herrcore’s gists

herrcore / dll_exports.py

Created April 19, 2021 06:03 — forked from OALabs/dll_exports.py

Build dictionary of DLL exports (Windows API Names)


	import os
	import pefile
	import json

	INTERESTING_DLLS = [
	'kernel32.dll', 'comctl32.dll', 'advapi32.dll', 'comdlg32.dll',
	'gdi32.dll', 'msvcrt.dll', 'netapi32.dll', 'ntdll.dll',
	'ntoskrnl.exe', 'oleaut32.dll', 'psapi.dll', 'shell32.dll',
	'shlwapi.dll', 'srsvc.dll', 'urlmon.dll', 'user32.dll',

herrcore / exports.json

Created April 19, 2021 06:03 — forked from OALabs/exports.json

Common DLL exports (Windows API Names)

{"exports": ["A_SHAFinal", "A_SHAInit", "A_SHAUpdate", "AbortSystemShutdownA", "AbortSystemShutdownW", "AccessCheck", "AccessCheckAndAuditAlarmA", "AccessCheckAndAuditAlarmW", "AccessCheckByType", "AccessCheckByTypeAndAuditAlarmA", "AccessCheckByTypeAndAuditAlarmW", "AccessCheckByTypeResultList", "AccessCheckByTypeResultListAndAuditAlarmA", "AccessCheckByTypeResultListAndAuditAlarmByHandleA", "AccessCheckByTypeResultListAndAuditAlarmByHandleW", "AccessCheckByTypeResultListAndAuditAlarmW", "AddAccessAllowedAce", "AddAccessAllowedAceEx", "AddAccessAllowedObjectAce", "AddAccessDeniedAce", "AddAccessDeniedAceEx", "AddAccessDeniedObjectAce", "AddAce", "AddAuditAccessAce", "AddAuditAccessAceEx", "AddAuditAccessObjectAce", "AddConditionalAce", "AddMandatoryAce", "AddUsersToEncryptedFile", "AddUsersToEncryptedFileEx", "AdjustTokenGroups", "AdjustTokenPrivileges", "AllocateAndInitializeSid", "AllocateLocallyUniqueId", "AreAllAccessesGranted", "AreAnyAccessesGranted", "AuditComputeEffectivePolicyBySid", "AuditComputeEf

herrcore / revil_strings.py

Created April 19, 2021 06:02 — forked from OALabs/revil_strings.py

Decrypt REvil ransomware strings with IDA Python

	import idaapi, idc, idautils


	class DecryptorError(Exception):
	pass


	def rc4crypt(key, data):
	x = 0
	box = range(256)

herrcore / simple_ast.py

Created January 24, 2021 03:34

Simple AST implementation from https://www.youtube.com/watch?v=kzDuHh6kolk - tutorial by Jack Mott

	#!/usr/bin/env python2.7
	#####################################################################################
	##
	## Simple Abstract Syntax Tree Example for Tokens x, const, add, sub
	##
	## Reference: https://www.youtube.com/watch?v=kzDuHh6kolk - tutorial by Jack Mott
	##
	#####################################################################################

herrcore / prnloader.py

Created December 10, 2020 04:56

Decryptor for PrnLoader

	def decrypt(data, video):
	video_len = len(video)
	if video_len > 0xa00000:
	video_len = 0xa00000
	video_offset_count = video_len /len(data)
	out = ''
	for i in range(len(data)):
	out += chr(ord(data[i]) ^ ord(video[video_offset_count*i]))
	return out

herrcore / irc_worm_string_decryption.py

Created May 31, 2020 01:39

IDA Pro script for decrypting IRC worm strings, ref https://www.cert.pl/wp-content/uploads/2011/06/201106_hamweq.pdf

	def decrypt(key, data):
	out = ''
	for d in data:
	for k in key:
	d = chr(ord(d) ^ ord(k))
	out += chr(~ord(d) & 255)
	return out


	def decrypt_string(ea):

herrcore / AdWindDecryptor.py

Created March 12, 2018 03:24

Python decryptor for newer AdWind config file - replicated from this Java version https://github.com/mhelwig/adwind-decryptor

	#!/usr/local/bin/env python

	########################################################################################################
	##
	## Decrypts the AdWind configiration files!
	## May also work for other files
	##
	##
	## All credit to Michael Helwig for the original Java implementation:
	## https://github.com/mhelwig/adwind-decryptor

herrcore / gootkit_packer_string_decrypt.py

Created March 3, 2018 22:35

Simple string decryptor for Gootkit packer (IDAPython script)

	import idautils
	import idaapi
	import idc


	def string_decrypt(data_ea, data_len):
	data = idc.GetManyBytes(data_ea, data_len)
	key = '89798798798g79er$'
	out = 'str_'
	for i in range(0 , len(data)):

herrcore / HexCopy.py

Last active August 23, 2024 08:41

IDA Plugin for quickly copying disassembly as encoded hex bytes (updated for IDA 7xx) - moved https://github.com/OALabs/hexcopy-ida

Moved: https://github.com/OALabs/hexcopy-ida

herrcore / ida_PYKSPA_hide_junk.py

Last active July 29, 2021 08:54

IDA script to hide junk code for PYKSPA malware

	################################################################################
	##
	## Junk Hide for PYKSPA
	##
	## Author: @herrcore
	##
	## Hide junk code:
	## mov al <something>
	## mov al <something>
	## mov al <something>

herrcore herrcore