Hacker News Reader

Comment by TeMPOraL | Hacker News Reader

> "Technical Note: This file, pocorgtfo15.pdf, is valid as PDF document and as a ZIP file of the relevant source code. Those of you who have laser projection equipment supporting the ILDA standard will find that this issue can be handily projected by your laser beams."

So this file is a PDF that's also a ZIP, and the archive contains - among other things - a song in MP3, and another PDF that's also a Git repo. Oh, and the whole bundle is supposedly laser-projector-compatible (that fact I can't verify - I have no access to such equipment).

I love this <3.

View on HN

Issue 10 is my all-time favorite:

> The polyglot file pocorgtfo10.pdf is valid as a PDF, as a ZIP file, and as an LSMV recording of a Tool Assisted Speedrun (TAS) that exploits Pokémon Red in a Super GameBoy on a Super NES. The result of the exploit is a chat room that plays the text of PoC‖GTFO 10:3. Run it in LSNES with the Gambatte plugin, the Japanese version of the Super Game Boy ROM and the USA/Europe version of Pokémon Red.

This is genuinely brilliant. Thanks for sharing.

For anyone who wants to read the back issues: https://www.alchemistowl.org/pocorgtfo/

Back issues are always included in the current issue, hence the zip. Keep recursing that way (or use binwalk)

As you have a newfound love for file polyglots, have a look at this talk by Ange Albertini, one of the people behind PoC||GTFO

https://www.youtube.com/watch?v=hdCs6bPM4is

Has anyone ever been able to make a polyglot executable file that runs on Windows, Linux, and macOS? (Without cheating by adding a PE loader to Linux or anything like that)

All of those file types use header magic (if for macOS you mean Mach-O), so you can't combine them. For macOS containers (app bundle, DMG), though, you might be able to, depending on how strict the OS is about having random data prepended to the container. But that still won't let you combine PE and ELF.

True, but Linux executes some things that aren't ELF and Windows executes tons of things that aren't PE. I wish someone would come up with something, because how awesome would it be to be able to distribute a single executable for all desktop platforms?

If the goal is any execution, you can do it on older (but still used in some places) Windows versions with COM, or if a) it's possible to construct a minimal executable without non-text characters, or b) there's a scripting engine that accepts non-text characters (raw, not just encoded), you could do it with a script. Off the top of my head I can't think of what else you might run in Windows, but I'm much less familiar with Linux.

Thanks so much for this!

I wrote an ILDA parser in Rust [1], and I also have a virtual EtherDream laser projection DAC (also in Rust [2]) that you can play this against if you're interested.

I'll try to fire this up tonight and see what renders.

[1] https://crates.io/crates/ilda

[2] https://github.com/echelon/etherdream-emulator

The previous issue 0x14 is also a NES ROM that prints its own MD5 hash. That issue was dedicated to fun things to do with MD5 exploits.

Reply on news.ycombinator.com