hasherezade’s gists

hasherezade / test.reg

Last active December 31, 2023 19:26

Demo: persistence key not visible for sysinternals autoruns (in a default configuration - read more: https://twitter.com/hasherezade/status/849756054145699840)

	Windows Registry Editor Version 5.00

	[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
	@="Rundll32.exe SHELL32.DLL,ShellExec_RunDLL \"C:\\ProgramData\\test.exe\""

hasherezade / list_modules.cpp

Created April 5, 2017 17:31

Enumerates all the modules in the process with a given PID

	// Enumerates all the modules in the process with a given PID
	// saves the list in the log with the given format:
	// <module_start>,<module_end>,<module_name>
	// CC-BY: hasherezade

	#include <stdio.h>

	#include <Windows.h>
	#include <TlHelp32.h>

hasherezade / moker_check.cpp

Created April 4, 2017 14:11

Defensive checks from Moker Trojan

	#include <Windows.h>
	#include <stdio.h>

	bool isVBox()
	{
	HKEY hKey = NULL;
	RegOpenKeyA(HKEY_LOCAL_MACHINE, "HARDWARE\\ACPI\\DSDT\\VBOX__", &hKey);
	if (hKey != NULL) {
	RegCloseKey(hKey);
	return true;

hasherezade / decode.vb

Created March 19, 2017 00:11

Diamond Fox Crystal code fragments

	Public Sub decrypt(str1_arg, str2_arg) '406ABC
	'Data Table: 401634
	Dim str2_len As Long
	Dim var_B6 As Integer
	Dim index As Long
	Dim var_B4 As Long
	On Error Resume Next
	str1 = StrConv(str1_arg, &H80, 0)
	str2 = StrConv(str2_arg, &H80, 0)
	str2_len = UBound(str2, 1)

hasherezade / ApiTracer.cpp

Last active August 27, 2019 15:45

ApiTracer PIN plugin (dedicated to Dridex)

	/*
	* ApiTracer, CC by: hasherezade@gmail.com
	* Runs with: Intel PIN (https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool)
	*
	* Prints to <output_file> addresses of transitions from one sections to another
	* (helpful in finding OEP of packed file)
	* args:
	* -m <module_name> ; Analysed module name (by default same as app name)
	* -o <output_path> Output file
	*

hasherezade / search_blacklisted.cpp

Last active June 16, 2017 08:03

Search blacklisted module/process

hasherezade / pastebin_api_test.py

Created November 28, 2016 04:38

Pastebin API test

	#!/usr/bin/python2.7

	import sys
	import urllib2

	method = 'POST'
	content_type = 'text/html'

	agent = 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20130921 Firefox/24.0'
	host = 'pastebin.com'

hasherezade / rtldecompress_exploit.cpp

Created November 16, 2016 02:55

RtlDecompressBuffer exploit (more: http://jolmos.blogspot.com/2016/11/rtldecompresbuffer-vulnerability.html)

	/*
	ntdll!RtlDecompressBuffer() vtable exploit + heap spray
	by @sha0coder
	original version: http://jolmos.blogspot.com/2016/11/rtldecompresbuffer-vulnerability.html
	*/
	#include <iostream>
	#include <Windows.h>
	#include <fstream>
	#include <stdio.h>
	#include <stdlib.h>

hasherezade / aes_crypt.cpp

Last active April 15, 2026 04:56

AES 128 - encrypt/decrypt using Windows Crypto API

	#include <Windows.h>
	#include <wincrypt.h>
	#include <stdio.h>
	#pragma comment(lib, "advapi32.lib")

	#define AES_KEY_SIZE 16
	#define IN_CHUNK_SIZE (AES_KEY_SIZE * 10) // a buffer must be a multiple of the key size
	#define OUT_CHUNK_SIZE (IN_CHUNK_SIZE * 2) // an output buffer (for encryption) must be twice as big

	//params: <input file> <output file> <is decrypt mode> <key>

hasherezade / syscall_extractor.cpp

Last active February 10, 2026 17:04

Extracts syscalls list from NTDLL.DLL

	#include <stdio.h>
	#include <Windows.h>

	// based on: https://www.evilsocket.net/2014/02/11/on-windows-syscall-mechanism-and-syscall-numbers-extraction-methods/
	// author: @evilsocket
	// modified by: @hasherezade

	#define IS_ADDRESS_BETWEEN( left, right, address ) ( (address) >= (left) && (address) < (right) )
	PIMAGE_SECTION_HEADER SectionByRVA( PIMAGE_SECTION_HEADER pSections, DWORD dwSections, DWORD rva )
	{

hasherezade hasherezade