beren12

<?xml version="1.0" encoding="UTF-8"?>
<ufwb version="1.9">
    <grammar name="Decrypted iTunes Library" start="id:148" author="Mr. eXoDia" email="mr.exodia.tpodt@gmail.com" fileextension="itl" uti="com.apple.itunes.db">
        <description>Grammar for decrypted iTunes Library files.</description>
        <structure name="Defaults" id="149" repeatmin="0" repeatmax="-1" encoding="ISO_8859-1:1987" endian="little" signed="no"/>
        <structure name="iTunes Library" id="148" repeatmin="0" repeatmax="-1" extends="id:149" order="variable">
            <structref name="hdfm" id="152" repeatmin="0" repeatmax="-1" structure="id:151"/>
            <structref name="msdh" id="154" repeatmin="0" repeatmax="-1" structure="id:153"/>
        </structure>
        <structure name="hdfm" id="151" length="this.headerLength" repeatmin="0" repeatmax="-1" extends="id:149" endian="big">

ygini

Reversing 10.13 RootGate, hands notes

Inital discovery process

Original state of the root.plist

Dict {
    smb_sid = Array {
        S-1-5-18

crittermike

# One liner
wget --recursive --page-requisites --adjust-extension --span-hosts --convert-links --restrict-file-names=windows --domains yoursite.com --no-parent yoursite.com

# Explained
wget \
     --recursive \ # Download the whole site.
     --page-requisites \ # Get all assets/elements (CSS/JS/images).
     --adjust-extension \ # Save files with .html on the end.
     --span-hosts \ # Include necessary assets from offsite as well.
     --convert-links \ # Update links to still work in the static version.

dreness

-- sqlite3 ~/Library/Messages/chat.db < attachments-for-buddy.sql
-- dates in the DB are NSDate. NSDate.h says: NSTimeIntervalSince1970 978328800

-- To list attachments for a specific buddy, put their handle in the 'where' clause at the end.

SELECT Datetime(created_date + 978328800, 'unixepoch', 'localtime'),
       mime_type,
       total_bytes,
       filename
FROM   attachment

dlangille

# the filesets will be different on each jail, thus, we'll always be doing a full unless 
# we define this for each jail server
#
FileSet {
  Name = "zuul jail snapshots"
  Include {
    Options {
      signature = MD5 
      Exclude = yes
    }

mrexodia

<?xml version="1.0" encoding="UTF-8"?>
<ufwb version="1.9">
    <grammar name="Decrypted iTunes Library" start="id:148" author="Mr. eXoDia" email="mr.exodia.tpodt@gmail.com" fileextension="itl" uti="com.apple.itunes.db">
        <description>Grammar for decrypted iTunes Library files.</description>
        <structure name="Defaults" id="149" repeatmin="0" repeatmax="-1" encoding="ISO_8859-1:1987" endian="little" signed="no"/>
        <structure name="iTunes Library" id="148" repeatmin="0" repeatmax="-1" extends="id:149" order="variable">
            <structref name="hdfm" id="152" repeatmin="0" repeatmax="-1" structure="id:151"/>
            <structref name="msdh" id="154" repeatmin="0" repeatmax="-1" structure="id:153"/>
        </structure>
        <structure name="hdfm" id="151" length="this.headerLength" repeatmin="0" repeatmax="-1" extends="id:149" endian="big">

dreness

require 'rubygems'
require 'blather/client'
require 'awesome_print'
require 'nokogiri'
require 'pretty-xml'
require 'nokogiri-pretty'
include PrettyXML

# This is a Blather bot that receives file transfers that are sent using
# XEP 0096, using either p2p SOCKS5 (XEP 0065), or through the server