wonderbeyond

References:

• https://github.com/darkk/redsocks
• https://www.cnblogs.com/develon/p/11830726.html
• https://fuckcloudnative.io/posts/linux-circumvent/
• https://www.cnblogs.com/whych/p/9147900.html
• https://www.singchia.com/2018/03/23/A-Brief-Talk-About-Proxy-CN/
• https://blog.chih.me/global-proxy-within-redsocks-and-shadowsocks.html
• http://gsoc-blog.ecklm.com/iptables-redirect-vs.-dnat-vs.-tproxy/

---

y0ug

# Emulate sample to resolv obfuscated import with qiling 
# Just one way to do it, this method is kind of slow. 
# You need to have all the required DLL in the 'rootfs'
# Classic getprocaddress by hash we hook after the call
# read EAX and resolv the name from ql.loader.import_symbols
# compute the address of the mov operand
# generate the idapython code

# python3 IAT_qiling.py sample.exe | tee addr_ida.py
# idapython is in addr_ida.py at the end

Hanan-Natan

import idaapi, idc, idautils


class DecryptorError(Exception):
    pass


def rc4crypt(key, data):
    x = 0
    box = list(range(256))

willings

import * as s3 from '@aws-cdk/aws-s3';
import * as iam from '@aws-cdk/aws-iam';
import * as lambda from '@aws-cdk/aws-lambda';
import * as ses from '@aws-cdk/aws-ses';
import * as sesActions from '@aws-cdk/aws-ses-actions'
import * as logs from '@aws-cdk/aws-logs'
import * as cdk from '@aws-cdk/core';

export class EmailProxyStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {

bazad

#! /usr/bin/env python3
#
# sep_firmware_split.py
# Brandon Azad
#
# Split a decrypted Apple SEP firmware image into individual Mach-O files.
#
# iPhone11,8 17C5053a   https://twitter.com/s1guza/status/1203550760102969345
# iPhone11,8 17E255     https://twitter.com/s1guza/status/1244683851957522435
#

OALabs

import idaapi, idc, idautils


class DecryptorError(Exception):
    pass


def rc4crypt(key, data):
    x = 0
    box = range(256)

Dobby233Liu

#!/usr/bin/env python
# -*- coding:utf-8 -*-
"""Edge Microsoft TTS for Python."""
import sys
from ws4py.client.threadedclient import WebSocketClient
import binascii
import argparse
import json
import requests
import re

xjohjrdy

#!/usr/bin/env python
# -*- coding:utf-8 -*-
import sys
reload(sys)
sys.setdefaultencoding('utf-8')
from ws4py.client.threadedclient import WebSocketClient
import binascii

class WSClient(WebSocketClient):
    def __init__(self, url, text, filename):

nstarke

Reversing Raw Binary Firmware Files in Ghidra

This brief tutorial will show you how to go about analyzing a raw binary firmware image in Ghidra.

Prep work in Binwalk

I was recently interested in reversing some older Cisco IOS images. Those images come in the form of a single binary blob, without any sort of ELF, Mach-o, or PE header to describe the binary.

While I am using Cisco IOS Images in this example, the same process should apply to other Raw Binary Firmware Images.

coconut49

package main

import (
	"context"
	"crypto/sha256"
	"crypto/tls"
	"crypto/x509"
	"encoding/pem"
	"errors"
	"fmt"