Skip to content

Instantly share code, notes, and snippets.

View PacodiazDG's full-sized avatar
💭
Process Hollowing

Francisco Javier DLG PacodiazDG

💭
Process Hollowing
  • Mexico, Aguascalientes
View GitHub Profile
@PacodiazDG
PacodiazDG / Socket client.kt
Created September 17, 2022 23:11
Socket client.kt
val socket = Socket("192.168.1.66", 8083)
val outputStream = socket.getOutputStream()
val dataOutputStream = DataOutputStream(outputStream)
println("Sending string to the ServerSocket")
dataOutputStream.write("CursorSet:0,0".toByteArray())
dataOutputStream.flush() // Send Buffer
val inFromServer = BufferedReader(InputStreamReader(socket.getInputStream()))
val sentence = inFromServer.readLine();
Log.i("TAGSsssss", sentence);
dataOutputStream.close()
@PacodiazDG
PacodiazDG / _config.cfg
Created June 4, 2022 19:16
config.cfg Euro Truck Simulator 2 Default config file
# modified for camera 0
# prism3d variable config data
uset s_init_intro_music_mute "0"
uset s_init_intro_music_volume "0.5"
uset s_init_ui_music_mute "0"
uset s_init_ui_music_volume "0.5"
uset s_init_master_mute "0"
uset s_init_master_volume "0.75"
uset s_output_driver ""
git clone https://github.com/stanislav-web/OpenDoor.git
go get https://github.com/OJ/gobuster
go get github.com/saeeddhqan/evine
git clone https://github.com/MonroCoury/admin-panel-finder.git
go get github.com/ffuf/ffuf
@PacodiazDG
PacodiazDG / gist:9db3fcdda0a734a0c803474de9b6ccf1
Created August 29, 2020 07:18
VMware Player 15 option “guest isolation” missing
isolation.tools.copy.disable = "FALSE"
isolation.tools.paste.disable = "FALSE"
bios.bootDelay = "2000"
.NET compiler + {SmartAssembly} Obfuscator
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 [ Obfus/Crypted ]
1) HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute
2) HKLM\System\CurrentControlSet\Services (start value of 0 indicates kernel drivers, which load before kernel initiation)
3) HKLM\System\CurrentControlSet\Services (start value of 2, auto-start and 3, manual start via SCM)
4) HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
5) HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
6) HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
7) HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
8) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
9) HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
10) HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell
00401533 | 51 | push ecx |
00401534 | 81EC 34020000 | sub esp,234 |
0040153A | E8 010A0000 | call stack.401F40 |
0040153F | C70424 06404000 | mov dword ptr ss:[esp],stack.404006 | 404006:"kernel32.dll"
00401546 | A1 30614000 | mov eax,dword ptr ds:[<&GetModuleHandle |
0040154B | FFD0 | call eax |
0040154D | 83EC 04 | sub esp,4 |
00401550 | 8945 F4 | mov dword ptr ss:[ebp-C],eax |
00401553 | C74424 04 13404000 | mov dword ptr ss:[esp+4],stack.404013 | 404013:"SetProcessDEPPolicy"
0040155B | 8B45 F4 | mov eax,dword ptr ss:[ebp-C] |
Cross Assembly Obfuscation
Symbol Renaming
Advanced Overload Renaming
String Encryption
Constant Value/Array Encryption
Control Flow Obfuscation
Code Pattern Masking
ILDASM Protection
Anti-Reflection Protection
@PacodiazDG
PacodiazDG / Determining Word Versions of Documents.md
Created May 21, 2020 09:29
Determining Word Versions of Documents

Info version 「docProps \ app.xml」

12.0000 is Office 2007

14.0000 is Office 2010

15.0000 is Office 2013

16.0000 is Office 2016

@PacodiazDG
PacodiazDG / http2_apache2_ubuntu16.04.md
Created May 1, 2020 02:08 — forked from GAS85/http2_apache2_ubuntu16.04.md
How to Enable HTTP/2 in Apache 2.4 on Ubuntu 16.04

Requirements

  • A self-managed VPS or dedicated server with Ubuntu 16.04 running Apache 2.4.xx.
  • For Ubuntu 18.04 please read here --> https://gist.github.com/GAS85/8dadbcb3c9a7ecbcb6705530c1252831
  • A registered domain name with working HTTPS (TLS/SSL). HTTP/2 only works alongside HTTPS because most browsers, including Firefox and Chrome, don’t support HTTP/2 in cleartext (non-TLS) mode.