Skip to content

Instantly share code, notes, and snippets.

View Still34's full-sized avatar

Still / Azaka Still34

176 followers · 11 following
View GitHub Profile
@Still34
Still34 / ConcurrencyTest.cs
Created August 20, 2017 16:59
Concurrency testing
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Threading.Tasks;
namespace TPLPractice
{
public class Program
@Still34
Still34 / 0. Discord.NET FAQ.md
Last active May 18, 2021 16:18
Discord.Net Frequently Asked Questions
@Still34
Still34 / ais3-2019-forensics.md
Last active July 31, 2019 08:32
Ransomware Analysis for AIS3 2019 Forensics

Analysis of Malware Sample (AIS3 2019)

Dynamic analysis

Dynamic analysis is used here first because it is already actively running on victim's machine, so we might as well start from there.

Discovering malicious executable

  • Launch Process Hacker on the victim VM; an anomaly named 5D85C2C17D.exe can be found in the process list.
  • The process is launched with the system, suggesting a daemon service or autorun registry is keeping the process persistent.
    • WhatsInStartup confirms our suspicion
@Still34
Still34 / ConvertTo-Gif.ps1
Created December 16, 2019 10:11
Short PowerShell script to generate GIF from video
function ConvertTo-Gif {
[CmdletBinding()]
param (
[ValidateScript( { test-path -LiteralPath $_ })]
[Parameter(Mandatory = $true)]
$File
)
begin {
# Check if ffmpeg is installed
@Still34
Still34 / resolve-address.py
Last active October 6, 2024 03:19 — forked from xorhex/Resolve APIs - Code Snippet 2 - IDAPython script renaming the dword variables.
IDAPython Script for DWORD Renaming (Compatible with the Latest IDAPython)
import ida_idaapi, ida_kernwin, ida_bytes, ida_name
import sys
import random
import re
if sys.version_info.major == 3:
import tkinter as tk
from tkinter import filedialog
else:
import Tkinter, tkFileDialog
@Still34
Still34 / keybase.md
Created April 17, 2021 01:52
keybase.md

Keybase proof

I hereby claim:

  • I am still34 on github.
  • I am stillaz (https://keybase.io/stillaz) on keybase.
  • I have a public key ASAE-X_di9JfeZuuhsTXYifdFaPJ3Z5dS3mxCYEHyCz3-wo

To claim this, I am signing this object:

@Still34
Still34 / dark-malpedia.user.css
Created June 8, 2021 08:07
/* ==UserStyle==
@name Dark Malpedia
@author Still
@version 1.0.0
@license MIT
@preprocessor default
==/UserStyle== */
@-moz-document domain("malpedia.caad.fkie.fraunhofer.de") {
:root {
--bg-color: hsl(212, 10%, 13%);
@Still34
Still34 / dump-ps1-to-exe.py
Last active June 16, 2023 07:04
Dumps the inner scripts generated by Kodak Faith's PS1/BAT to EXE tool
# Made with <3 by Still/Azaka
# https://links.azaka.fun
import hashlib
import logging
import os
import pathlib
import re
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms
import lief
@Still34
Still34 / MsftDocsUtils.ps1
Created January 23, 2024 06:15
Lookup Win32 APIs from pwsh
# Made with <3 by Still/Azaka
# https://links.azaka.fun
#Requires -Module ps-menu
#Requires -Version 7
$msftDocsCacheDir = [System.IO.Path]::Combine(($env:HOME ?? $env:USERPROFILE), '.msftdocs-cache')
function Update-MsDocsCache
{
$win32Categories = "_ad", "_adam", "_rm", "_adsi", "_alljoyn", "_amsi", "_setup", "_recovery", "_audio", "_automat", "_bits", "_backup", "_battery", "_bltooth", "_bluetooth", "_cimfs", "_cimwin32", "_cloudapi", "_cos", "_com", "_cmpapi", "_coreaudio", "_fs", "_dedup", "_dataxchg", "_debug", "_dwm", "_devlic", "_winprog", "_deviceaccess", "_devinst", "_dlgbox", "_directmanipulation", "_direct2d", "_direct3d10", "_direct3d11", "_direct3d12", "_direct3d9", "_directcomp", "_directdraw", "_directml", "_directwrite", "_dxmath", "_display", "_dfs", "_msdtcwmi", "_dns", "_devtest", "_dxcore", "_direct3ddxgi", "_dhcp", "_enstor", "_etw", "_eventlogprov", "_eaphost", "_eap", "_cluswmi", "_clushyperv", "_fax", "_fsrm", "_gamemode", "_gamingdvcinfo", "_gdiplus", "_policy", "_gpmc", "_hcp"
@Still34
Still34 / nointro-nx.ps1
Last active July 18, 2024 23:57
PowerShell script for generating template for submission info for NX titles
#Requires -Version 7
$Config = [PSCustomObject]@{
NXGameInfoPath = "E:\tools\NXGameInfo-CLI\nxgameinfo_cli.exe"
HashMyFiles = "hashmyfiles.exe"
HacToolNet = "E:\tools\hactoolnet\hactoolnet.exe"
}
if ("NXNativeWin32" -as [type]) {}else {
Add-Type -TypeDefinition @"