Barakat’s gists

Barakat / KbdclassFltrDriver.c

Last active September 12, 2023 11:02

Kbdclass kernel filter driver to log scan-codes

	#include <wdm.h>
	#include <ntddkbd.h>

	//
	// Per-device object extension
	//
	typedef struct _DEVICE_EXTENSTION
	{
	//
	// Driver must not be deleted as long as there is a pending IRP

Barakat / Client.c

Created December 12, 2019 10:30

Simple example of using shared memory to shared data between user and the kernel

	/* Run as admin */
	#include <Windows.h>
	#include <stdio.h>

	int main(void)
	{
	const HANDLE SharedSection = OpenFileMappingW(FILE_MAP_READ,
	FALSE,
	L"Global\\ToyDriverSharedSection");

Barakat / Driver.c

Last active October 8, 2023 05:43

sysenter/KiFastCallEntry/IA32_SYSENTER_EIP hooking driver for Windows x86

	//
	// sysenter/KiFastCallEntry/IA32_SYSENTER_EIP hooking driver
	//
	// Barakat Soror (https://twitter.com/barakatsoror)
	//

	#include <wdm.h>
	#include <intrin.h>

	#ifndef _X86_

Barakat / ssdt.c

Last active December 8, 2019 04:06

SSDT hook implementation

	#include <wdm.h>

	#ifndef _X86_
	#error "Only x86 is supported"
	#endif

	//
	// If you disassemble any service, you will see that it moves the service index to EAX in the first
	// instruction. The index is right after the first byte of the MOV opcode. This behavior looks stable
	// and is used by Sysinternals Procmon.

Barakat / simd-dot-product.cpp

Last active March 27, 2019 20:38

Optimized dot product using SSE and AVX

	#include "pch.h"

	#include <xmmintrin.h>
	#include <immintrin.h>
	#include <random>
	#include <chrono>
	#include <chrono>
	#include <functional>
	#include <cstdio>

Barakat / egg-hunter.cpp

Last active August 31, 2019 21:10

Egg hunter shellcode that performs "linear search" looking for an egg shellcode and executes it

	#include <Windows.h>
	#include <cassert>
	#include <cstring>
	#include <cstdio>
	#include <cinttypes>
	#include <random>

	int main()
	{
	static const unsigned char hunter_shellcode[] = {

Barakat / emulator-extended-x64.py

Last active May 4, 2022 10:26

Emulating x64 machine code using Unicorn (A CPU scriptable emulator)

	#!python3
	# -- coding: utf-8 --
	# pip install unicorn
	import unicorn
	import unicorn.x86_const
	import struct


	def required_mapping_size(size):
	page_size = 4096

Barakat / tcpview.cpp

Created February 5, 2019 11:13

TCPView like example. It only displays IP4 TCP connections but you can extend it easily.

	#include <Windows.h>
	#include <iphlpapi.h>
	#include <cstdio>

	#pragma comment(lib, "iphlpapi.lib")

	static void Ip4ToString(DWORD ip4, char ip4_string[16])
	{
	if (ip4 == 0)
	{

Barakat / dnsexfil.py

Created January 28, 2019 08:50

DNS-based exfiltration/tunnelling prototype

	#!python
	# -- coding: utf-8 --
	import struct
	import socket
	import logging
	import sys

	logging.basicConfig(stream=sys.stdout, level=logging.DEBUG)

Barakat / config.h

Last active February 2, 2024 13:18

mbedTLS client and a simple TLS testing server example (with custom config.h), generated Windows x64 executable size ~256KB (mbedTLS + CRT statically linked)

	#ifndef MBEDTLS_CONFIG_H
	#define MBEDTLS_CONFIG_H

	#define MBEDTLS_PLATFORM_C
	#define MBEDTLS_GCM_C
	#define MBEDTLS_PKCS1_V15
	#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
	#define MBEDTLS_SSL_PROTO_TLS1_2
	#define MBEDTLS_AES_C
	#define MBEDTLS_ASN1_PARSE_C

Barakat Barakat