这是一篇笔记式博客，包含了多种仅适用于我本人系统环境的操作与考虑，其中有些已在文内标出，有些则不然。我的系统配置如下：
如果你想跟随本篇博客进行操作，需要准备以下材料：
在 /opt 下创建目录并设置权限。我在这里选择将所有者设置为 csmantle:wheel、目录权限设为 drwxr-sr-x，是为了对齐 /opt 下软件全局所有的设计用途，实践中可以自行考量：
3.13. /opt : Add-on application software packages
3.13.1. Purpose
/optis reserved for the installation of add-on application software packages.– https://refspecs.linuxfoundation.org/FHS_3.0/fhs-3.0.html#optAddonApplicationSoftwarePackages
$ sudo mkdir -p /opt/zeroclaw
$ sudo chown -R csmantle:wheel /opt/zeroclaw
$ sudo find /opt/zeroclaw -type d -exec chmod 2755 {} \;
$ sudo setfacl -R -d -m u::rwx,g::w-x,o::r-x /opt/zeroclaw
进入目录下后进行克隆、签出并构建。我选择的是 v0.1.7 tag，这是当时最新的 tag，读者可以自行选择基提交。
$ cd /opt/zeroclaw
$ git clone -- https://github.com/zeroclaw-labs/zeroclaw.git .
$ git checkout v0.1.7
进行构建。
$ cargo build --release --locked
使用 systemd-nspawn(1) 创建容器。
$ sudo pacstrap -K -c /var/lib/machines/claw base vim less
$ sudo systemd-nspawn -D /var/lib/machines/claw
# logout
之后配置容器内网络。我这里选择使用 NAT 联网，留出 198.18.1.0/24 作为容器网段。使用 systemd-networkd 创建一个虚拟接口。
$ cat <<EOF | sudo tee /etc/systemd/network/10-ve-br0.netdev
[NetDev]
Name=ve-br0
Kind=bridge
EOF
$ cat <<EOF | sudo tee /etc/systemd/network/80-ve-br0.network
[Match]
Name=ve-br0
[Link]
RequiredForOnline=no
[Network]
Address=198.18.1.1/24
DHCPServer=yes
IPv4Forwarding=yes
IPMasquerade=ipv4
ConfigureWithoutCarrier=yes
LLMNR=no
MulticastDNS=no
[DHCPServer]
PoolSize=64
DefaultLeaseTimeSec=1h
MaxLeaseTimeSec=1d
EOF
$ cat <<EOF | sudo tee /etc/systemd/nspawn/claw.nspawn
[Exec]
Boot=yes
ResolvConf=copy-host
[Network]
VirtualEthernet=yes
Bridge=ve-br0
EOF
之后配置防火墙允许 DHCP。我的机器上部署的是 ufw。
$ sudo ufw allow in on ve-br0 to any port 67 proto udp
之后启动 systemd-networkd。这里有一个需要注意的地方：虽然 systemd-networkd 并不会抢占其他网络管理器（比如 NetworkManager(1)）管理的接口，但是其 wait-online 服务 systemd-networkd-wait-online.service 依然会默认开启。如果你的 systemd-networkd 只 管理了虚拟接口，由于虚拟接口永远不会 online，这个服务会超时失败。这时候需要将其禁用。
$ sudo systemctl disable --now systemd-networkd-wait-online.service
$ sudo systemctl mask systemd-networkd-wait-online.service
$ sudo systemctl enable --now systemd-networkd.service
之后将编译好的二进制 bind 至容器内即可。
# /etc/systemd/nspawn/claw.nspawn
[Files]
BindReadOnly=/opt/zeroclaw/target/release/zeroclaw:/usr/local/bin/zeroclaw
BindReadOnly=/opt/zeroclaw:/opt/zeroclaw
进入容器，进行 onboard 并且自定义配置，设置服务。
$ sudo machinectl list
$ sudo machinectl shell claw
# cat <<EOF >/etc/systemd/system/zeroclaw.service
[Unit]
Description=ZeroClaw
[Service]
Type=exec
ExecStart=/usr/local/bin/zeroclaw daemon
User=root
WorkingDirectory=/root
Restart=always
[Install]
WantedBy=multi-user.target
EOF
# zeroclaw onboard
# # Other steps...
# systemctl enable --now zeroclaw.service
在宿主容器内设置开机启动。
$ sudo systemctl enable --now systemd-nspawn@claw.service
之后还可以在容器内配置代理、隧道、工具等，对容器本身还可以进行资源限制，不多赘述。
这些都是只很通用的部署步骤，任何一台 x86 Arch 都可以这么操作，跟龙架构有什么关系？
这才是这个部署流程的关键所在。龙架构生态已经能够大体支持无痛、无缝部署 ZeroClaw，体验上甚至可以与 x86 Arch 并驾齐驱。这离不开龙芯中科与整个龙芯爱好者社区的不懈努力。
当然，以上只是故事的一半……
我最开始尝试的实现是 IronClaw。实际上，在整个踩坑过程中的 90% 时间花在这个部分中。
首先尝试的是原生编译 IronClaw。遗憾的是其依赖 Wasmtime 的 JIT 后端 Cranelift 并不支持龙架构。为 Cranelift 增加新的后端是一个很大的工作，且目前暂无公开社区努力。
之后尝试交叉编译至 x86_64 并使用 QEMU 模拟执行。首先尝试的目标是 x86_64-unknown-linux-gnu，但 Arch4Loong 对非原生架构的支持十分不完善，缺少 ld 等多种必须运行时库。因此尝试 x86_64-unknown-linux-musl，静态编译 OpenSSL 后再使用 Cargo 编译项目。这条路径上的第一个问题是 Arch4Loong 的 x86_64 binutils 和原生 binutils 并不兼容。后者使用 2.46，提供 libsframe.so.3，而前者版本为 2.45，需要 libsframe.so.2。对相关 PKGBUILD 打补丁保留这个 soname 后可以正常工作：
diff --git a/x86_64-linux-gnu-binutils/PKGBUILD b/x86_64-linux-gnu-binutils/PKGBUILD
index 547876b..729ae63 100644
--- a/x86_64-linux-gnu-binutils/PKGBUILD
+++ b/x86_64-linux-gnu-binutils/PKGBUILD
@@ -3,7 +3,7 @@
_target=x86_64-linux-gnu
pkgname=$_target-binutils
pkgver=2.45
-pkgrel=1
+pkgrel=2
pkgdesc='A set of programs to assemble and manipulate binary and object files for 32-bit and 64-bit x86'
arch=(loong64)
url='https://www.gnu.org/software/binutils/'
@@ -90,7 +90,10 @@ package() {
# Remove file conflicting with host binutils and manpages for MS Windows tools
rm "$pkgdir"/usr/share/man/man1/$_target-{dlltool,windres,windmc}*
- rm -rf "$pkgdir"/usr/lib
+ find "$pkgdir"/usr/lib -mindepth 1 \
+ ! -name 'libsframe.so.2' \
+ ! -name 'libsframe.so.2.0.0' \
+ -delete
rm -rf "$pkgdir"/usr/include
之后继续尝试静态编译后，编译产物在 QEMU 下和原生环境下始终出现段错误。再加上其令人担忧的代码质量、onboarding 体验、版本兼容性、修复 bug 的方式等种种因素，最终选择放弃部署 IronClaw。
]]>Please be careful with line endings if you’re copy-pasting the script from below.
If you’re interested in the story behind it, please scroll down to #background-story.
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
#
# POSIX sh-compliant rewrite of reresolve-dns.sh.
#
# Notes for BusyBox-based coreutils:
# * A POSIX-compliant tr(1) is expected for [:upper:] and [:lower:].
#
# Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
# Copyright (C) 2025 Rong Bao <webmaster@csmantle.top>.
#
# Link: https://github.com/WireGuard/wireguard-tools/blob/master/contrib/reresolve-dns/reresolve-dns.sh
# Link: https://gist.github.com/CSharperMantle/ffff2a5e781fe2e4adff22a293315a65#file-reresolve-dns-posix-sh
set -e
export LC_ALL=C
trim() {
echo "$1" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//'
}
lower() {
echo "$1" | tr '[:upper:]' '[:lower:]'
}
CONFIG_FILE="$1"
if echo "$CONFIG_FILE" | grep -qE '^[a-zA-Z0-9_=+.-]{1,15}$'; then
CONFIG_FILE=/etc/wireguard/"$CONFIG_FILE".conf
fi
INTERFACE=$(basename "$CONFIG_FILE" .conf)
PEER_SECTION=0
PUBLIC_KEY=''
ENDPOINT=''
process_peer() {
if [ "$PEER_SECTION" -ne 1 ] || [ -z "$PUBLIC_KEY" ] || [ -z "$ENDPOINT" ]; then
return 0
fi
handshake_line=$(wg show "$INTERFACE" latest-handshakes | grep -F "$PUBLIC_KEY" || true)
if [ -z "$handshake_line" ]; then
return 0
fi
if [ $(( $(date +%s) - $(echo "$handshake_line" | awk '{print $2}') )) -gt 135 ]; then
wg set "$INTERFACE" peer "$PUBLIC_KEY" ENDPOINT "$ENDPOINT"
fi
reset_peer_section
}
reset_peer_section() {
PEER_SECTION=0
PUBLIC_KEY=''
ENDPOINT=''
}
reset_peer_section
while read -r line || [ -n "$line" ]; do
stripped="${line%%\#*}"
raw_key="${stripped%%=*}"
if echo "$stripped" | grep -q '='; then
raw_value="${stripped#*=}"
else
raw_value=''
fi
key=$(lower "$(trim "$raw_key")")
value=$(trim "$raw_value")
case "$key" in
"["*)
process_peer
reset_peer_section
if lower "$key" | grep -qEi '^\[peer\]$'; then
PEER_SECTION=1
fi
;;
*)
if [ $PEER_SECTION -eq 1 ]; then
case "$(lower "$key")" in
publickey) PUBLIC_KEY="$value" ;;
endpoint) ENDPOINT="$value" ;;
esac
fi
;;
esac
done < "$CONFIG_FILE"
process_peer
Recently, I finally decided to setup a lightweight auto-refresher for my WireGuard peers’s DDNS endpoints. A brief search brought me reresolve-dns.sh, an awesome small script written by Jason A. Donenfeld.
I am running WireGuard on several different boxes. I have:
The first two have all the modern amenities available, so I deployed reresolve-dns.sh using systemd timers fairly quickly. The third one is trickier. The coreutils on this OpenWrt distro uses BusyBox by default, so the built-in shell is ash, a barely POSIX-compliant shell without much extra fuss. Its source docs says:
The most complete and most pedantically correct shell included with busybox. This shell is actually a derivative of the Debian ‘dash’ shell (by Herbert Xu), which was created by porting the ‘ash’ shell written by Kenneth Almquist) from NetBSD.
The original reresolve-dns.sh uses quite a lot of Bash features. I also don’t want to break the embedded firmware immutability yet once more, so a rewrite seems natural.
After completing the first draft, I tested it on my OpenWrt box. It didn’t work as expected, for the BusyBox tr(1) utility came with my OpenWrt distro can’t recognize character classes (like [:upper:]). In fact, it does have such feature in its source code, but it’s disabled on OpenWrt builds. Breaking immutability and installing coreutils-tr resolves this issue.
DES 加密算法存在四个弱密钥，分别为：
0x0101010101010101；0xFEFEFEFEFEFEFEFE；0xE0E0E0E0F1F1F1F1；0x1F1F1F1F0E0E0E0E。它们均满足 $\forall x.\ \mathrm{DESEncrypt}(x, K_w) = \mathrm{DESDecrypt}(x, K_w)$。
在记住结论之外，我们也可以使用 Z3 证明弱密钥的存在性，并借此求出所有 $K_w$。
针对完整的 DES 网络直接使用符号求解是不现实的，因此证明的第一步是将弱密钥存在性问题简化至对密钥编排（key schedule）性质的研究上。DES 密钥编排仅包含循环左移与按位置换两种操作，结构较为简单，容易对其使用符号求解器。
记16个轮密钥按顺序组成序列 $\mathrm{DESKeySched}(K) = \{ k_i \}$，我们首先证明以下引理：
引理$K$ 为弱密钥的充要条件为 $\mathrm{DESKeySched}(K)$ 构成回文。
证明由于 DES 算法为 Feistel 结构，可将加密、解密过程改写为：
\[\begin{align} \mathrm{DESEncrypt}(x, K) &= \mathrm{DESNetwork}(x, \mathrm{DESKeySched}(K)) \nonumber \\ &= \mathrm{DESNetwork}(x, \{ k_i \}) \nonumber \\ \mathrm{DESDecrypt}(x, K) &= \mathrm{DESNetwork}(x, \overline{\mathrm{DESKeySched}(K)}) \nonumber \\ &= \mathrm{DESNetwork}(x, \overline{\{ k_i \}}) \nonumber \\ \end{align}\]其中 $\overline{\{ k_i \}}$ 表示逆序。那么显然 $\forall x.\ \mathrm{DESEncrypt}(x, K_w) = \mathrm{DESDecrypt}(x, K_w)$ 等价于 $\{ k_i \} = \overline{\{ k_i \}}$，即轮密钥组成的序列构成回文。
备注维基百科上对弱密钥的描述如下：
DES weak keys produce sixteen identical subkeys.
这个结论初看只是弱密钥的一个充分条件，但根据密钥编排轮函数的性质，可以证明其为充要条件，请读者自行思考。
证明引理后，我们只需要研究是否有密钥能够产生回文轮密钥序列即可。如上文，由于 DES 的密钥编排仅涉及按位置换，可以较为平凡地使用 SMT 求解器实现，因此不难编写一个 Z3 脚本进行计算：
#!/usr/bin/env python3
# SPDX-License-Identifier: BSD-3-Clause
import functools as ft
import z3
def des_keysched_round(i: int, s: z3.BitVecRef) -> tuple[z3.BitVecRef, z3.BitVecRef]:
"""
Args:
i: 1-indexed round count.
s: Ci ++ Di, 56 bits.
Returns:
* ki without permutation but with dropped bits
* s' for next iteration
"""
ROT_AMOUNT = (1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1)
ci, di = z3.Extract(55, 28, s), z3.Extract(27, 0, s)
ci1, di1 = z3.RotateLeft(ci, ROT_AMOUNT[i - 1]), z3.RotateLeft(
di, ROT_AMOUNT[i - 1]
)
s1 = z3.Concat(ci1, di1)
# Ignore bits (1-indexed) 9, 18, 22, 25, 35, 38, 43, 54
# (0-indexed) 8, 17, 21, 24, 34, 37, 42, 53
ki = z3.Concat(
z3.Extract(55, 54, s1),
z3.Extract(52, 43, s1),
z3.Extract(41, 38, s1),
z3.Extract(36, 25, s1),
z3.Extract(23, 22, s1),
z3.Extract(20, 18, s1),
z3.Extract(16, 9, s1),
z3.Extract(7, 0, s1),
)
return (ki, s1)
def des_pc1_inv(x: int) -> int:
# fmt: off
TABLE = (
57, 49, 41, 33, 25, 17, 9,
1, 58, 50, 42, 34, 26, 18,
10, 2, 59, 51, 43, 35, 27,
19, 11, 3, 60, 52, 44, 36,
63, 55, 47, 39, 31, 23, 15,
7, 62, 54, 46, 38, 30, 22,
14, 6, 61, 53, 45, 37, 29,
21, 13, 5, 28, 20, 12, 4,
)
# fmt: on
bits = [(x >> i) & 1 for i in range(55, -1, -1)]
new_bits = [0] * 64
for i, ti in enumerate(TABLE):
new_bits[ti - 1] = bits[i]
for i in range(0, 64, 8):
parity = ft.reduce(lambda acc, b: acc ^ b, new_bits[i : i + 7], 1)
new_bits[i + 7] = parity
return ft.reduce(lambda acc, b: (acc << 1) | b, new_bits)
s0 = z3.BitVec("s0", 56)
k = []
si = s0
for i in range(1, 16 + 1):
ki, si = des_keysched_round(i, si)
k.append(ki)
solver = z3.Solver()
assert len(k) == 16
for i in range(len(k) // 2):
solver.add(k[i] == k[len(k) - i - 1])
sol = []
while solver.check() == z3.sat:
m = solver.model()
s0v = None
for d in m.decls():
if d.name() == "s0":
s0v = m[d].as_long()
assert s0v is not None
sol.append(s0v)
solver.add(s0 != z3.BitVecVal(s0v, 56))
for i, s in enumerate(sol):
print(f"Solution {i}: {hex(des_pc1_inv(s))}")
这里的 des_keysched_round 不是完整的轮函数。由于仅需要判断轮密钥间是否相等，可以在这里省略 PC-2 的置换部分，仅保留其抛弃部分比特的特性即可。
运行求解脚本后即可得到如下四个能够产生回文轮密钥序列的 DES 密钥：
> py.exe -3 ./des-weak-key.py
Solution 0: 0x101010101010101
Solution 1: 0xe0e0e0e0f1f1f1f1
Solution 2: 0xfefefefefefefefe
Solution 3: 0x1f1f1f1f0e0e0e0e
之后借助引理即可推出 DES 弱密钥存在，且上述四个密钥即为全部弱密钥。
]]>Recently, I received an email from Groq titled “Updates to Groq’s Terms & Policies”. I registered on Groq quite a while ago with my Google account, and I didn’t use it ever since. So, I decided to delete my account.
I logged in on their “Console” at console[.]groq[.]com and went to the “Settings” page. I scoured for a button like “Delete Account”, but in vain. Basically, the available tabs on the left were:
“Organization - General” contained a textbox to change the organization name, and another one to copy its ID. “Billing” offered an upgrade to “Developer tier” or “Enterprise tier”. “Profile” allowed me to change my avatar and subscribe to their newsletter. “Data control” let me control how the platform stores and keeps my input to AI models. None of them contained a button to delete my account.
“It’s just hiding somewhere,” I encouraged myself. I went to their “Docs” site at console[.]groq[.]com/docs, and searched the keywords “delete”, “account deletion” and “delete account” using the built-in search. Nothing but irrelevant API references.
I turned to search engines and typed “groq delete account” into the searchbox. The first answer came from “Groq Community”:
Contact support to request account deletion (Visit Groq Console → Click Organization Name on upper righthand corner → Select Chat with us from the dropdown menu). Note that this will permanently remove all API keys, usage history, and account data.
– https://community.groq.com/t/how-do-i-delete-my-groq-account/52
I was on mobile when I did all that. Clicking anything on “upper right corner” opens up a panel which displayed no dropdown menu, less for something called “Chat with us”.
After waking up my laptop I could finally “Chat”. A panel opens up on the lower right corner, saying:
[GroqCloud icon] [avatar 1] [avatar 2] [avatar 3]
Hi there 👋
Questions? Feedback? We’re here to help.
- View API/Model Status
- Check Out Our Documentation
Ask The Community
- Send us a message
I guessed I need to “Send them a message” since Item 1 was not relevant, Item 2 was not helping, and Item 3 led me here.
Hi! 👋 What can we help you with?
Groq • Just now
[Account Question] [Technical Question]
[Rate Limit Increase] [Report an Issue]
[Request a Feature] [Other]
I selected “Account Question”.
What’s going on with your account?
Groq • Just now
[Create an Account] [Upgrade Account]
[Account is Restricted] [Delete Account]
[Billing Questions] [Other]
I selected “Delete Account”.
Thank you for your account deletion request. Please note that if we complete this request, all account and usage data with Groq will be permanently deleted and cannot be recovered. To proceed, we need to first verify your identity. Can you please provide your organization ID below for verification? We are always looking to improve and would appreciate any more context on the reason you’re looking to delete your account. Please share any feedback for Groq and how we could improve in the future.
Groq • Just now
I typed in my “Organization ID” from far above.
… Then, silence.
They could have designed a automated deletion button straight into the Console. After all, nothing can prove the user’s identity more than a valid login.
I haven’t heard from Groq as of this writing. I think I’ll just have to wait until a real, human employee starts working.
]]>本文可供大多数需要将USB设备直通至WSL2虚拟机内的场景参考，并不局限于Canokeys或USB智能卡等话题。
WSL2支持使用usbipd-win实现USB设备直通，可以较为方便地将OpenPGP智能卡直通至虚拟机内供GPG使用，配置方法推荐阅读微软的文章。一般而言，出现类似以下的输出，即可认为USB直通配置正确：
$ lsusb
[...]
Bus 001 Device 005: ID 20a0:42d4 Clay Logic CanoKey Canary
[...]
但是即使设备直通成功，gpg也可能无法找到智能卡：
$ gpg --card-status
gpg: selecting card failed: No such device
gpg: OpenPGP card not available: No such device
运行pcsc_scan可以发现是权限不足：
$ pcsc_scan
PC/SC device scanner
V 1.7.1 (c) 2001-2022, Ludovic Rousseau <ludovic.rousseau@free.fr>
SCardEstablishContext: Access denied.
scdaemon的日志也有类似的问题：
2025-07-17 21:29:29 scdaemon[112573] DBG: chan_7 <- learn
2025-07-17 21:29:29 scdaemon[112573] ccid open error: skip
2025-07-17 21:29:29 scdaemon[112573] check permission of USB device at Bus 001 Device 002
2025-07-17 21:29:29 scdaemon[112573] DBG: chan_7 -> ERR 100696144 No such device <SCD>
2025-07-17 21:29:29 scdaemon[112573] DBG: chan_7 <- RESTART
2025-07-17 21:29:29 scdaemon[112573] DBG: chan_7 -> OK
可以通过创建热插拔规则形式自动配置设备的权限，允许当前用户所在的组（可以使用groups查看，这里选择plugdev组）写入该设备。
sudo tee /etc/udev/rules.d/99-canokey.rules << EOF
SUBSYSTEM=="usb", ATTR{idVendor}=="20a0", ATTR{idProduct}=="42d4", MODE="0664", GROUP="plugdev"
EOF
sudo udevadm control --reload-rules
sudo udevadm trigger
运行后可验证生效：
$ ls -la /dev/bus/usb/*/*
crw-rw-r-- root root 0 B Thu Jul 17 22:22:35 2025 /dev/bus/usb/001/001
crw-rw-r-- root root 0 B Thu Jul 17 22:22:35 2025 /dev/bus/usb/002/001
crw-rw-r-- root plugdev 0 B Thu Jul 17 22:23:04 2025 /dev/bus/usb/001/005
$ gpg --card-status
Reader ...........: 20A0:42D4:013138D7:0
Application ID ...: D276000124010304F1D0013138D70000
Application type .: OpenPGP
Version ..........: 3.4
Manufacturer .....: CanoKeys
[...]
在签名时有可能出现以下错误：
$ git commit --amend -S --no-edit
error: gpg failed to sign the data:
[GNUPG:] KEY_CONSIDERED <...> 0
[GNUPG:] BEGIN_SIGNING H10
[GNUPG:] PINENTRY_LAUNCHED 130663 curses 1.2.1 - xterm-256color :0 - 1000/1000 -
gpg: signing failed: Inappropriate ioctl for device
[GNUPG:] FAILURE sign 83918950
gpg: signing failed: Inappropriate ioctl for device
fatal: failed to write commit object
export GPG_TTY=$(tty)
这样就能够正确显示合适的PIN输入界面。若有需要，也可以修改sudoers文件让sudo保留这个环境变量：
Defaults env_keep += "GPG_TTY"
Features that requires JavaScript:
If you don’t need them, feel free to disable JavaScript entirely when browsing through my site.
]]> ”). This little character is known to cause dozens of software problems, and most of them are attributed to the existing codebase which does not properly quote file paths.
Recently this space started troubling me more than before. Two pieces of software suddenly refused to work. I spent a while diagnosing the bugs, then filed bug reports and patches to the developers:
ERROR_BAD_EXE_FORMAT.
Here’s a TL;DR version for them: Both apps pass the target executable name in a shell command rather than as an image path. For Nushell < 0.105.0 on Windows, it put the bare path in the “commandline” property of the Windows Terminal profile. For vscode-opencl, it runs child_process.exec with bare path and CLI arguments. In both cases, the first fragment delimited by space is recognized as the “real” executable name, and that does not exist of course.
Wait, did I say “suddenly”? Both software worked fine up to a recent time point. That’s not normal, since my username was set long ago. They should either work or break from the very beginning. So I dug deeper and took a look at the “Users” directory. I found a file with the same name as the first fragment of my username:
> ls `C:\Users\` | find "Mantle" | select name type
╭───┬─────────────────────────────────────────────────┬──────╮
│ # │ name │ type │
├───┼─────────────────────────────────────────────────┼──────┤
│ 0 │ C:\Users\Mantle │ file │
│ 1 │ C:\Users\Mantle Bao │ dir │
╰───┴─────────────────────────────────────────────────┴──────╯
>
File #0 is an empty file and not an executable, thus the ERROR_BAD_EXE_FORMAT. So I proposed the three PRs to Nushell upstream that fixes the profile creation. They worked as intended, but one question remains: Why did they work before?
Windows apps call CreateProcess series of functions to load and execute another image. Take CreateProcessW as an example. When an image name (lpApplicationName) is not specified, the command line (lpCommandLine) would be used to specify the executable to run. Here, Windows applies a curious strategy to iteratively determine which executable to run, literally:
For example, consider the string “c:\program files\sub dir\program name”. This string can be interpreted in a number of ways. The system tries to interpret the possibilities in the following order:
- c:\program.exe
- c:\program files\sub.exe
- c:\program files\sub dir\program.exe
- c:\program files\sub dir\program name.exe
I think this is a compatibility and developer experience consideration. Very often developers forget to quote their executable names, and spaces are common in standard Windows paths (like “Program Files”, and “Application Data”, and even mixed with parentheses like “Program Files (x86)”). Having this strategy can handle most misquoted situations and end up finding the right executable. But under some conditions, it could go wrong in a disastrous way.
Suppose an application named “My App” creates a data directory at %APPDATA%\My App\, and drops a helper executable into %APPDATA%\My App\helper.exe. Suppose the developers of this app forget to quote the path and pass it to CreateProcess. An attacker or hacker can create a backdoor executable named My at %APPDATA%\. When the app tries to run the helper executable, the backdoor would be called instead.
How to prevent these from happening? There are three common approaches:
lpCommandLine. This is safer and more user-friendly than the last approach.lpApplicationName, and use lpCommandLine solely for command line arguments. Some quotes may still be needed to help the callee parse the correct argv[0]. This is the safest, as it’s now impossible to have the executable path truncated.But as the developers review their codebase and take whatever approaches above, maybe it’s time for me to switch my username.
]]>With these constants defined…
const a = -3 / 80; const e = 1; const f = 5; const g = 8 / 3; const h = 9 / 10; const i = 1; const l = 11 / 3; const n = 3; const o = 1 / 3; const r = 1; const s = 7 / 3; const t = 10 / 3; const u = 12 / 5; const v = 1; const w = 9 / 5; const x = 18 / 7; const z = 0;… you can write numbers directly and perform arithmetic on it!
console.log(t*w*o + n*i*n*e) // 11 console.log(e*l*e*v*e*n - f*i*v*e) // 6
We can use one of the many nonlinear solvers to produce a number of feasible solutions, with arbitrary number of words taken into consideration. My version uses Z3.py and defines “zero” to “nine”.
import string
import z3
ALPHABET = {ch: z3.Real(f"{ch}") for ch in string.ascii_lowercase}
VALUES = {
"zero": 0,
"one": 1,
"two": 2,
"three": 3,
"four": 4,
"five": 5,
"six": 6,
"seven": 7,
"eight": 8,
"nine": 9,
}
solver = z3.Solver()
for word, value in VALUES.items():
expr: z3.ArithRef = z3.IntVal(1)
for ch in word:
assert ch in ALPHABET
expr = expr * ALPHABET[ch] # type: ignore
solver.add(expr == value)
assert solver.check() == z3.sat
model = solver.model()
for d in model.decls():
name = d.name()
value = model[d]
assert isinstance(value, z3.RatNumRef)
locals()[name] = value.as_fraction()
It can be run as follows and produce the desired output:
# python -i alpha_numeric.py
>>> o*n*e + t*w*o
Fraction(3, 1)
>>> (t*h*r*e*e) / (f*o*u*r)
Fraction(3, 4)
>>> n*i*n*e - s*e*v*e*n
Fraction(2, 1)
>>>
Open question: What is the maximum number of consecutive “words” that can be added to this nonlinear system while maintaining its compatibility (i.e., ensuring it has at least one solution)?
]]>The first step is, as always, obtaining a copy of original game image. If you have an “.app” file, refer to this awesome post to decrypt it into a mountable VHD. An extra note: When you are asked to use ImDisk (Chocolatey), just use it. Don’t use any “remastered” versions. They lack critical features.
These revised scripts utilize MaichartConverter’s built-in database creation feature. That tool has some peculiarities of its own:
The function New-TemporaryDirectory comes from a StackOverflow answer.
param (
[boolean]$Overwrite = $false,
[string]$MusicPath,
[string]$SoundPath,
[string]$OutputPath,
[string]$CriToolsPath,
[string]$EncKey,
[uint32]$Parallelism = 24
)
Get-ChildItem -Path $MusicPath -Directory -Filter "music*" | Foreach-Object -ThrottleLimit $Parallelism -Parallel {
function New-TemporaryDirectory {
$tmp = [System.IO.Path]::GetTempPath() # Not $env:TEMP, see https://stackoverflow.com/a/946017
$name = (New-Guid).ToString("N")
New-Item -ItemType Directory -Path (Join-Path $tmp $name)
}
$music_name = $PSItem.BaseName
if (-not ($music_name -match "^music([0-9]{6})$")) {
Write-Warning "Invalid music name: $music_name"
break
}
$music_id = $Matches.1
$music_id_int = [int]$music_id
if ($music_id_int -ge 10000) {
if (-not ($music_id -match "^[0-9]{2}([0-9]{4})$")) {
Write-Warning "Invalid DX/Party music name: $music_name"
break
}
$music_id = "00$($Matches.1)"
}
$sound_path = "$USING:SoundPath/music$music_id.acb"
if (-not (Test-Path $sound_path -PathType Leaf)) {
Write-Warning "Sound file not found: $sound_path"
break
}
$metadata_path = "$($PSItem.FullName)/Music.xml"
if (-not (Test-Path $metadata_path -PathType Leaf)) {
Write-Warning "Metadata not found: $metadata_path"
break
}
if (-not $USING:Overwrite -and (Test-Path "$USING:OutputPath/music$music_id.mp3" -PathType Leaf)) {
Write-Warning "Skipping existing music$music_id.mp3"
break
}
$tmp_dir = New-TemporaryDirectory
node.exe $USING:CriToolsPath/src/index.js acb2wavs -k $USING:EncKey -o $tmp_dir $sound_path
ffmpeg.exe -hide_banner -loglevel error -i "$tmp_dir/stream_1.wav" -codec:a libmp3lame -qscale:a 2 "$tmp_dir/stream_1.mp3"
Remove-Item "$tmp_dir/stream_1.wav"
Move-Item -Path "$tmp_dir/stream_1.mp3" -Destination "$USING:OutputPath/music$music_id.mp3" -Force
Remove-Item -Path $tmp_dir -Recurse
}
Run this script as follows:
.\Prepare-Maichart-Sound.ps1 -MusicPath "X:/Package/Sinmai_Data/StreamingAssets/A000/music" -SoundPath "X:/Package/Sinmai_Data/StreamingAssets/A000/SoundData" -OutputPath "[Your output path]/sound_out" -CriToolsPath "[Cloned CriTools root]" -EncKey "0x[Your encryption key in HEX]"
param (
[boolean]$Overwrite = $false,
[string]$MusicPath,
[string]$MoviePath,
[string]$OutputPath,
[string]$EncKey,
[uint32]$Parallelism = 2
)
Get-ChildItem -Path $MusicPath -Directory -Filter "music*" | Foreach-Object -ThrottleLimit $Parallelism -Parallel {
function New-TemporaryDirectory {
$tmp = [System.IO.Path]::GetTempPath() # Not $env:TEMP, see https://stackoverflow.com/a/946017
$name = (New-Guid).ToString("N")
New-Item -ItemType Directory -Path (Join-Path $tmp $name)
}
$music_name = $PSItem.BaseName
if (-not ($music_name -match "^music([0-9]{6})$")) {
Write-Warning "Invalid music name: $music_name"
break
}
$music_id = $Matches.1
$music_id_int = [int]$music_id
if ($music_id_int -ge 10000) {
if (-not ($music_id -match "^[0-9]{2}([0-9]{4})$")) {
Write-Warning "Invalid DX/Party music name: $music_name"
break
}
$music_id = "00$($Matches.1)"
}
$metadata_path = "$($PSItem.FullName)/Music.xml"
if (-not (Test-Path $metadata_path -PathType Leaf)) {
Write-Warning "Metadata not found: $metadata_path"
break
}
if (-not $USING:Overwrite -and (Test-Path "$USING:OutputPath/$music_id.mp4" -PathType Leaf)) {
Write-Warning "Skipping existing $music_id.mp4"
break
}
$tmp_dir = New-TemporaryDirectory
wannacri.exe extractusm -k $USING:EncKey -o $tmp_dir "$USING:MoviePath/$music_id.dat"
$movie_export_path = "$tmp_dir/$music_id.dat/videos"
if (-not (Test-Path $movie_export_path -PathType Container)) {
Write-Warning "Exported movie not found: $movie_export_path; ignoring"
continue
}
$movie_file = Get-ChildItem -Path $tmp_dir -Filter "*.ivf" -Recurse
$movie_file = $movie_file.FullName
ffmpeg.exe -hide_banner -loglevel error -stats -hwaccel cuda -i $movie_file -c:v hevc_nvenc -rc:v vbr -cq:v 32 -qmin 30 -qmax 36 -an "$tmp_dir/$music_name.mp4"
Move-Item -Path "$tmp_dir/$music_name.mp4" -Destination "$USING:OutputPath/$music_id.mp4" -Force
Remove-Item -Path $tmp_dir -Recurse
}
Run this script as follows:
.\Prepare-Maichart-Movie.ps1 -MusicPath "X:/Package/Sinmai_Data/StreamingAssets/A000/music" -MoviePath "X:/Package/Sinmai_Data/StreamingAssets/A000/MovieData" -OutputPath "[Your output path]/movie_out" -EncKey "0x[Your encryption key in HEX]"
Seq if you just need a Scala array or container. Use Vec if you want a multiplexer.
scala.collection.immutable.Seq is purely a Scala-land concept. You can index into it via a Int thanks to its apply function.
chisel3.Vec is a hardware container that can be indexed by Scala-land Ints and hardware UInts. It has two apply overloads: apply(idx: Int): T and apply(p: UInt): T. It also have connection operators like :=, allowing for element-wise connection.
Always refer to the (scarce) Chisel documentation when in doubt. If the API in question is not documented (which is very likely), read the source code for its exact behavior.
]]>