This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// | |
// sysenter/KiFastCallEntry/IA32_SYSENTER_EIP hooking driver | |
// | |
// Barakat Soror (https://twitter.com/barakatsoror) | |
// | |
#include <wdm.h> | |
#include <intrin.h> | |
#ifndef _X86_ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/* Run as admin */ | |
#include <Windows.h> | |
#include <stdio.h> | |
int main(void) | |
{ | |
const HANDLE SharedSection = OpenFileMappingW(FILE_MAP_READ, | |
FALSE, | |
L"Global\\ToyDriverSharedSection"); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <wdm.h> | |
#include <ntddkbd.h> | |
// | |
// Per-device object extension | |
// | |
typedef struct _DEVICE_EXTENSTION | |
{ | |
// | |
// Driver must not be deleted as long as there is a pending IRP |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// | |
// Windows x86 Interrupt Descriptor Table (IDT) hook test | |
// | |
// Barakat Soror (https://twitter.com/barakatsoror) | |
// | |
#include <Windows.h> | |
int main(void) | |
{ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!python3 | |
# -*- coding: utf-8 -*- | |
# pip install unicorn | |
import unicorn | |
import unicorn.x86_const | |
def main(): | |
emulation_address = 0x08000000 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!python3 | |
import pefile | |
SYMBOLS_SERVER = 'https://msdl.microsoft.com/download/symbols' | |
def main(): | |
pe = pefile.PE('C:/Windows/System32/kernel32.dll', fast_load=True) | |
pe.parse_data_directories() | |
for directory in pe.DIRECTORY_ENTRY_DEBUG: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
pop rax = flag | |
pop rdi = 0 | |
add rax, rdi | |
mov rdi, rax | |
movzx rdi, BYTE PTR [rdi] | |
pop rax = flag | |
pop rsi = 2 | |
add rax, rsi | |
mov rsi, rax |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import base64 | |
import struct | |
from pwn import * | |
def parse_x64(filename): | |
with open(filename, 'rb') as fp: | |
fp.seek(0x820) | |
character = fp.read(1) | |
fp.seek(0x819) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import cv2 as cv | |
import numpy as np | |
def test(method = (cv.TM_CCOEFF)): | |
img = cv.imread('input.png', 0) | |
fill_color = img[0, 0] | |
width, height = img.shape[:2] | |
fill_color = int(fill_color) |