Skip to content

Instantly share code, notes, and snippets.

@nicoster
nicoster / msgmon.wds
Created April 12, 2012 15:20
monitor a posted window msg using windbg
.if (not(${/d:$arg1}))
{
.echo Usage:
.echo " $$>a<${$arg0} msg [hwnd]"
.echo " Specify the msg you want to check. You could specify the hwnd as well"
.echo ""
.echo Example:
.echo " $$>a<${$arg0} 400 1a0396 # monitor msg WM_USER (0x400) for window 0x1a0396"
.echo " $$>a<${$arg0} 1 # monitor msg WM_CREATE (0x1) for all windows in current process"
}
@nicoster
nicoster / chkshowwnd.wds
Created April 12, 2012 23:45
Monitoring show/hide window using Windbg
.if (not(${/d:$arg1}))
{
.echo Now you're monitoring all windows for show/hide events in current process.
.echo
.echo If you just want to monitor one window, do it this way:
.echo " $$>a<${$arg0} [hwnd]"
.echo
bp USER32!NtUserShowWindow ".printf \"ShowWindow(%N, %d)\\n\", poi(@esp+4), @@(!!@@(poi(@esp+8)));g"
bp USER32!NtUserSetWindowPos ".printf \"SetWindowPos(%N, %d)\\n\", poi(@esp+4), @@(!!(@@(poi(@esp+1c))&0x40));g"
@nicoster
nicoster / buildpp.sh
Created April 13, 2012 06:28
Build your boost::preprocessor library
#!/bin/bash
src=/tmp/boostpp.cpp
cat>$src<<EOF
#include <boost/preprocessor/config/config.hpp>
#include <boost/preprocessor/repetition.hpp>
#include <boost/preprocessor/array.hpp>
EOF
@nicoster
nicoster / httpshark.lua
Last active October 30, 2016 10:34
#parse http request and response in wireshark #this was originally posted at http://blog.csdn.net/jasonhwang/article/details/5525700 by Huang Qiangxiong.
-- Decode param=value from "application/x-www-form-urlencoded" type http body
-- Original Author: Huang Qiangxiong (qiangxiong.huang@gmail.com)
-- change log:
-- 2010-04-20
-- Just can play.
-- 2010-04-24
-- Add option "Turn on/off debug tree item" to preference window.
-- Add option "add_orig_item" to preference window.
------------------------------------------------------------------------------------------------
do
@nicoster
nicoster / findthis.py
Last active March 2, 2016 13:11
This script finds the registers saved on the stack in each frame.As ESI, EDI usually serves as the 'this' ptr to an object, that's why it's named findthis. It is written in python. An extension pykd(http://pykd.codeplex.com/) needs to be installed and loaded before running the script in Windbg.Check http://nicoster.github.io/find-this-ptr-within…
desc = '''
Author: Nick X(nicoster@gmail)
This scripts finds the registers saved on the stack in each frame.
As ESI, EDI usually serves as the 'this' ptr to an object, that's why it's named findthis
Usage:
!py findthis [debug|desc]
Due to a bug in pykd that it won't allow modifying a file once it's loaded by '!py' cmd.
@nicoster
nicoster / sort.py
Last active December 31, 2015 16:49
sort components for building a train. nicoster@gmail. 2013. all rights reserved
#!/usr/bin/python
# -*- coding: utf8 -*-
import sys
reload(sys)
sys.setdefaultencoding('gbk')
_debug = False
_index_node = 1
_index_parent = 3
@nicoster
nicoster / .slate.js
Last active January 2, 2016 05:19
my slate config file
/*
my slate config file
nicoster@gmail
*/
function hyper(key){return key + ':ctrl;shift;alt;cmd';}
slate.bind(hyper('r'), slate.op('relaunch'));
// fast switch to common applications
#include <mach/mach.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#define CHECK_MACH_ERROR(a, msg) do {kern_return_t rr = (a); if ((rr) != KERN_SUCCESS) { printf("%s Mach error %x (%s) on line %d of file %s\n", msg, (rr), mach_error_string((rr)), __LINE__, __FILE__); abort(); } } while (0)
static int
setup_recv_port (mach_port_t *recv_port)
@nicoster
nicoster / c++.sublime-build
Created February 24, 2014 06:41
This is the custom sublime-build for c++ that works for me the best. pay attention to the 'selector' field. it's a plain string rather than an array. keyword: vs2008, cl.exe, sublime text, custome build
{
"cmd": ["cl", "${file}", "/link", "user32.lib"],
"path": "C:\\Program Files (x86)\\Microsoft Visual Studio 9.0\\Common7\\IDE;C:\\Program Files (x86)\\Microsoft Visual Studio 9.0\\VC\\BIN;C:\\Program Files (x86)\\Microsoft Visual Studio 9.0\\Common7\\Tools;C:\\Windows\\Microsoft.NET\\Framework\\v3.5;C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727;C:\\Program Files (x86)\\Microsoft Visual Studio 9.0\\VC\\VCPackages;C:\\Program Files\\Microsoft SDKs\\Windows\\v6.0A\\bin;C:\\Program Files\\Intel\\iCLS Client\\;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0;C:\\Program Files\\TortoiseSVN\\bin;c:\\python27;C:\\Python27\\Scripts;c:\\program files\\bin;C:\\Program Files\\Microsoft SQL Server\\110\\Tools\\Binn\\;C:\\Program Files (x86)\\Windows Kits\\8.1\\Windows Performance Toolkit\\;C:\\Chocolatey\\bin;",
"working_dir": "${file_path:${folder}}",
"file_regex": "^\\s*(.+?)\\(([0-9]+),?([0-9]+)?\\):\\s*(.*) \\[",
"shell": true,
"selector": "s
@nicoster
nicoster / softokend.js
Created June 13, 2014 11:04
turn SofToken II.app into a https web service
#!/usr/bin/env node
// the pathname of the url without the leading '/' is used as softoken pin
// so make the call with http://localhost:8000/<softoken-pin>
const https = require('https'),
fs = require("fs"),
url = require('url'),
exec = require('child_process').exec;