anch0vy

#아이다에서 프로세스 덤프 분석하기

##준비물

• Process Explorer

• IDA

• windbg

##방법

PurpleBooth

Project Title

One Paragraph of project description goes here

Getting Started

These instructions will get you a copy of the project up and running on your local machine for development and testing purposes. See deployment for notes on how to deploy the project on a live system.

Prerequisites

Neo23x0

This Gist has been transfered into a Github Repo. You'll find the most recent version here.

YARA Performance Guidelines

When creating your rules for YARA keep in mind the following guidelines in order to get the best performance from them. This guide is based on ideas and recommendations by Victor M. Alvarez and WXS.

• Revision 1.4, October 2020, applies to all YARA versions higher than 3.7

jrglee

#!/usr/bin/env python
import sys

a = sys.argv[1].decode("hex")
b = sys.argv[2].decode("hex")

def tohex(v):
  return chr(v).encode("hex")

out = [tohex(ord(x) ^ ord(y)) for (x, y) in zip(a, b)]

revolunet

#
# NB : this is not secure
# from http://code.activestate.com/recipes/266586-simple-xor-keyword-encryption/
# added base64 encoding for simple querystring :)
#

def xor_crypt_string(data, key='awesomepassword', encode=False, decode=False):
    from itertools import izip, cycle
    import base64
    if decode: