Skip to content

Instantly share code, notes, and snippets.

View gavz's full-sized avatar

gavz

114 followers · 40 following
View GitHub Profile
@nstarke
nstarke / 01-reversing-cisco-ios-raw-binary-firmware-images-with-ghidra.md
Last active December 10, 2025 04:11
Reversing Cisco IOS Raw Binary Firmware Images with Ghidra

Reversing Raw Binary Firmware Files in Ghidra

This brief tutorial will show you how to go about analyzing a raw binary firmware image in Ghidra.

Prep work in Binwalk

I was recently interested in reversing some older Cisco IOS images. Those images come in the form of a single binary blob, without any sort of ELF, Mach-o, or PE header to describe the binary.

While I am using Cisco IOS Images in this example, the same process should apply to other Raw Binary Firmware Images.

@payalord
payalord / sqlite_static_cpp.md
Last active January 11, 2026 20:12
How to add SQLite into your VS project as Static Library

I assume that you already created C++ Win32 project where you want to include SQLite.

  1. Navigate to https://www.sqlite.org/download.html and download latest amalgamation source version of SQLite.
  2. Extract all the files into your project directory, or your include path, or separate path that you will add/added as include path in your project properties.
  3. Run Developer Command Prompt for VS **** which is usually available at Start -> Programs -> Visual Studio **** -> Visual Studio Tools.
  4. Navigate with command prompt to that directory where we extracted our SQLite.
  5. Run next command to compile: cl /c /EHsc sqlite3.c
  6. Run next command to create static library: lib sqlite3.obj
  7. Open properties of your project and add sqlite3.lib to Linker -> Input -> Additional Dependencies.
@jaredcatkinson
jaredcatkinson / Get-InjectedThread.ps1
Last active March 13, 2026 04:24
Code from "Taking Hunting to the Next Level: Hunting in Memory" presentation at SANS Threat Hunting Summit 2017 by Jared Atkinson and Joe Desimone
function Get-InjectedThread
{
<#
.SYNOPSIS
Looks for threads that were created as a result of code injection.
.DESCRIPTION
@hasherezade
hasherezade / syscall_extractor.cpp
Last active February 10, 2026 17:04
Extracts syscalls list from NTDLL.DLL
#include <stdio.h>
#include <Windows.h>
// based on: https://www.evilsocket.net/2014/02/11/on-windows-syscall-mechanism-and-syscall-numbers-extraction-methods/
// author: @evilsocket
// modified by: @hasherezade
#define IS_ADDRESS_BETWEEN( left, right, address ) ( (address) >= (left) && (address) < (right) )
PIMAGE_SECTION_HEADER SectionByRVA( PIMAGE_SECTION_HEADER pSections, DWORD dwSections, DWORD rva )
{