😶

Alexander Hanel alexander-hanel

😶

152 followers · 94 following

Lafayette, Colorado USA
http://hooked-on-mnemonics.blogspot.com/

View GitHub Profile

Recently created

Least recently created

Recently updated

Least recently updated

OALabs / revil_strings.py

Created January 26, 2020 22:13

Decrypt REvil ransomware strings with IDA Python

	import idaapi, idc, idautils


	class DecryptorError(Exception):
	pass


	def rc4crypt(key, data):
	x = 0
	box = range(256)

jymcheong / Program.cs

Created December 19, 2019 08:06

C# ETW Example

	using System;
	using System.Diagnostics;
	using Microsoft.Diagnostics.Tracing;
	using Microsoft.Diagnostics.Tracing.Session;
	using Microsoft.Diagnostics.Tracing.Parsers;
	using System.IO;
	using System.Collections.Generic;
	using System.Reflection;
	using Newtonsoft.Json;

icecr4ck / idapython_cheatsheet.md

Last active May 4, 2025 00:07

Cheatsheet for IDAPython

IDAPython cheatsheet

Important links

Basic commands

Get informations on the binary

MattPD / analysis.draft.md

Last active April 12, 2025 10:15

Program Analysis Resources (WIP draft)

Program Analysis Resources

(draft; work in progress)

IDA Microcode notes

References

Ilfak's presentation at Recon 2018
Microcode in pictures
Hex-Rays Microcode API vs. Obfuscating Compiler
Scripts vds10, vds11, vds12 and vds13 from Hex-Rays SDK

Implementation

lucasg / ida_get_guid.py

Created June 13, 2019 14:43

Read memory as GUID via IDA

	import ida_bytes
	import binascii

	def get_guid(address):

	data1 = ida_bytes.get_dword(address)
	data2 = ida_bytes.get_word(address + 4)
	data3 = ida_bytes.get_word(address + 6)
	data4 = ida_bytes.get_bytes(address + 8, 8)

cmatthewbrooks / hello_world_plugin.py

Created April 25, 2019 12:41

The simplest possible IDA plugin with multiple actions

	##############################################################################
	#
	# Name: hello_world_plugin.py
	# Auth: @cmatthewbrooks
	# Desc: A test plugin to learn how to make these work; Specifically, how to
	# have multiple actions within the same plugin.
	#
	# In plain English, IDA will look for the PLUGIN_ENTRY function which
	# should return a plugin object. This object can contain all the
	# functionality itself, or it can have multiple actions.

mattifestation / NiftyETWProviders.json

Created December 21, 2018 19:27

ETW providers you never knew existed...

	[
	{
	"ProviderGUID": "72d164bf-fd64-4b2b-87a0-62dbcec9ae2a",
	"ProviderName": "AccEventTool",
	"ProviderGroupGUID": "4f50731a-89cf-4782-b3e0-dce8c90476ba",
	"AssociatedFilenames": [
	"accevent.exe",
	"inspect.exe",
	"narrator.exe",
	"srh.dll"

countercept / dotnet-runtime-etw.py

Last active August 22, 2023 16:02

A research aid for tracing security relevant events in the CLR via ETW for detecting malicious assemblies.

	import time
	import etw
	import etw.evntrace
	import sys
	import argparse
	import threading


	class RundownDotNetETW(etw.ETW):
	def __init__(self, verbose, high_risk_only):

williballenthin / vb-ref.md

Last active December 27, 2019 01:59

references:

Newer Older