Skip to content

Instantly share code, notes, and snippets.

View alexander-hanel's full-sized avatar
😶

Alexander Hanel alexander-hanel

😶
View GitHub Profile
@tophertimzen
tophertimzen / CreateThread.asm
Last active June 14, 2022 00:45
Make a new Thread with Windows PEB -> Function Hash Resolver
; Topher Timzen
; Messing around with PE backdooring for CTP/OSCE and wanted to make a new thread inside of process to avoid synchronization issues.
; Tons of NULL as I used this in a PE directly, no need to avoid them.
; nasm CreateThread.asm -o CreateThread.raw; xxd -p CreateThread.raw | tr -d '\n'
[BITS 32]
[SECTION .text]
global _start
@DanielRTeixeira
DanielRTeixeira / example.sct
Created November 2, 2017 15:21 — forked from nicholasmckinney/example.sct
SCT File Obfuscation Examples:
<?XML version="1.0"?>
<scriptlet>
<registration
progid="PoC"
classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
<!-- Proof Of Concept - Casey Smith @subTee -->
<!-- License: BSD3-Clause -->
<script language="JScript">
<![CDATA[
//x86 only. C:\Windows\Syswow64\regsvr32.exe /s /u /i:file.sct scrobj.dll
//**********************************************************************`
//* This is an include file generated by Message Compiler. *`
//* *`
//* Copyright (c) Microsoft Corporation. All Rights Reserved. *`
//**********************************************************************`
#pragma once
#include <wmistr.h>
#include <evntrace.h>
#include "evntprov.h"
//
#!/usr/bin/env python3
"""
The idea here is to have one demo of each common argparse format
type. This is useful for me to be able to copy/paste into a new
script and have something to quickly edit and trim down to get
the functionality I need.
Expect this file to grow/change as I need new options.
This is, however, a working example. I hate examples that don't
@worawit
worawit / eternalblue_merge_shellcode.py
Last active April 3, 2024 12:25
Windows x64 and x86 kernel shellcode for eternalblue exploit
# This file has no update anymore. Please see https://github.com/worawit/MS17-010
import sys
from struct import pack
if len(sys.argv) < 4:
print('Usage: {} sc_x86 sc_x64 sc_out'.format(sys.argv[0]))
sys.exit()
sc_x86 = open(sys.argv[1], 'rb').read()
sc_x64 = open(sys.argv[2], 'rb').read()
'''
IDA plugin to display the calls and strings referenced by a function as hints.
Installation: put this file in your %IDADIR%/plugins/ directory.
Author: Willi Ballenthin <[email protected]>
Licence: Apache 2.0
'''
import idc
import idaapi
import idautils
@trietptm
trietptm / rol-ror.py
Created August 3, 2016 16:27 — forked from vqhuy/rol-ror.py
python rol, ror operation implement
###########################################################################
# Rotating bits (tested with Python 2.7)
from __future__ import print_function # PEP 3105
# max bits > 0 == width of the value in bits (e.g., int_16 -> 16)
# Rotate left: 0b1001 --> 0b0011
rol = lambda val, r_bits, max_bits: \
(val << r_bits%max_bits) & (2**max_bits-1) | \
@nitrocode
nitrocode / getDictValueFromPath.py
Last active July 21, 2020 22:00
Gets a value from a dictionary using a list key path
#!/usr/bin/env python
def getDictValueFromPath(listKeys, jsonData):
"""Retrieve value from a dictionary using a list of keys.
>>> mydict = {
'a': {
'b': {
'c': '1'
}
void TestCopy()
{
BOOL cond = FALSE;
IFileOperation *FileOperation1 = NULL;
IShellItem *isrc = NULL, *idst = NULL;
BIND_OPTS3 bop;
SHELLEXECUTEINFOW shexec;
HRESULT r;
do {
@rkitover
rkitover / make.log
Created April 9, 2016 00:20
llvm won't link
[ 89%] Built target not
[ 89%] Built target yaml-bench
[ 89%] Built target gtest
[ 89%] Built target gtest_main
[ 89%] Built target LTO_exports
[ 90%] Linking CXX shared library ../../lib/libLTO.so
../../lib/libLLVMScalarOpts.a: could not read symbols: Memory exhausted
collect2: error: ld returned 1 exit status
*** Error 1 in . (tools/lto/CMakeFiles/LTO.dir/build.make:255 'lib/libLTO.so')
*** Error 1 in . (CMakeFiles/Makefile2:12494 'tools/lto/CMakeFiles/LTO.dir/all')