Ciro Santilli @cirosantilli 37

 Articles (11k) Discussions (24) Comments (52) Follows  Received likes

 New  Updated  Top  Announced  A-Z  Liked  Followed

Bitcoin mining reward  Updated 2025-05-21  +Created 1970-01-01

 Read the full article

Brain simulation  Updated 2025-05-21  +Created 1970-01-01

 View more

www.nature.com/articles/d41586-019-02209-z The four biggest challenges in brain simulation (2019)

 Read the full article

Change (Bitcoin)  Updated 2025-05-21  +Created 1970-01-01

 Read the full article

CIA 2010 covert communication websites / Oleg Shakirov's findings  Updated 2025-05-21  +Created 1970-01-01

 View more

Starting at twitter.com/shakirov2036/status/1746729471778988499, Russian expat Oleg Shakirov comments "Let me know if you are still looking for the Carson website".

He then proceeded to give Carson and 5 other domains in private communication. His name is given here with his consent. His advances besides not being blind were Yandexing for some of the known hits which led to pages that contained other hits:

moyistochnikonlaynovykhigr.com contains a copy of myonlinegamesource.com, and both are present at www.seomastering.com/audit/pefl.ru/, an SEO tracker, because both have backlinks to pefl.ru, which is apparently a niche fantasy football website
4 previously unknown hits from: "Mass Deface III" pastebin. He missed one which Ciro then found after inspecting all URLs on Wayback Machine, so leading to a total of 5 new hits from that source.

Unfortunately, these methods are not very generalizable, and didn't lead to a large number of other hits. But every domain counts!

 Read the full article

Cryogen-free dilution refrigerator  Updated 2025-05-21  +Created 1970-01-01

 Read the full article

Dilution refrigerator manufacturer  Updated 2025-05-21  +Created 1970-01-01

 Read the full article

Eating  Updated 2025-05-21  +Created 1970-01-01

 Read the full article

ELF Hello World Tutorial / Minimal ELF file  Updated 2025-05-21  +Created 1970-01-01

 View more

It is non-trivial to determine what is the smallest legal ELF file, or the smaller one that will do something trivial in Linux.

Some impressive attempts:

In this example we will consider a saner hello world example that will better capture real life cases.

 Read the full article

gem5  Updated 2025-05-21  +Created 1970-01-01

 View more

cirosantilli.com/linux-kernel-module-cheat/gem5

 Read the full article

Length  Updated 2025-05-21  +Created 1970-01-01

 Read the full article

List of cryptocurrency exchanges  Updated 2025-05-21  +Created 1970-01-01

 Read the full article

Silk Road (marketplace)  Updated 2025-05-21  +Created 1970-01-01

 View more

Ciro Santilli has become slightly obsessed with this story, and the main mastermind Ross Ulbricht.

Figure 1.
Ross Ulbricht's open laptop shortly after his arrest at the Francisco Public Library
. Source. He was running some GNOME based distro, could be Ubuntu from that photo, and likely is given that Ross once recommended Ubuntu to his flatmate.

The best article available so far is: www.theregister.co.uk/2019/01/29/how_i_caught_silk_road_mastermind (archive) which summarizes what one of the investigators said in a 2019 French computer security conference.

The key living posts are:

stackoverflow.com/questions/15445285/how-can-i-connect-to-a-tor-hidden-service-using-curl-in-php (archive) which was originally asked under the real name, and then the username was changed to "Frosty", which matches one of the server's logins after the laptop was captured
altoid early Silk Road mention: bitcointalk.org/?topic=175.70;wap2 (archive)

The big question is of course how libertarian free market ideologically motivated the website was, and how purely criminal greed it was.

The magnitude of the early operational security mistakes does make Ciro think that Ross did it "because he could" and "for the lolz" in a real world Breaking Bad way.

The entry in Ross' diary does resonate a lot with Ciro and any entrepreneur, full diary at: www.wired.com/2015/01/heres-secret-silk-road-journal-laptop-ross-ulbricht/ (archive).

[i]n 2011," [I believe I will be] "creating a year of prosperity and power beyond what I have ever experienced before,
Silk Road is going to become a phenomenon and at least one person will tell me about it, unknowing that I was its creator."

Having this kind of feeling, is the greatest thing any human can have, and what motivates all great things.

Capitalizing in illegal things though is a cheat, big things take longer than a few years to reach, but reaching them is that much more satisfying as well.

Other interesting quotes:

I hated working for someone else and trading my time for money with no investment in myself.

which Ciro also feels, see don't be a pussy, and:

Everyone knows I am working on a bitcoin exchange. I always thought honesty was the best policy and now I didn't know what to do. I should have just told everyone I am a freelance programmer or something, but I had to tell half truths. It felt wrong to lie completely so I tried to tell the truth without revealing the bad part, but now I am in a jam. Everyone knows too much. Dammit.

Also very worth reading is the San Francisco flat mate account: www.vice.com/en_us/article/ae3q8g/my-roommate-the-darknet-drug-lord (archive).

The murder for hire allegations are also interesting: mashable.com/2013/10/03/silk-road-hits, he paid 80k dollars to undercover DEA agents!

Except for the fact that Ross was an 80 million Dollar drug lord, those accounts sound exactly like what you would expect from any other nerdy startup founder! The:

"just do it" strategy effectively going to a minimal viable product (manual transaction management!), while making many mistakes along the way, including hiring mistakes and successes when scaling is needed
the hardship of self bootstrapping your own social network (here with some kilos of mushrooms)
the variety of periods, from relatively calm, to hair pulling stress during big changes

It is also amusing to see very concretely the obvious fact that the FBI can get a subpoena for all accounts you ever had, e.g. they knew his laptop model from Amazon and brought a corresponding power cable to the arrest! If you are going to be a cyber criminal, don't use your real name, ever!

Should justice be blind? Maybe. But it does hurt for mere non-blind men to see it sometimes. Especially when drug liberalization is involved.

Video 1.

One Mistake Took Down a 29-Yr-Old Dark Web Drug Lord by Newsthink (2022)

Source. Wow nice video, covers most of the interesting annecdotes and the (alledged) investigation procedure.

 Read the full article

Stored procedure  Updated 2025-05-21  +Created 1970-01-01

 Read the full article

Block reward  Updated 2025-05-21  +Created 1970-01-01

 Read the full article

ELF Hello World Tutorial / ELF header  Updated 2025-05-21  +Created 1970-01-01

 View more

Running:

readelf -h hello_world.o

outputs:

Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
Class:                             ELF64
Data:                              2's complement, little endian
Version:                           1 (current)
OS/ABI:                            UNIX - System V
ABI Version:                       0
Type:                              REL (Relocatable file)
Machine:                           Advanced Micro Devices X86-64
Version:                           0x1
Entry point address:               0x0
Start of program headers:          0 (bytes into file)
Start of section headers:          64 (bytes into file)
Flags:                             0x0
Size of this header:               64 (bytes)
Size of program headers:           0 (bytes)
Number of program headers:         0
Size of section headers:           64 (bytes)
Number of section headers:         7
Section header string table index: 3

Running:

readelf -h hello_world.out

outputs:

Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
Class:                             ELF64
Data:                              2's complement, little endian
Version:                           1 (current)
OS/ABI:                            UNIX - System V
ABI Version:                       0
Type:                              EXEC (Executable file)
Machine:                           Advanced Micro Devices X86-64
Version:                           0x1
Entry point address:               0x4000b0
Start of program headers:          64 (bytes into file)
Start of section headers:          272 (bytes into file)
Flags:                             0x0
Size of this header:               64 (bytes)
Size of program headers:           56 (bytes)
Number of program headers:         2
Size of section headers:           64 (bytes)
Number of section headers:         6
Section header string table index: 3

Bytes in the object file:

00000000  7f 45 4c 46 02 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
00000010  01 00 3e 00 01 00 00 00  00 00 00 00 00 00 00 00  |..>.............|
00000020  00 00 00 00 00 00 00 00  40 00 00 00 00 00 00 00  |........@.......|
00000030  00 00 00 00 40 00 00 00  00 00 40 00 07 00 03 00  |....@.....@.....|

Executable:

00000000  7f 45 4c 46 02 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
00000010  02 00 3e 00 01 00 00 00  b0 00 40 00 00 00 00 00  |..>.......@.....|
00000020  40 00 00 00 00 00 00 00  10 01 00 00 00 00 00 00  |@...............|
00000030  00 00 00 00 40 00 38 00  02 00 40 00 06 00 03 00  |....@.8...@.....|

Structure represented:

# define EI_NIDENT 16

typedef struct {
    unsigned char   e_ident[EI_NIDENT];
    Elf64_Half      e_type;
    Elf64_Half      e_machine;
    Elf64_Word      e_version;
    Elf64_Addr      e_entry;
    Elf64_Off       e_phoff;
    Elf64_Off       e_shoff;
    Elf64_Word      e_flags;
    Elf64_Half      e_ehsize;
    Elf64_Half      e_phentsize;
    Elf64_Half      e_phnum;
    Elf64_Half      e_shentsize;
    Elf64_Half      e_shnum;
    Elf64_Half      e_shstrndx;
} Elf64_Ehdr;

Manual breakdown:

0 0: EI_MAG = 7f 45 4c 46 = 0x7f 'E', 'L', 'F': ELF magic number
0 4: EI_CLASS = 02 = ELFCLASS64: 64 bit elf
0 5: EI_DATA = 01 = ELFDATA2LSB: little endian data
0 6: EI_VERSION = 01: format version
0 7: EI_OSABI (only in 2003 Update) = 00 = ELFOSABI_NONE: no extensions.
0 8: EI_PAD = 8x 00: reserved bytes. Must be set to 0.
1 0: e_type = 01 00 = 1 (big endian) = ET_REl: relocatable format
On the executable it is 02 00 for ET_EXEC.
Another important possibility for the executable is ET_DYN for PIE executables and shared libraries.
ET_DYN tells the Linux kernel that the code is position independent, and can loaded at a random memory location with ASLR.
This is explained further at:
- stackoverflow.com/questions/2463150/what-is-the-fpie-option-for-position-independent-executables-in-gcc-and-ld/51308031#51308031
- stackoverflow.com/questions/34519521/why-does-gcc-create-a-shared-object-instead-of-an-executable-binary-according-to/55704865#55704865
1 2: e_machine = 3e 00 = 62 = EM_X86_64: AMD64 architecture
1 4: e_version = 01 00 00 00: must be 1
1 8: e_entry = 8x 00: execution address entry point, or 0 if not applicable like for the object file since there is no entry point.
On the executable, it is b0 00 40 00 00 00 00 00. The kernel puts the RIP directly on that value when executing. It can be configured by the linker script or -e. But it will segfault if you set it too low: stackoverflow.com/questions/2187484/why-is-the-elf-execution-entry-point-virtual-address-of-the-form-0x80xxxxx-and-n
2 0: e_phoff = 8x 00: program header table offset, 0 if not present.
40 00 00 00 on the executable, i.e. it starts immediately after the ELF header.
2 8: e_shoff = 40 7x 00 = 0x40: section header table file offset, 0 if not present.
3 0: e_flags = 00 00 00 00 Arch specific. i386 docs say:
The Intel386 architecture defines no flags; so this member contains zero.
3 4: e_ehsize = 40 00: size of this elf header. TODO why this field needed? Isn't the size fixed?
3 6: e_phentsize = 00 00: size of each program header, 0 if not present.
38 00 on executable: it is 56 bytes long
3 8: e_phnum = 00 00: number of program header entries, 0 if not present.
02 00 on executable: there are 2 entries.
3 A: e_shentsize and e_shnum = 40 00 07 00: section header size and number of entries
3 E: e_shstrndx (Section Header STRing iNDeX) = 03 00: index of the .shstrtab section.