alexander-hanel

import ida_kernwin

"""
mostly stolen from https://github.com/idapython/ examples/ex_actions.py
"""


class IconExample(ida_kernwin.action_handler_t):
    def __init__(self, passed):
        ida_kernwin.action_handler_t.__init__(self)

alexander-hanel

Learning Rust

Rust has kind of a steep learning curve but fortunately the Rust community has created some amazing resources for it. The approach I have taken is an iterative one using the following five resorces.

1. The Rust Programming Language
2. Rust by Example
3. Introduction to Programming Using Rust
4. rustlings
5. Learning Rust by Working Through the Rustlings Exercises

alexander-hanel

opaque predicates

In computer programming, an opaque predicate is a predicate—an expression that evaluates to either "true" or "false"—for which the outcome is known by the programmer a priori, but which, for a variety of reasons, still needs to be evaluated at run time

Source

Opaque predicates appears to have been first used by Christian Collberg & Clark Thomborson back in 1997 source. The technique is discussed in their paper A Taxonomy of Obfuscating Transformations.

Notes from A Taxonomy of Obfuscating Transformations

alexander-hanel

Rust Ownership Notes

Rather than relying on garbage collection or user memory allocation (via allocate/free memory), Rust relys on the compiler to ensure memory is managed through ownership.

Ownership is a set of rules that governs how a Rust program manages memory.

Ownership helps with organizing how data is stored in the heap, minimizing duplication of data in the heap and cleaning up the heap. Data types (e.g. Scalar types) are not stored in the heap. Data types (e.g. integers) can be easily pushed/stored and popped/removed on the stack. Rust enforces single ownership.

Ownership Rules

alexander-hanel

Cryptopals

link

Set 1

Challenge 1: Convert hex to base64

use std::str;
extern crate base64;

alexander-hanel

# Created By: Alexander Hanel
# Date: 20220425
# Version 2.0
# Purpose: Simple API logger for a subset of API's used by Java's JVM

# C:\tt\pypyp>C:\Python37\python.exe jvm_logger.py -file "C:\Progra~1\Java\jdk1.8.0_191\bin\java.exe" -args " -jar C:\tt\pypyp\victim-app-0.0.1-SNAPSHOT.jar"

import sys
import _ptrace
import argparse

alexander-hanel

import idautils
import string

DEBUG = True 
if DEBUG:
    import hexdump 

SEGMENT = True 

def get_to_xrefs(ea):

alexander-hanel

Disassembler (aka Task 1)

Notes on RE1.

1. Use a language of your choice to decode the base64 encoded data, disassemble the binary data using the capstone engine and save the text to a file named disassemble.txt

alexander-hanel

import logging

logging.basicConfig()
logging.getLogger().setLevel(logging.DEBUG)

file_name = ""

try:
    import binaryninja
    logging.debug("BinaryNinja has been imported")

alexander-hanel

Stages

Source

1. Machine Code

• disassemble (x86, ARM, MIPS, etc)
• disassembler (capstone, etc)