This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
; Topher Timzen | |
; Messing around with PE backdooring for CTP/OSCE and wanted to make a new thread inside of process to avoid synchronization issues. | |
; Tons of NULL as I used this in a PE directly, no need to avoid them. | |
; nasm CreateThread.asm -o CreateThread.raw; xxd -p CreateThread.raw | tr -d '\n' | |
[BITS 32] | |
[SECTION .text] | |
global _start |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<?XML version="1.0"?> | |
<scriptlet> | |
<registration | |
progid="PoC" | |
classid="{F0001111-0000-0000-0000-0000FEEDACDC}" > | |
<!-- Proof Of Concept - Casey Smith @subTee --> | |
<!-- License: BSD3-Clause --> | |
<script language="JScript"> | |
<![CDATA[ | |
//x86 only. C:\Windows\Syswow64\regsvr32.exe /s /u /i:file.sct scrobj.dll |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
//**********************************************************************` | |
//* This is an include file generated by Message Compiler. *` | |
//* *` | |
//* Copyright (c) Microsoft Corporation. All Rights Reserved. *` | |
//**********************************************************************` | |
#pragma once | |
#include <wmistr.h> | |
#include <evntrace.h> | |
#include "evntprov.h" | |
// |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python3 | |
""" | |
The idea here is to have one demo of each common argparse format | |
type. This is useful for me to be able to copy/paste into a new | |
script and have something to quickly edit and trim down to get | |
the functionality I need. | |
Expect this file to grow/change as I need new options. | |
This is, however, a working example. I hate examples that don't |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# This file has no update anymore. Please see https://github.com/worawit/MS17-010 | |
import sys | |
from struct import pack | |
if len(sys.argv) < 4: | |
print('Usage: {} sc_x86 sc_x64 sc_out'.format(sys.argv[0])) | |
sys.exit() | |
sc_x86 = open(sys.argv[1], 'rb').read() | |
sc_x64 = open(sys.argv[2], 'rb').read() |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
''' | |
IDA plugin to display the calls and strings referenced by a function as hints. | |
Installation: put this file in your %IDADIR%/plugins/ directory. | |
Author: Willi Ballenthin <[email protected]> | |
Licence: Apache 2.0 | |
''' | |
import idc | |
import idaapi | |
import idautils |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
########################################################################### | |
# Rotating bits (tested with Python 2.7) | |
from __future__ import print_function # PEP 3105 | |
# max bits > 0 == width of the value in bits (e.g., int_16 -> 16) | |
# Rotate left: 0b1001 --> 0b0011 | |
rol = lambda val, r_bits, max_bits: \ | |
(val << r_bits%max_bits) & (2**max_bits-1) | \ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python | |
def getDictValueFromPath(listKeys, jsonData): | |
"""Retrieve value from a dictionary using a list of keys. | |
>>> mydict = { | |
'a': { | |
'b': { | |
'c': '1' | |
} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
void TestCopy() | |
{ | |
BOOL cond = FALSE; | |
IFileOperation *FileOperation1 = NULL; | |
IShellItem *isrc = NULL, *idst = NULL; | |
BIND_OPTS3 bop; | |
SHELLEXECUTEINFOW shexec; | |
HRESULT r; | |
do { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
[ 89%] Built target not | |
[ 89%] Built target yaml-bench | |
[ 89%] Built target gtest | |
[ 89%] Built target gtest_main | |
[ 89%] Built target LTO_exports | |
[ 90%] Linking CXX shared library ../../lib/libLTO.so | |
../../lib/libLLVMScalarOpts.a: could not read symbols: Memory exhausted | |
collect2: error: ld returned 1 exit status | |
*** Error 1 in . (tools/lto/CMakeFiles/LTO.dir/build.make:255 'lib/libLTO.so') | |
*** Error 1 in . (CMakeFiles/Makefile2:12494 'tools/lto/CMakeFiles/LTO.dir/all') |