Tils on Qtnes

KUSER_SHARED_DATA quick notes

Wed, 22 Apr 2026 00:00:00 +0000

Today I learned about KUSER_SHARED_DATA: a kernel-populated shared page that user mode can read directly.

User-mode address

User mode reads it at fixed address 0x7FFE0000 (same on x86 and x64).
It is mapped read-only in user mode.
Kernel has a different fixed mapping, but from user-mode reversing, 0x7FFE0000 is the important one.

What is stored there (high value fields)

This structure contains fast-access global OS data, historically heavy on time-related values:

Stripped Go binaries still leak function names via pclntab

Fri, 20 Feb 2026 00:00:00 +0000

Even with -ldflags="-s -w", Go binaries retain the pclntab section which maps PC values to function names. Tools like GoReSym or IDA’s Go helper scripts can recover the full symbol table. “Stripped” means less than you think in Go.

UPX magic bytes can be swapped to block automated unpacking

Fri, 06 Feb 2026 00:00:00 +0000

Standard UPX uses the magic bytes UPX! (0x55505821). Swapping them to anything else (e.g. TRTW / 0x54525457) causes upx -d to throw NotPackedException while the binary still unpacks and runs fine at runtime. Four bytes of friction against automated tools.