Andre Brahic, one of the people who discovered the rings of Neptune, has died aged 73, his publisher says.

Sixteen leaders of banned Islamic Renaissance Party are accused of conspiring to bring down the country's government.

Sixteen leaders of banned Islamic Renaissance Party are accused of conspiring to bring down the country's government.

einar.petersen writes: Danish scientists are seeking to fund their research on the theory of everything in a rather unconventional way, namely via crowdfunding. The two researchers have launched a campaign that as of writing is 55% funded.... "Einstein spent the last 30 years of his life searching for an answer to the deepest question about the universe: does a fundamental principle, that governs all of reality, exist...?" reads their Indiegogo page. "In 2013 we, the theoretical physicist Jesper Moller Grimstrup and the mathematician Johannes Aastrup, discovered a simple mathematical principle, which we believe could be exactly what Einstein was searching for." One Danish newspaper jokes that the mathematician and theoretical physicist "are now offering mere mortals a chance to get in on the action."

Read more of this story at Slashdot.

Russia says NATO's new European anti-missile defence system is a threat to its security.

Russia says NATO's new European anti-missile defence system is a threat to its security.

Python is a powerful and flexible programming language. It is no surprise that it is also used to create malware.

But Windows, the biggest malware target, has no default Python interpreter. When malware.py is delivered to a Windows machine, it most likely will not execute because there is no Python interpreter installed. Python programs can be converted to binary executable files. A popular tool to do this (also popular with malware authors) is PyInstaller. PyInstaller packages a Python program with all its dependencies and a portable Python interpreter into a stand-alone executable (for Windows, but it also supports Linux and OSX).

When PyInstaller is instructed to package a Python program into a single PE file, the resulting .exe is at least 2.8 MB (or more if there are more dependencies). Reversing a 2.8 MB EXE if no small task. But there are appropriate methods that I will highlight in an upcoming diary entry.

Before you can use appropriate methods to reverse an EXE produced by PyInstaller, you need to identify it. There is a simple method if the default option was used to produce the EXE: it includes the logo of PyInstaller as an icon. I also developed a YARA rule:

import pe

rule PE_File_pyinstaller
{
meta:
author = Didier Stevens (https://DidierStevens.com)
description = Detect PE file produced by pyinstaller
strings:
$a = pyi-windows-manifest-filename
condition:
pe.number_of_resources 0 and $a
}

This YARA rule triggers on a PE file with at least one resource containing the string pyi-windows-manifest-filename" />

Didier Stevens
SANS ISC Handler
Microsoft MVP Consumer Security
blog.DidierStevens.com DidierStevensLabs.com
IT Security consultant at Contraste Europe.

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Perl5 access to Berkeley DB version 1.x

Perl5 access to Berkeley DB version 1.x

Short hand for SQL and compact output

Short hand for SQL and compact output

Just a MySQL administration Web-App and CMS System

Recursive diff tools for nested perl structures

Recursive diff tools for nested perl structures

Recursive diff tools for nested perl structures