Skip to content

Instantly share code, notes, and snippets.

View nanzhipro's full-sized avatar

南知 nanzhipro

View GitHub Profile
@nanzhipro
nanzhipro / agent loop
Created March 11, 2025 07:16 — forked from jlia0/agent loop
Manus tools and prompts
You are Manus, an AI agent created by the Manus team.
You excel at the following tasks:
1. Information gathering, fact-checking, and documentation
2. Data processing, analysis, and visualization
3. Writing multi-chapter articles and in-depth research reports
4. Creating websites, applications, and tools
5. Using programming to solve various problems beyond development
6. Various tasks that can be accomplished using computers and the internet
@nanzhipro
nanzhipro / library_injector.cpp
Created December 19, 2023 10:20 — forked from saagarjha/library_injector.cpp
Load a library into newly spawned processes (using DYLD_INSERT_LIBRARIES and EndpointSecurity)
// To compile: clang++ -arch x86_64 -arch arm64 -std=c++20 library_injector.cpp -lbsm -lEndpointSecurity -o library_injector,
// then codesign with com.apple.developer.endpoint-security.client and run the
// program as root.
#include <EndpointSecurity/EndpointSecurity.h>
#include <algorithm>
#include <array>
#include <bsm/libbsm.h>
#include <cstdint>
#include <cstdlib>
import Cocoa
protocol AXUIProtocol {
func AXUIWindowArray(processIdentifier pid:pid_t) -> [AXUIElement]
func AXUIWindowArray(bundleIdentifier bid:NSString) -> [AXUIElement]
}
extension AXUIProtocol {
func AXUIWindowArray(processIdentifier pid:pid_t) -> [AXUIElement] {
let windowList : UnsafeMutablePointer<AnyObject?> = UnsafeMutablePointer<AnyObject?>.alloc(1)

Last updated: 2014-12-25

mdfind commands

Find all the file types in a given directory

mdfind -attr kMDItemContentType "kMDItemContentType == '*'" -onlyin . | awk -F"kMDItemContentType =" '{print $2}' | sort | uniq -c | sort -r

Get Last 5 Files Added in Dropbox Folders

@nanzhipro
nanzhipro / git_rename.sh
Created July 22, 2022 06:00 — forked from robotdana/git_rename.sh
Use git .mailmap
#!/bin/bash
# based on: https://gist.github.com/octocat/0831f3fbd83ac4d46451#gistcomment-2178506
# will use the .mailmap file to rewrite all names/emails
function correct_names () {
( git shortlog -sen ; git shortlog -secn ) | cut -f2 | sort | uniq
}
function all_names () {
( git log --format="%an <%ae>" ; git log --format="%cn <%ce>" ) | sort | uniq
@nanzhipro
nanzhipro / SigCheck.py
Created March 24, 2022 03:10 — forked from richiercyrus/SigCheck.py
Python code for checking whether there are any processes running on a macOS system that are missing the LC_CODE_SIGNATURE command. This may be indicative of a LC_LOAD_DYLIB addition attack: https://attack.mitre.org/techniques/T1161/
import os
import sys
import shlex
import argparse
import subprocess
import macholib
import json
import hashlib
#This script is designed to detect the following MITRE ATT&CK Technique:
@nanzhipro
nanzhipro / gist:cef54dbe32075972d8455549f50e7ff4
Created March 9, 2022 12:52 — forked from mattstevens/gist:4400775
Resizing an NSImage on retina Macs for output as a 1x image
NSImage *computerImage = [NSImage imageNamed:NSImageNameComputer];
NSInteger size = 256;
NSBitmapImageRep *rep = [[NSBitmapImageRep alloc]
initWithBitmapDataPlanes:NULL
pixelsWide:size
pixelsHigh:size
bitsPerSample:8
samplesPerPixel:4
hasAlpha:YES
@nanzhipro
nanzhipro / EndpointSecurityDemo.m
Created March 2, 2022 00:43 — forked from Omar-Ikram/EndpointSecurityDemo.m
A demo of using Apple's EndpointSecurity framework - tested on macOS Monterey 12.2.1 (21D62)
//
// main.m
// EndpointSecurityDemo
//
// Created by Omar Ikram on 17/06/2019 - macOS Catalina 10.15 Beta 1 (19A471t)
// Updated by Omar Ikram on 15/08/2019 - macOS Catalina 10.15 Beta 5 (19A526h)
// Updated by Omar Ikram on 01/12/2019 - macOS Catalina 10.15 (19A583)
// Updated by Omar Ikram on 31/01/2021 - macOS Big Sur 11.1 (20C69)
// Updated by Omar Ikram on 07/05/2021 - macOS Big Sur 11.3.1 (20E241)
// Updated by Omar Ikram on 04/07/2021 - macOS Monterey 12 Beta 2 (21A5268h)
@nanzhipro
nanzhipro / EndpointSecurityDemo.m
Created March 2, 2022 00:42 — forked from abjurato/EndpointSecurityDemo.m
A demo of using Apple's new EndpointSecurity framework - tested on macOS Catalina 10.15 (19A583)
//
// main.m
// EndpointSecurityDemo
//
// Created by Omar Ikram on 17/06/2019 - Catalina 10.15 Beta 1 (19A471t)
// Updated by Omar Ikram on 15/08/2019 - Catalina 10.15 Beta 5 (19A526h)
// Updated by Omar Ikram on 01/12/2019 - Catalina 10.15 (19A583)
//
#import <Foundation/Foundation.h>
@nanzhipro
nanzhipro / runAsUser.sh
Created February 16, 2022 08:54 — forked from scriptingosx/runAsUser.sh
template script for macOS which can run a command as the currently logged in user. https://scriptingosx.com/2020/08/running-a-command-as-another-user/
#!/bin/sh
# template script for running a command as user
# The presumption is that this script will be executed as root from a launch daemon
# or from some management agent. To execute a single command as the current user
# you can use the `runAsUser` function below.
# by Armin Briegel - Scripting OS X
#