hasherezade’s gists

hasherezade / lookup.cpp

Last active January 9, 2020 06:06

Zbot - checksum to function

	#include <Windows.h>
	#include <tlhelp32.h>
	#include <iostream>

	#include <peconv.h> // include libPeConv header

	DWORD get_hex_number(char *param)
	{
	DWORD checksum = 0;
	if (sscanf(param, "%X", &checksum) == 0) {

hasherezade / main.cpp

Created September 5, 2019 23:03

Flare On 2019 - task 9 - reloadered

hasherezade / main.cpp

Last active October 4, 2019 19:40

Flare-On Task 12 - string decoder

	#include <stdio.h>
	#include <windows.h>

	#include <peconv.h>

	#define EXE_PATH "Z:\\flare\\m.dll"

	__int64 (__fastcall ini_ctx)(BYTE ctx, BYTE *key, int key_size) = nullptr;
	__int64 (__fastcall decrypt_buf)(BYTE ctx, BYTE in_buf, BYTE out_buf, unsigned int size) = nullptr;

hasherezade / main.cpp

Created August 27, 2019 21:54

Flare-On Task 10 - solution

hasherezade / guard_flags.h

Last active August 14, 2019 21:54

	#pragma once

	#define IMAGE_GUARD_CF_INSTRUMENTED 0x00000100 // Module performs control flow integrity checks using system-supplied support

	#define IMAGE_GUARD_CFW_INSTRUMENTED 0x00000200 // Module performs control flow and write integrity checks
	#define IMAGE_GUARD_CF_FUNCTION_TABLE_PRESENT 0x00000400 // Module contains valid control flow target metadata
	#define IMAGE_GUARD_SECURITY_COOKIE_UNUSED 0x00000800 // Module does not make use of the /GS security cookie
	#define IMAGE_GUARD_PROTECT_DELAYLOAD_IAT 0x00001000 // Module supports read only delay load IAT
	#define IMAGE_GUARD_DELAYLOAD_IAT_IN_ITS_OWN_SECTION 0x00002000 // Delayload import table in its own .didat section (with nothing else in it) that can be freely reprotected
	#define IMAGE_GUARD_CF_EXPORT_SUPPRESSION_INFO_PRESENT 0x00004000 // Module contains suppressed export information. This also infers that the address taken

hasherezade / str_decoder.cpp

Last active December 20, 2018 18:11

Decoder for the obfuscated strings from malware: ef0cb0a1a29bcdf2b36622f72734aec8d38326fc8f7270f78bd956e706a5fd57

	#include <iostream>
	#include <Windows.h>

	char* decode_string(const char *a1)
	{
	const BYTE enc_str = (BYTE)a1;
	signed int enc_len = strlen(a1);

	BYTE *v4;
	int v5;

hasherezade / extracted_list.txt

Last active October 30, 2018 17:56

TrickBot string decoder (c3737aaf6b613a7c7d5e0c6d3c0d60a2)

hasherezade / Driver.c

Last active April 26, 2024 10:36

HelloWorld driver

	// Sample "Hello World" driver
	// creates a HelloDev, that expects one IOCTL

	#include <ntddk.h>

	#define HELLO_DRV_IOCTL CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_NEITHER, FILE_ANY_ACCESS)

	#define DOS_DEV_NAME L"\\DosDevices\\HelloDev"
	#define DEV_NAME L"\\Device\\HelloDev"

hasherezade / output.txt

Last active June 20, 2018 18:51

hasherezade / run_elevated.cpp

Last active November 11, 2019 12:21

Run elevated via rundll32.exe (NOTE: it is NOT a stealthy UAC bypass!)

	/**
	The role of this snippet is to enforce a user to elevate a process,
	simply by flooding them with repeatitive requests till they agree.
	I do NOT recommend it as a UAC bypass technique as it is very noisy!
	*/

	#include <stdio.h>
	#include <Windows.h>

	char mutex_name[] = "elev_mutex";

hasherezade hasherezade