joshfinley

0:009> g
'=== NtTerminateThread Called ==='
Debug session time: Thu Apr 10 09:19:51.565 2025 (UTC - 7:00)
System Uptime: 1 days 7:46:35.591
Process Uptime: 0 days 0:15:59.024
  Kernel time: 0 days 0:00:12.812
  User time: 0 days 0:03:32.390
'RCX: ' + @rcx
'RDX: ' + @rdx
'R8: ' + @r8

joshfinley

0:008> g
'=== NtTerminateThread Called ==='
Debug session time: Thu Apr 10 09:17:36.486 2025 (UTC - 7:00)
System Uptime: 1 days 7:44:20.512
Process Uptime: 0 days 0:13:43.946
  Kernel time: 0 days 0:00:11.750
  User time: 0 days 0:03:18.703
'RCX: ' + @rcx
'RDX: ' + @rdx
'R8: ' + @r8

joshfinley

@echo off
REM ============================================================
REM Simple ELAM Driver Signing Script
REM ============================================================
REM   To integrate with Visual Studio, update your SDK version
REM   paths below, disable default test signing, and add
REM   a post-build event to your build configurations in the
REM   driver VCXPROJ. For example, near the top, add:
REM
REM   <PropertyGroup>

joshfinley

# Search for GUIDs in a target file or directory and check
# if it might be an ETW provider GUID using logman.
#
# Inspired by chapter 8 of "Evading EDR" by Matt Hand.
#
# Not fast but easy to deploy and use.

param (
    [string]$Path
)

joshfinley

# Helper script to get SDDL/ACES for ETW Providers
# Inspired by / draws from Chapter 8 of "Evading EDR" by Matt Hand
param (
    [Parameter(Mandatory = $false)]
    [string]$ProviderName,

    [Parameter(Mandatory = $false)]
    [Guid]$Guid
)

joshfinley

# Deploy-DriverToVM.ps1
# Script to deploy debug drivers to Win11 Debug VM

param (
    [string]$VMName = "win-11-dbg",
    [string]$DriverPath = ".\x64\Debug\EtwResearchDriver\EtwResearchDriver.sys",
    [string]$VMDestPath = "C:\Drivers\EtwResearchDriver\",
    [string]$symbolPath = "C:\Symbols",
    [switch]$InstallDriver = $true,
    [System.Management.Automation.PSCredential]$Credential = $null

joshfinley

"use strict";

function initializeScript()
{
    return [new host.apiVersionSupport(1, 7)];
}

function findRegHandlesForGuid(targetGuidStr)
{
    let dbgOutput = host.diagnostics.debugLog;

joshfinley

import boto3
import base64
import argparse

# Parse command-line arguments
parser = argparse.ArgumentParser(description="List EC2 instances and their passwords.")
parser.add_argument("--profile", required=True, help="AWS profile to use")
args = parser.parse_args()

# Use specified AWS profile

joshfinley

import boto3
import argparse
import re
import botocore.exceptions
import itertools
import os

def generate_role_permutations(keywords):
    """
    Generate role name permutations from a list of keywords

joshfinley

import boto3
import re
import json
import sys
import argparse
import mimetypes
import os
import yaml

class SecretScanner: