YSaxon

"""Windows port of mac_usbscan.py.

Uses the built-in PnpDevice PowerShell module (Get-PnpDevice /
Get-PnpDeviceProperty) instead of `ioreg` to enumerate USB devices and,
for composite devices, their child interfaces. No admin rights or third
party packages required.

Notes on fidelity vs. the macOS version:
  - "Serial" is the last path segment of the PnP instance ID. Devices
    without a real USB serial number get a synthetic ID from Windows

YSaxon

import subprocess
import re
import shutil
import argparse
import time
from datetime import datetime


def _parse_field(line, key, as_int=True):
    """Extract a field value from an ioreg property line."""

YSaxon

# DatadivDecoder.py
# @category Data
# @menupath Tools.Deobfuscation.Decode .datadiv_decode XOR data
# @toolbar

# I wrote this script myself in Jython a few years ago and just had chatgpt port it to pyghidra

import re
import os
import traceback

YSaxon

#via opus 4.6

import subprocess
import re
import shutil
import argparse
import time
from datetime import datetime

YSaxon

test
http://example.com
content://settings/secure
intent:#Intent;action=android.settings.MANAGE_UNKNOWN_APP_SOURCES;end
https://f-droid.org/repo/de.szalkowski.activitylauncher_46.apk
intent://settings/#Intent;scheme=android-settings;end
market://details?id=com.android.settings
intent://com.android.settings/#Intent;scheme=android-app;end

YSaxon

export GHIDRA_HOME=$(dirname $(readlink -f  $(which ghidraRun)))

YSaxon

# Add this to your zshrc etc

# modified from #http://broken-by.me/lazy-load-nvm/

setup_nvm(){
    unset -f nvm node npm

    export NVM_DIR="$HOME/.nvm"
    [ -s "/opt/homebrew/opt/nvm/nvm.sh" ] && \. "/opt/homebrew/opt/nvm/nvm.sh"  # This loads nvm
    [ -s "/opt/homebrew/opt/nvm/etc/bash_completion.d/nvm" ] && \. "/opt/homebrew/opt/nvm/etc/bash_completion.d/nvm"  # This loads nvm bash_completion

YSaxon

Initial setup (paths are assuming an Android target but you can obviously modify it)

cat << EOF > /data/local/tmp/shell1.sh
echo echo START >> /data/local/tmp/shell/infile
tail -n 1 -f /data/local/tmp/shell/infile | sh -i >> /data/local/tmp/shell/outfile 2>>/data/local/tmp/shell/outfile
EOF

chmod +x /data/local/tmp/shell1.sh

mkdir /data/local/tmp/shell

YSaxon

Analyzing Cortex-M Firmware Binary Files with Ghidra

Opening the Firmware Binary

1. Open the firmware binary in Ghidra

Establishing the Initial Memory Offset

1. Go to the data view and copy all the string addresses, and paste them into a Jupyter notebook with the code below
2. Sort and copy all the possible pointers (probably undefined4 type) similarly

YSaxon

def find_and_extract_dex(file_path, output_path):
    try:
        with open(file_path, 'rb') as file:
            data = file.read()

        # DEX file header magic number and offset for file size
        dex_magic = b'dex\n'
        size_offset = 32
        size_length = 4