panda bear 0xcpu

Disassembling 1bitsy examples using radare2

Note that because radare2 uses Capstone to disassemble ARM code, there are issues with the disassembly. arm-none-eabi-objdump -d compiledbinary.elf actually does a better job in some cases. For example, msr isn't decompiled correctly...

First, you have to either strip the default ELF binaries the default Makefiles build when you run make OR you need to just compile .bin files using something like:

make binaryname.bin

Understanding the Memory Layout of Linux Executables

Required tools for playing around with memory:

hexdump
objdump
readelf
xxd
gcore

Moved to git repository: https://github.com/denji/golang-tls

Generate private key (.key)

# Key considerations for algorithm "RSA" ≥ 2048-bit
openssl genrsa -out server.key 2048

# Key considerations for algorithm "ECDSA" ≥ secp384r1
# List ECDSA the supported curves (openssl ecparam -list_curves)

	import os
	import sys
	import logging

	import pefile
	import ucutils
	import unicorn
	import capstone
	import argparse

	#include <Windows.h>
	#include <time.h>

	#include <string>
	using namespace std;

	#define BTF_FLAG 0x300
	#define TRAP_FLAG 0x100

	LONG CALLBACK TraceCallback(LPEXCEPTION_POINTERS ex)

	function Get-InjectedThread
	{
	<#

	.SYNOPSIS

	Looks for threads that were created as a result of code injection.

	.DESCRIPTION

	# Logparser


	###############
	# Security Log
	###############

	# Find Event id
	& 'C:\Program Files (x86)\Log Parser 2.2\LogParser.exe' -stats:OFF -i:EVT "SELECT * FROM 'Security.evtx' WHERE EventID = '5038'"

	###########################################################################
	# Rotating bits (tested with Python 2.7)

	from __future__ import print_function # PEP 3105

	# max bits > 0 == width of the value in bits (e.g., int_16 -> 16)

	# Rotate left: 0b1001 --> 0b0011
	rol = lambda val, r_bits, max_bits: \
	(val << r_bits%max_bits) & (2**max_bits-1) \| \

	#!/usr/bin/python
	#
	#
	# Decompling something being loaded in through powershell
	#
	#
	# diff <[email protected]>
	#

	#

	#!/bin/sh
	# Convert a raw binary image into an ELF file suitable for loading into a disassembler

	cat > raw$$.ld <<EOF
	SECTIONS
	{
	EOF

	echo " . = $3;" >> raw$$.ld