were passed in from as many as 18 layers back. Analysis also entailed resolving matters of C++ class inheritance, scope ambiguity, overloaded functions, and control flow termination upon named pipe usage. The overall effect was that this was difficult to analyze, even in source code.
I only embarked on this top-to-bottom journey once, to search for any surprises. The effort gave me an appreciation for the baroque machinery the authors constructed either for the sake of obfuscation or flexibility. I felt like this was done at least in part to obscure relationships and hinder timely analysis.
Anti-Analysis Mechanisms in Source Code
CARBANAK’s executable code is filled with logic that pushes hexadecimal numbers to the same function, followed by an indirect call against the returned value. This is easily recognizable as obfuscated function import resolution, wherein CARBANAK uses a simple string hash known as PJW (named after its author, P.J. Weinberger) to locate Windows API functions without disclosing their names. A Python implementation of the PJW hash is shown in Figure 11 for reference.
def pjw_hash(s): ctr = 0 for i in range(len(s)): ctr = 0xffffffff & ((ctr > 24) ^ ctr) & 0x0fffffff
return ctr
Figure 11: PJW hash
This is used several hundred times in CARBANAK samples and impedes understanding of the malware’s functionality. Fortunately, reversers can use the flare-ida scripts to annotate the obfuscated imports, as shown in Figure 12.
Figure 12: Obfuscated import resolution annotated with FLARE’s shellcode hash search
The CARBANAK authors achieved this obfuscated import resolution throughout their backdoor with relative ease using C preprocessor macros and a pre-compilation source code scanning step to calculate function hashes. Figure 13 shows the definition of the relevant API macro and associated machinery.
Figure 13: API macro for import resolution
The API macro allows the author to type API(SHLWAPI, PathFindFileNameA)(…) and have it replaced with GetApiAddrFunc(SHLWAPI, hashPathFindFileNameA)(…). SHLWAPI is a symbolic macro defined to be the constant 3, and hashPathFindFileNameA is the string hash value 0xE3685D1 as observed in the disassembly. But how was the hash defined?
The CARBANAK source code has a utility (unimaginatively named tool) that scans source code for invocations of the API macro to build a header file defining string hashes for all the Windows API function names encountered in the entire codebase. Figure 14 shows the source code for this utility along with its output file, api_funcs_hash.h.
Figure 14: Source code and output from string hash utility
When I reverse engineer obfuscated malware, I can’t help but try to theorize about how authors implement their obfuscations. The CARBANAK source code gives another data point into how malware authors wield the powerful C preprocessor along with custom code scanning and code generation tools to obfuscate without imposing an undue burden on developers. This might provide future perspective in terms of what to expect from malware authors in the future and may help identify units of potential code reuse in future projects as well as rate their significance. It would be trivial to apply this to new projects, but with the source code being on VirusTotal, this level of code sharing may not represent shared authorship. Also, the source code is accessibly instructive in why malware would push an integer as well as a hash to resolve functions: because the integer is an index into an array of module handles that are opened in advance and associated with these pre-defined integers.
Conclusion
The CARBANAK source code is illustrative of how these malware authors addressed some of the practical concerns of obfuscation. Both the tasking code and the Windows API resolution system represent significant investments in throwing malware analysts off the scent of this backdoor. Check out Part Two of this series for a round-up of antivirus evasions, exploits, secrets, key material, authorship artifacts, and network-based indicators.
#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */
Go to Source Author: Michael Bailey CARBANAK Week Part One: A Rare Occurrence Original Post from FireEye Author: Michael Bailey It is very unusual for FLARE to analyze a prolifically-used,
0 notes
Text
Original Post from FireEye Author: Michael Bailey
It is very unusual for FLARE to analyze a prolifically-used, privately-developed backdoor only to later have the source code and operator tools fall into our laps. Yet this is the extraordinary circumstance that sets the stage for CARBANAK Week, a four-part blog series that commences with this post.
CARBANAK is one of the most full-featured backdoors around. It was used to perpetrate millions of dollars in financial crimes, largely by the group we track as FIN7. In 2017, Tom Bennett and Barry Vengerik published Behind the CARBANAK Backdoor, which was the product of a deep and broad analysis of CARBANAK samples and FIN7 activity across several years. On the heels of that publication, our colleague Nick Carr uncovered a pair of RAR archives containing CARBANAK source code, builders, and other tools (both available in VirusTotal: kb3r1p and apwmie).
FLARE malware analysis requests are typically limited to a few dozen files at most. But the CARBANAK source code was 20MB comprising 755 files, with 39 binaries and 100,000 lines of code. Our goal was to find threat intelligence we missed in our previous analyses. How does an analyst respond to a request with such breadth and open-ended scope? And what did we find?
My friend Tom Bennett and I spoke about this briefly in our 2018 FireEye Cyber Defense Summit talk, Hello, Carbanak! In this blog series, we will expound at length and share a written retrospective on the inferences drawn in our previous public analysis based on binary code reverse engineering. In this first part, I’ll discuss Russian language concerns, translated graphical user interfaces of CARBANAK tools, and anti-analysis tactics as seen from a source code perspective. We will also explain an interesting twist where analyzing the source code surprisingly proved to be just as difficult as analyzing the binary, if not more. There’s a lot here; buckle up!
File Encoding and Language Considerations
The objective of this analysis was to discover threat intelligence gaps and better protect our customers. To begin, I wanted to assemble a cross-reference of source code files and concepts of specific interest.
Reading the source code entailed two steps: displaying the files in the correct encoding, and learning enough Russian to be dangerous. Figure 1 shows CARBANAK source code in a text editor that is unaware of the correct encoding.
Figure 1: File without proper decoding
Two good file encoding guesses are UTF-8 and code page 1251 (Cyrillic). The files were mostly code page 1251 as shown in Figure 2.
Figure 2: Code Page 1251 (Cyrillic) source code
Figure 2 is a C++ header file defining error values involved in backdoor command execution. Most identifiers were in English, but some were not particularly descriptive. Ergo, the second and more difficult step was learning some Russian to benefit from the context offered by the source code comments.
FLARE has fluent Russian speakers, but I took it upon myself to minimize my use of other analysts’ time. To this end, I wrote a script to tear through files and create a prioritized vocabulary list. The script, which is available in the FireEye vocab_scraper GitHub repository, walks source directories finding all character sequences outside the printable lower ASCII range: decimal values 32 (the space character) through 126 (the tilde character “~”) inclusive. The script adds each word to a Python defaultdict_ and increments its count. Finally, the script orders this dictionary by frequency of occurrence and dumps it to a file.
The result was a 3,400+ word vocabulary list, partially shown in Figure 3.
Figure 3: Top 19 Cyrillic character sequences from the CARBANAK source code
I spent several hours on Russian language learning websites to study the pronunciation of Cyrillic characters and Russian words. Then, I looked up the top 600+ words and created a small dictionary. I added Russian language input to an analysis VM and used Microsoft’s on-screen keyboard (osk.exe) to navigate the Cyrillic keyboard layout and look up definitions.
One helpful effect of learning to pronounce Cyrillic characters was my newfound recognition of English loan words (words that are borrowed from English and transliterated to Cyrillic). My small vocabulary allowed me to read many comments without looking anything up. Table 1 shows a short sampling of some of the English loan words I encountered.
Cyrillic
English Phonetic
English
Occurrences
Rank
Файл
f ah y L
file
224
5
сервер
s e r v e r
server
145
13
адрес
a d r e s
address
52
134
команд
k o m a n d
command
110+
27
бота
b o t a
bot
130
32
плагин
p l ah g ee n
plugin
116
39
сервис
s e r v ee s
service
70
46
процесс
p r o ts e s s
process
130ish
63
Table 1: Sampling of English loan words in the CARBANAK source code
Aside from source code comments, understanding how to read and type in Cyrillic came in handy for translating the CARBANAK graphical user interfaces I found in the source code dump. Figure 4 shows a Command and Control (C2) user interface for CARBANAK that I translated.
Figure 4: Translated C2 graphical user interface
These user interfaces included video management and playback applications as shown in Figure 5 and Figure 6 respectively. Tom will share some interesting work he did with these in a subsequent part of this blog series.
Figure 5: Translated video management application user interface
Figure 6: Translated video playback application user interface
Figure 7 shows the backdoor builder that was contained within the RAR archive of operator tools.
Figure 7: Translated backdoor builder application user interface
The operator RAR archive also contained an operator’s manual explaining the semantics of all the backdoor commands. Figure 8 shows the first few commands in this manual, both in Russian and English (translated).
Figure 8: Operator manual (left: original Russian; right: translated to English)
Down the Rabbit Hole: When Having Source Code Does Not Help
In simpler backdoors, a single function evaluates the command ID received from the C2 server and dispatches control to the correct function to carry out the command. For example, a backdoor might ask its C2 server for a command and receive a response bearing the command ID 0x67. The dispatch function in the backdoor will check the command ID against several different values, including 0x67, which as an example might call a function to shovel a reverse shell to the C2 server. Figure 9 shows a control flow graph of such a function as viewed in IDA Pro. Each block of code checks against a command ID and either passes control to the appropriate command handling code, or moves on to check for the next command ID.
Figure 9: A control flow graph of a simple command handling function
In this regard, CARBANAK is an entirely different beast. It utilizes a Windows mechanism called named pipes as a means of communication and coordination across all the threads, processes, and plugins under the backdoor’s control. When the CARBANAK tasking component receives a command, it forwards the command over a named pipe where it travels through several different functions that process the message, possibly writing it to one or more additional named pipes, until it arrives at its destination where the specified command is finally handled. Command handlers may even specify their own named pipe to request more data from the C2 server. When the C2 server returns the data, CARBANAK writes the result to this auxiliary named pipe and a callback function is triggered to handle the response data asynchronously. CARBANAK’s named pipe-based tasking component is flexible enough to control both inherent command handlers and plugins. It also allows for the possibility of a local client to dispatch commands to CARBANAK without the use of a network. In fact, not only did we write such a client to aid in analysis and testing, but such a client, named botcmd.exe, was also present in the source dump.
Tom’s Perspective
Analyzing this command-handling mechanism within CARBANAK from a binary perspective was certainly challenging. It required maintaining tabs for many different views into the disassembly, and a sort of textual map of command ids and named pipe names to describe the journey of an inbound command through the various pipes and functions before arriving at its destination. Figure 10 shows the control flow graphs for seven of the named pipe message handling functions. While it was difficult to analyze this from a binary reverse engineering perspective, having compiled code combined with the features that a good disassembler such as IDA Pro provides made it less harrowing than Mike’s experience. The binary perspective saved me from having to search across several source files and deal with ambiguous function names. The disassembler features allowed me to easily follow cross-references for functions and global variables and to open multiple, related views into the code.
Figure 10: Control flow graphs for the named pipe message handling functions
Mike’s Perspective
Having source code sounds like cheat-mode for malware analysis. Indeed, source code contains much information that is lost through the compilation and linking process. Even so, CARBANAK’s tasking component (for handling commands sent by the C2 server) serves as a counter-example. Depending on the C2 protocol used and the command being processed, control flow may take divergent paths through different functions only to converge again later and accomplish the same command. Analysis required bouncing around between almost 20 functions in 5 files, often backtracking to recover information about function pointers and parameters that were passed in from as many as 18 layers back. Analysis also entailed resolving matters of C++ class inheritance, scope ambiguity, overloaded functions, and control flow termination upon named pipe usage. The overall effect was that this was difficult to analyze, even in source code.
I only embarked on this top-to-bottom journey once, to search for any surprises. The effort gave me an appreciation for the baroque machinery the authors constructed either for the sake of obfuscation or flexibility. I felt like this was done at least in part to obscure relationships and hinder timely analysis.
Anti-Analysis Mechanisms in Source Code
CARBANAK’s executable code is filled with logic that pushes hexadecimal numbers to the same function, followed by an indirect call against the returned value. This is easily recognizable as obfuscated function import resolution, wherein CARBANAK uses a simple string hash known as PJW (named after its author, P.J. Weinberger) to locate Windows API functions without disclosing their names. A Python implementation of the PJW hash is shown in Figure 11 for reference.
def pjw_hash(s): ctr = 0 for i in range(len(s)): ctr = 0xffffffff & ((ctr > 24) ^ ctr) & 0x0fffffff
return ctr
Figure 11: PJW hash
This is used several hundred times in CARBANAK samples and impedes understanding of the malware’s functionality. Fortunately, reversers can use the flare-ida scripts to annotate the obfuscated imports, as shown in Figure 12.
Figure 12: Obfuscated import resolution annotated with FLARE’s shellcode hash search
The CARBANAK authors achieved this obfuscated import resolution throughout their backdoor with relative ease using C preprocessor macros and a pre-compilation source code scanning step to calculate function hashes. Figure 13 shows the definition of the relevant API macro and associated machinery.
Figure 13: API macro for import resolution
The API macro allows the author to type API(SHLWAPI, PathFindFileNameA)(…) and have it replaced with GetApiAddrFunc(SHLWAPI, hashPathFindFileNameA)(…). SHLWAPI is a symbolic macro defined to be the constant 3, and hashPathFindFileNameA is the string hash value 0xE3685D1 as observed in the disassembly. But how was the hash defined?
The CARBANAK source code has a utility (unimaginatively named tool) that scans source code for invocations of the API macro to build a header file defining string hashes for all the Windows API function names encountered in the entire codebase. Figure 14 shows the source code for this utility along with its output file, api_funcs_hash.h.
Figure 14: Source code and output from string hash utility
When I reverse engineer obfuscated malware, I can’t help but try to theorize about how authors implement their obfuscations. The CARBANAK source code gives another data point into how malware authors wield the powerful C preprocessor along with custom code scanning and code generation tools to obfuscate without imposing an undue burden on developers. This might provide future perspective in terms of what to expect from malware authors in the future and may help identify units of potential code reuse in future projects as well as rate their significance. It would be trivial to apply this to new projects, but with the source code being on VirusTotal, this level of code sharing may not represent shared authorship. Also, the source code is accessibly instructive in why malware would push an integer as well as a hash to resolve functions: because the integer is an index into an array of module handles that are opened in advance and associated with these pre-defined integers.
Conclusion
The CARBANAK source code is illustrative of how these malware authors addressed some of the practical concerns of obfuscation. Both the tasking code and the Windows API resolution system represent significant investments in throwing malware analysts off the scent of this backdoor. Check out Part Two of this series for a round-up of antivirus evasions, exploits, secrets, key material, authorship artifacts, and network-based indicators.
#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */
Go to Source Author: Michael Bailey CARBANAK Week Part One: A Rare Occurrence Original Post from FireEye Author: Michael Bailey It is very unusual for FLARE to analyze a prolifically-used,
0 notes