😶

Alexander Hanel alexander-hanel

😶

DanielRTeixeira / example.sct

Created November 2, 2017 15:21 — forked from nicholasmckinney/example.sct

SCT File Obfuscation Examples:

	<?XML version="1.0"?>
	<scriptlet>
	<registration
	progid="PoC"
	classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
	<!-- Proof Of Concept - Casey Smith @subTee -->
	<!-- License: BSD3-Clause -->
	<script language="JScript">
	<![CDATA[
	//x86 only. C:\Windows\Syswow64\regsvr32.exe /s /u /i:file.sct scrobj.dll

tophertimzen / CreateThread.asm

Last active June 14, 2022 00:45

Make a new Thread with Windows PEB -> Function Hash Resolver

	; Topher Timzen
	; Messing around with PE backdooring for CTP/OSCE and wanted to make a new thread inside of process to avoid synchronization issues.
	; Tons of NULL as I used this in a PE directly, no need to avoid them.
	; nasm CreateThread.asm -o CreateThread.raw; xxd -p CreateThread.raw \| tr -d '\n'

	[BITS 32]

	[SECTION .text]
	global _start

williballenthin / vb-ref.md

Last active December 27, 2019 01:59

references:

countercept / dotnet-runtime-etw.py

Last active August 22, 2023 16:02

A research aid for tracing security relevant events in the CLR via ETW for detecting malicious assemblies.

	import time
	import etw
	import etw.evntrace
	import sys
	import argparse
	import threading


	class RundownDotNetETW(etw.ETW):
	def __init__(self, verbose, high_risk_only):

mattifestation / NiftyETWProviders.json

Created December 21, 2018 19:27

ETW providers you never knew existed...

	[
	{
	"ProviderGUID": "72d164bf-fd64-4b2b-87a0-62dbcec9ae2a",
	"ProviderName": "AccEventTool",
	"ProviderGroupGUID": "4f50731a-89cf-4782-b3e0-dce8c90476ba",
	"AssociatedFilenames": [
	"accevent.exe",
	"inspect.exe",
	"narrator.exe",
	"srh.dll"

cmatthewbrooks / hello_world_plugin.py

Created April 25, 2019 12:41

The simplest possible IDA plugin with multiple actions

	##############################################################################
	#
	# Name: hello_world_plugin.py
	# Auth: @cmatthewbrooks
	# Desc: A test plugin to learn how to make these work; Specifically, how to
	# have multiple actions within the same plugin.
	#
	# In plain English, IDA will look for the PLUGIN_ENTRY function which
	# should return a plugin object. This object can contain all the
	# functionality itself, or it can have multiple actions.

lucasg / ida_get_guid.py

Created June 13, 2019 14:43

Read memory as GUID via IDA

	import ida_bytes
	import binascii

	def get_guid(address):

	data1 = ida_bytes.get_dword(address)
	data2 = ida_bytes.get_word(address + 4)
	data3 = ida_bytes.get_word(address + 6)
	data4 = ida_bytes.get_bytes(address + 8, 8)