Skip to content

Instantly share code, notes, and snippets.

View hasherezade's full-sized avatar

hasherezade hasherezade

6.2k followers · 34 following
View GitHub Profile
@hasherezade
hasherezade / Program.cs
Last active July 27, 2021 06:48
A simple app to decode #PurpleFoxEK stegano payloads
using System;
using System.Drawing;
using System.IO;
namespace PurpleFoxPNGDec
{
internal class Program
{
public static int getPrintableLen(byte[] array)
{
@hasherezade
hasherezade / winupdate64.dll.tag
Created July 27, 2021 06:31
Tag file from tracing a VMProtect-protected NuggetPhantom component
71941;kernel32.LoadLibraryA
Arg[0] = ptr 0x000000d19111f670 -> "kernel32.dll"
cdb3d;kernel32.GetModuleFileNameW
cdb3d;kernel32.CreateFileW
Arg[0] = ptr 0x000000d19111f280 -> L"C:\Users\tester\Desktop\winupdate64.dll"
Arg[1] = 0x0000000080000000 = 2147483648
Arg[2] = 0x0000000000000003 = 3
Arg[3] = 0
Arg[4] = 0x0000000000000003 = 3
@hasherezade
hasherezade / GzipSimpleHttpServer.py
Last active January 18, 2023 14:11 — forked from bkeating/GzipSimpleHttpServer.py
Python's SimpleHttpServer, but w/Gzip support. 🤙
#!/usr/bin/python3
"""Simple HTTP Server.
This module builds on BaseHTTPServer by implementing the standard GET
and HEAD requests in a fairly straightforward manner.
"""
__version__ = "0.7"
@hasherezade
hasherezade / main.cpp
Created July 17, 2021 16:35
A native way to enumerate processes (alternative to: EnumProcesses, CreateToolhelp32Snapshot - Process32First - Process32Next)
#include <windows.h>
#include <iostream>
#include "ntddk.h"
bool enum_processes()
{
ULONG retLen = 0;
// check length:
@hasherezade
hasherezade / injection_demos.md
Last active October 14, 2024 18:19
List of my PE injection demos
@hasherezade
hasherezade / buid_hh.sh
Last active December 29, 2020 14:22
Build Hollows Hunter on Linux (MinGW)
#!/bin/sh
set -e
test -d _hollows_hunter \
|| git clone --recurse-submodules https://github.com/hasherezade/hollows_hunter _hollows_hunter
cd _hollows_hunter
cmake . \
-DCMAKE_C_COMPILER=x86_64-w64-mingw32-gcc \
@hasherezade
hasherezade / uac_bypass.c
Created July 14, 2020 00:11 — forked from Cr4sh/uac_bypass.c
void TestCopy()
{
BOOL cond = FALSE;
IFileOperation *FileOperation1 = NULL;
IShellItem *isrc = NULL, *idst = NULL;
BIND_OPTS3 bop;
SHELLEXECUTEINFOW shexec;
HRESULT r;
do {
@hasherezade
hasherezade / str_ref.py
Created January 28, 2020 01:42
IDA script snippets
#IDA script to print all referenced strings along with their references
import idautils
sc = idautils.Strings()
for s in sc:
curr_str = str(s)
str_offset = s.ea
for xref in idautils.XrefsTo(s.ea):
func = idaapi.get_func(xref.frm)
@hasherezade
hasherezade / lookup.cpp
Last active January 9, 2020 23:44
Zbot - checksum lookup (v2)
#include <Windows.h>
#include <tlhelp32.h>
#include <iostream>
#include <peconv.h> // include libPeConv header (https://github.com/hasherezade/libpeconv)
#include <paramkit.h> // include ParamKit header (https://github.com/hasherezade/paramkit)
using namespace paramkit;
#define PARAM_CHECKSUM "checks"
#define PARAM_CHECKSUM_FUNC "cfunc"
@hasherezade
hasherezade / lookup.cpp
Last active January 9, 2020 06:06
Zbot - checksum to function
#include <Windows.h>
#include <tlhelp32.h>
#include <iostream>
#include <peconv.h> // include libPeConv header
DWORD get_hex_number(char *param)
{
DWORD checksum = 0;
if (sscanf(param, "%X", &checksum) == 0) {