mattypiper

#!/usr/bin/python

import sys
from keystone import *
from unicorn import *
from unicorn.arm_const import *
from capstone import *
from capstone.arm import *
from capstone.x86 import *

icewall

def getGUID(ea):
    data1 = idc.GetManyBytes(ea,4)
    data1 = struct.unpack("<I",data1)[0]
    #print "%08x" % (data1)

    ea += 4
    data2 = idc.GetManyBytes(ea,2)
    data2 = struct.unpack("<H",data2)[0]
    #print "%04x" % (data2)

HarmJ0y

#Requires -Version 2

function New-ADPayload {
<#
    .SYNOPSIS

        Stores PowerShell logic in the mSMQSignCertificates of the specified -TriggerAccount and generates
        a one-line launcher.

        Author: @harmj0y

ocean1

# rename functions loading addresses using nm

import idaapi
import idc
from subprocess import Popen, PIPE


def make_func(addr):
    idc.MakeCode(addr)
    idc.MakeFunction(addr)

williballenthin

'''
IDAPython plugin that adds the contents of a file as a new segment in an existing idb.
Prompts the user for:
  - file path
  - segment name
  - segment starting offset
  
Useful for reversing engineering packed software and shellcode.

Author: Willi Ballenthin <[email protected]>

laanwj

Wladimir van der Laan 2016. This document is in the public domain.

BLATSTING reverse-engineering notes. Based on files from the EQGRP free dump,
more specifically in Firewall/BLATSTING/BLATSTING_201381/LP/lpconfig.

In https://musalbas.com/2016/08/16/equation-group-firewall-operations-catalogue.html,
BLATSTING is described as "A firewall software implant that is used with EGREGIOUSBLUNDER
(Fortigate) and ELIGIBLEBACHELOR (TOPSEC)".

If true, it's interesting how this implant can target both vendors. Presumably they both use the same Linux

williballenthin

'''
IDAPython script that generates a YARA rule to match against the
basic blocks of the current function. It masks out relocation bytes
and ignores jump instructions (given that we're already trying to
match compiler-specific bytes, this is of arguable benefit).

If python-yara is installed, the IDAPython script also validates that
the generated rule matches at least one segment in the current file.

author: Willi Ballenthin <[email protected]>

st4rk

''' 
ROP Analyze
Written by St4rk

The code is a total mess and I don't know python (it's one of many reasons 
that I decided to use python here, to learn)
Feel free to modify and do whatever you want
'''

# imports

in7egral

from idc import *
from idaapi import *

def getSysctlSegment():
    addr = 0
    seg = SegByName("__sysctl_set")
    if seg != BADADDR:
        addr = SegByBase(seg)
    return addr

laxa

#!/usr/bin/env python2

from libformatstr import FormatStr
from pwn import *

import binascii
import struct
import time

def p32(addr):