killvxk

History

• http://jakob.engbloms.se/archives/1554
• “Debugging Operating Systems with Time-Traveling Virtual Machines“ 2005. Samuel King, George Dunlap, and Peter Chen, - paper - https://www.usenix.org/legacy/events/usenix05/tech/general/king.html - nice list of example bugs for which reverse debugging work much better than cyclic debugging.
• “Framework for Instruction-level Tracing and Analysis of Program Executions“, Virtual Execution Environments (VEE), 2006. Sanjay Bhansali, Wen-Ke Chen, Stuart de Jong, Andrew Edwards, Ron Murray, Milenko Drinic, Darek Mihocka, and Joe Chau,
  • iDNA paper - https://www.usenix.org/legacy/events/vee06/full_papers/p154-bhansali.pdf
• “Don’t Panic: Reverse Debugging of Kernel Drivers“. 2015. Pavel Dovgalyuk, Denis Dmitriev, and Vladimir Makarov,
  • An approach using record-replay of hardware interactions from an OS running inside a Qemu virtual amachine,
• Paper - https://dl.acm.org/citation.cfm?doid=2786805.2803179

killvxk

#!/usr/bin/env python
# vim: tabstop=4:softtabstop=4:shiftwidth=4:expandtab:

import os
import requests
import sys

docs = {
    '68000': {
        'M68000PRM.pdf': 'https://www.nxp.com/files-static/archives/doc/ref_manual/M68000PRM.pdf',

killvxk

Choco Install

Install Choco

@"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))" && SET "PATH=%PATH%;%ALLUSERSPROFILE%\chocolatey\bin"

Install Ghidra 9.0.2

choco install ghidra

killvxk

// clang -Werror -Wall -O3 -mssse3 -msha cpu-brute.c sha.c prng.c -o brute && scp brute scanifi:/tmp

#include "sha1.h"

#define gen_bsd_drand48 1
// #define gen_msvc_rand 1
#include "prng.h"

#include <stdint.h>
#include <math.h>

killvxk

/**
  BSD 3-Clause License

  Copyright (c) 2019, TheWover, Odzhan. All rights reserved.

  Redistribution and use in source and binary forms, with or without
  modification, are permitted provided that the following conditions are met:

  * Redistributions of source code must retain the above copyright notice, this
    list of conditions and the following disclaimer.

killvxk

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
/exploit {{
  /println  {{ (\\n) exch print print }} bind executeonly def
  /info     {{ ([*] ) print println }} bind executeonly def
  /success  {{ ([+] ) print println }} bind executeonly def
  /fail     {{ ([-] ) print println stop }} bind executeonly def
  
  /MaxFileSize 16#10000 def
  /readfile {{
    (r) file

killvxk

#include "stdafx.h"

BOOL SetPrivilege(HANDLE hToken, LPCTSTR Privilege, BOOL bEnablePrivilege) {
	TOKEN_PRIVILEGES tp;
	LUID luid;
	TOKEN_PRIVILEGES tpPrevious;
	DWORD cbPrevious = sizeof(TOKEN_PRIVILEGES);

	if (!LookupPrivilegeValue(NULL, Privilege, &luid)) return FALSE;

killvxk

//------------------------------------------------
//--- 010 Editor v8.0.1 Binary Template
//
//      File: Transactional Registry Transaction Logs (.TxR)
//   Authors: Willi Ballenthin <william.ballenthin@fireeye.com>
//   Version: 0.1
// Reference: https://www.fireeye.com/blog/threat-research/2019/01/digging-up-the-past-windows-registry-forensics-revisited.html
//------------------------------------------------

LittleEndian();

killvxk

#    _____        __  __  ___        __      
#   / ___/__  ___/ / /  |/  /__  ___/ /__    
#  / (_ / _ \/ _  / / /|_/ / _ \/ _  / -_)   
#  \___/\___/\_,_/ /_/  /_/\___/\_,_/\__/_   
#    / __(_)__ ___ _  ___ _  / _ \__ __/ /__ 
#   _\ \/ / _ `/  ' \/ _ `/ / , _/ // / / -_)
#  /___/_/\_, /_/_/_/\_,_/ /_/|_|\_,_/_/\__/ 
#        /___/                               
#
#  Florian Roth

killvxk

<#
    ImageFileExecutionOptions v1.0
    License: GPLv3
    Author: @netbiosX
#>
# Image File Execution Options Injection Persistence Technique
# https://pentestlab.blog/2020/01/13/persistence-image-file-execution-options-injection/

function Persist-Debugger