ELF64 x86-64 PIE, stripped, 43,640 bytes sha256 2d25d2ea313767fae5808164224cf6ad610ab09546d1e5a6f033eedbfd98a281
first-stage loader that installs itself, builds its own tor transport, fetches stage 2 from an .onion, runs it, then goes inactive.
it contains 154 ChaCha20 encrypted strings, see https://gist.github.com/ysf/c1b8cc85f4063367fddb85c443589f5b
first it checks:
| -- An alternative representation of optics. | |
| -- | |
| -- I represent an optic as the set of actions it supports. Composition | |
| -- intersects the sets, which is how e.g. composing a Lens with a Prism gives a | |
| -- Traversal. | |
| {-# LANGUAGE DataKinds, FlexibleContexts, FlexibleInstances, GADTs, KindSignatures, MultiParamTypeClasses, RankNTypes, TypeFamilies, TypeOperators, UndecidableInstances #-} | |
| {-# OPTIONS -Wno-name-shadowing #-} | |
| module Main where | |
| import Test.DocTest |
Monads and delimited control are very closely related, so it isn’t too hard to understand them in terms of one another. From a monadic point of view, the big idea is that if you have the computation m >>= f, then f is m’s continuation. It’s the function that is called with m’s result to continue execution after m returns.
If you have a long chain of binds, the continuation is just the composition of all of them. So, for example, if you have
m >>= f >>= g >>= hthen the continuation of m is f >=> g >=> h. Likewise, the continuation of m >>= f is g >=> h.
An "invertible syntax description" is something that can be used to both parse and generate a syntax.
For example, instead of defining separate toJson and fromJson functions for a given data type, an invertible syntax description could be used to provide both.
There are many Haskell libraries that provide this functionality or something close to it.
As far as I can tell most of them are at least inspired by Invertible syntax descriptions by Tillmann Rendel and Klaus Ostermann.
Personally I am interested in using these for HTTP routing.
I frequently want to be able to define a route such as /episodes/:id.json, dispatch based on that route, and generate links to that route.
Doing so manually is tedious and error prone.
Last reviewed: October 2026 · Tested on: Debian 12.15, Kernel version 6.1.0-53-amd64,
iproute2: 6.1.0-3Conventions:
#= command run as root (or withsudo),$= command run as a normal user. Commands useiproute2(ip,bridge,tc) andnftables(nft). The olderifconfig,brctlandroutetools are deprecated and not used here.
| {-# language | |
| TypeInType, GADTs, RankNTypes, TypeFamilies, | |
| TypeOperators, TypeApplications, | |
| UnicodeSyntax, UndecidableInstances | |
| #-} | |
| import Data.Kind | |
| import Data.Proxy | |
| data Nat = Z | S Nat |
这里的“流量”一般定义为中间人观测到的一组由（时间，方向，包大小）元数据组成的序列 [Cai2014]。其源头是应用层的读写操作，经过传输层协议的变换（分片、协议状态机、加密等），流量序列产生一定变化。但是这种变化非常有限，因为流量的发生过程本质是确定性的，随机因素较小，因此对于特定环境中的特定应用（浏览器访问 google.com）各种流量特征体现出相当大的一致性和独特性，这就使“从流量特征识别应用”的监督学习问题成为可能。虽然有若干不利因素使得确定性下降，例如多层次上软件多版本的排列组合爆炸、有状态的缓存、流水线和连接复用、用户随机行为，但是因为版本的幂律分布、应用层读写操作间的依赖关系、流量特征和检测算法的改进等原因，分类依然具有相当的可行性。
根据分类的对象产生了两个相近但是不同的研究领域。从流量特征中分类应用类型的被称为流量分类（traffic classification），从流量特征中分类所访问网站或者网页的被称为网站指纹（website fingerprinting）。以机器学习的方法而论前者是比后者更弱但本质相同的一个问题。
这两类攻击的威胁类型不同。流量分类威胁的是可用性，如果GFW检出流量是隧道应用然后进行封锁，则破坏了可用性。而网站指纹威胁的是匿名性和隐私，如果从隐秘流量中检出是谁在访问哪个网站，则破坏了匿名性，丝绸之路就是这样被FBI破获的。
Delimited continuations manipulate the control flow of programs. Similar to control structures like conditionals or loops they allow to deviate from a sequential flow of control.
We use exception handling as another example for control flow manipulation and later show how to implement it using delimited continuations. Finally, we show that nondeterminism can also be expressed using delimited continuations.
