Barakat’s gists

Barakat / admin.cpp

Created January 11, 2019 09:53

Check if the process running under an admin user. Tested on Windows 95-Windows 10 (checks for elevation on Vista+)

	#include <Windows.h>

	#pragma warning(push)
	#pragma warning(disable: 4996)
	bool RunningAsAdmin()
	{
	OSVERSIONINFOA os_version_information;
	os_version_information.dwOSVersionInfoSize = sizeof(os_version_information);
	GetVersionExA(&os_version_information);

Barakat / Windows95.asm

Created January 19, 2019 08:29

Visual Studio 2005 CRT imports IsDebuggerPresent which is missing on Windows 95. This is a workaround, compile the following code as static library and pass it to the linker before kernel32.lib

	.386
	.model flat

	extern _IsDebuggerPresentProxy@0:proc

	public __imp__IsDebuggerPresent@0
	public _IsDebuggerPresent@0

	.data

Barakat / CNG.cpp

Created January 19, 2019 14:06

Hashing with Cryptography API: Next Generation (CNG)

	#define _WIN32_WINNT 0x0600 // Windows Vista
	#define WIN32_LEAN_AND_MEAN
	#include <windows.h>
	#include <bcrypt.h>
	#include <cstddef>
	#include <memory>
	#include <cassert>

	#pragma comment(lib, "bcrypt.lib")

Barakat / config.h

Last active February 2, 2024 13:18

mbedTLS client and a simple TLS testing server example (with custom config.h), generated Windows x64 executable size ~256KB (mbedTLS + CRT statically linked)

	#ifndef MBEDTLS_CONFIG_H
	#define MBEDTLS_CONFIG_H

	#define MBEDTLS_PLATFORM_C
	#define MBEDTLS_GCM_C
	#define MBEDTLS_PKCS1_V15
	#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
	#define MBEDTLS_SSL_PROTO_TLS1_2
	#define MBEDTLS_AES_C
	#define MBEDTLS_ASN1_PARSE_C

Barakat / dnsexfil.py

Created January 28, 2019 08:50

DNS-based exfiltration/tunnelling prototype

	#!python
	# -- coding: utf-8 --
	import struct
	import socket
	import logging
	import sys

	logging.basicConfig(stream=sys.stdout, level=logging.DEBUG)

Barakat / tcpview.cpp

Created February 5, 2019 11:13

TCPView like example. It only displays IP4 TCP connections but you can extend it easily.

	#include <Windows.h>
	#include <iphlpapi.h>
	#include <cstdio>

	#pragma comment(lib, "iphlpapi.lib")

	static void Ip4ToString(DWORD ip4, char ip4_string[16])
	{
	if (ip4 == 0)
	{

Barakat / emulator-extended-x64.py

Last active May 4, 2022 10:26

Emulating x64 machine code using Unicorn (A CPU scriptable emulator)

	#!python3
	# -- coding: utf-8 --
	# pip install unicorn
	import unicorn
	import unicorn.x86_const
	import struct


	def required_mapping_size(size):
	page_size = 4096

Barakat / egg-hunter.cpp

Last active August 31, 2019 21:10

Egg hunter shellcode that performs "linear search" looking for an egg shellcode and executes it

	#include <Windows.h>
	#include <cassert>
	#include <cstring>
	#include <cstdio>
	#include <cinttypes>
	#include <random>

	int main()
	{
	static const unsigned char hunter_shellcode[] = {

Barakat / simd-dot-product.cpp

Last active March 27, 2019 20:38

Optimized dot product using SSE and AVX

	#include "pch.h"

	#include <xmmintrin.h>
	#include <immintrin.h>
	#include <random>
	#include <chrono>
	#include <chrono>
	#include <functional>
	#include <cstdio>

Barakat / ssdt.c

Last active December 8, 2019 04:06

SSDT hook implementation

	#include <wdm.h>

	#ifndef _X86_
	#error "Only x86 is supported"
	#endif

	//
	// If you disassemble any service, you will see that it moves the service index to EAX in the first
	// instruction. The index is right after the first byte of the MOV opcode. This behavior looks stable
	// and is used by Sysinternals Procmon.

Barakat Barakat