barberj

tmux cheatsheet

start new:

tmux

start new with session name:

tmux new -s myname

makelariss

# -*- coding: UTF-8 -*-
from ctypes.wintypes import *
from ctypes import *
from enum import IntEnum


# These libraries have the APIs we need
kernel32 = WinDLL('kernel32',    use_last_error=True)
advapi32 = WinDLL('advapi32',    use_last_error=True)
psapi    = WinDLL('psapi.dll',   use_last_error=True)

sudo-suhas

pprof

With a single import _ "net/http/pprof" you can add profiling endpoints to a HTTP server.

package main

import (
	"fmt"

alxbl

import sys
import random
import binascii
import struct
import os

from ctypes import *
from ctypes.wintypes import *

# Shorthands for some ctypes stuff.

icecr4ck

IDAPython cheatsheet

Important links

• Porting IDAPython plugins to IDA 7.4
• Hex-Rays IDAPython official documentation

Basic commands

Get informations on the binary

icecr4ck

IDAPython CTREE

Important links

• Hex-Rays Decompiler Primer
• hexrays.hpp

Description

The CTREE is built from the optimized microcode (maturity at CMAT_FINAL), it represents an AST-like tree with C statements and expressions. It can be printed as C code.

NyaMisty

Resync Local Types in IDA

Sometimes there's some inconsistency between local types and structs view.

Typically, you can see the type in the "Structures" view are zero-lengthed, which should normally be the same size as local type's one.

When this happens, you'll not be able to rename the structure fields in HexRay Decompiler's view, and both hotkey N and right-clicking the item won't show the rename popup.

After reverse engineering the hexx64.dll, I found that IDA tries to do the following things:

odzhan

/**
    Compression using undocumented API in rdpbase.dll

    RDPCompressEx supports four algorithms : MPPC-8K, MPPC-64K, NCRUSH and XCRUSH.

    This code supports all except NCRUSH.
    The MPPC compression ratio is very similar to LZSS, so this could be quite useful for shellcode trying to evade detection.
    
    NCRUSH compression appears to work but fails for decompression.