Hacker News Reader

Comment by scandox | Hacker News Reader

> because the one thing that I learn as I learn more about computers is that they're basically working "by accident"

So true. Thanks this is good advice. As it happens it is a physical server.

I'm not actually mandated to do anything except replace it with a comparable service but this makes me feel like I'm racing against time!

View on HN

Have you tried decompiling the executable to see if any sensible information can be gained that way?

Everyone's afraid to do anything on that machine at all. So even getting agreement to login or install software or run tcpdump or whatever is fraught.

You need to setup an identical-ish host, could even be in VM so that you can build software that will run on the Ghost Ship. This in and of itself could be difficult, Debian 4?

Using this Shadow Ghost Ship you can build a copy of tcpdump that you can just scp over and run in place. Don't touch the package manager, /etc, /var, anything!

It might not help much but maybe you can get permission to run tcpdump on a machine that talks to the service?

What I was meaning was that if you can get a hold of the binary that is running you could take it to some other environment and have a look (starting with a hex dump and working up from there...).

Mind you if things are that bad then maybe I'd follow my own advice (in another comment) and stay well away from the currently running thing.

this would certainly help recreate the configuration.

Reply on news.ycombinator.com