Skip to content

Instantly share code, notes, and snippets.

View karanlyons's full-sized avatar

Karan Lyons karanlyons

74 followers · 10 following
View GitHub Profile
@karanlyons
karanlyons / payloadPack.js
Last active July 26, 2019 20:52
Char wise, byte foolish.
const pack = s =>
s.match(/^[\u0000-\u00ff]*$/)
? s
.split("")
.map(s => s.charCodeAt())
.reduce(
(pairs, c) =>
(
!c || pairs[pairs.length - 1].length === 2
? pairs.push(...(c? [[c]] : [[c], []]))
@karanlyons
karanlyons / ZoomDaemon.yara
Last active August 5, 2024 23:37
Fixes for Zoom, RingCentral, Zhumu (and additional white labels) RCE vulnerabilities
private rule Macho
{
meta:
description = "private rule to match Mach-O binaries (copied from Apple's XProtect)"
condition:
uint32(0) == 0xfeedface or uint32(0) == 0xcefaedfe or uint32(0) == 0xfeedfacf or uint32(0) == 0xcffaedfe or uint32(0) == 0xcafebabe or uint32(0) == 0xbebafeca
}
rule ZoomDaemon
{
@karanlyons
karanlyons / testcase.html
Last active March 20, 2019 01:01
WebKit RAF Inaccuracy (Related: https://github.com/whatwg/html/issues/2569)
<html>
<head>
<style>
#left, #right, #test {
display: block;
z-index: 0;
}
#left {
float: left;
@karanlyons
karanlyons / pypy_ssl_after_fork_bug.py
Created June 2, 2018 21:54
import os
from http.client import HTTPSConnection
from time import sleep
def request():
connection = HTTPSConnection('httpbin.org')
connection.request('GET', '/headers')
return connection.getresponse().read()
@karanlyons
karanlyons / README.md
Created September 25, 2017 15:45
Headspace Challenge

Headspace Challenge

Requirements

  • Python >=3.5 (compiled with sqlite3 support)
  • That’s it.
  • This may have been a bad idea.

Get Started

@karanlyons
karanlyons / splatify.js
Created August 29, 2017 22:39
splatify.js: Add some venom to your coffee
function splatify(func) {
args_string = func.toString().split('(')[1].split(')')[0].split(',').map(function(s) { return s.trim(); });
if (args_string.length && args_string[args_string.length - 1] === 'splat_args') {
pivot = args_string.length - 1;
return function () {
if (arguments.length > pivot + 1) {
args = Array.prototype.slice.call(arguments, 0, pivot);
args.push(Array.prototype.slice.call(arguments, pivot));
@karanlyons
karanlyons / solver.py
Last active August 21, 2024 13:26
Why PRNGs are not the same as CSPRNGs
import z3
def sym_xoroshiro128plus(solver, sym_s0, sym_s1, mask, result):
s0 = sym_s0
s1 = sym_s1
sym_r = (sym_s0 + sym_s1)
condition = z3.Bool('c0x%0.16x' % result)
solver.add(z3.Implies(condition, (sym_r & mask) == result & mask))
@karanlyons
karanlyons / method_missing.py
Last active August 7, 2017 17:47
method_missing for Python: All the headaches of Ruby, now with added whitespace!
import dis
import inspect
class MethodMissingMixin:
def __getattr__(self, attr):
if hasattr(getattr(self, '__methodmissing__', None), '__call__'):
parent_frame = inspect.currentframe().f_back
instructions = dis.get_instructions(parent_frame.f_code)
@karanlyons
karanlyons / parse.html
Created July 9, 2017 10:34
Javascript QTFF/MP4 Parser
<html>
<body>
<script>
'use strict';
ArrayBuffer.prototype.toSource = function(hex) {
var buf = this,
bytes = Array.prototype.slice.call(new Uint8Array(buf)),
i = buf.byteLength,
blank = true;
@karanlyons
karanlyons / sha512.cpp
Created July 4, 2017 08:35
SHA-512 in C“++”
#include <algorithm>
#include <cstdint>
#include <cstdio>
#include <cstring>
using namespace std;
const uint64_t k[] = {
UINT64_C(0x428a2f98d728ae22), UINT64_C(0x7137449123ef65cd), UINT64_C(0xb5c0fbcfec4d3b2f), UINT64_C(0xe9b5dba58189dbbc),