notareverser

rule Windows_7z_SFX
{
  strings:
      $makeCommandFile_prefix_1 = {53 56 8b 75 08 66 83 7e 02 3a 0f 85 ?? ?? ?? ?? 0f b7 46 04 66 3d 5c 00 74 0a 66 3d 2f 00 0f 85 ?? ?? ?? ?? 66 8b 06 66 89 45 f0 8d 45 f0 33 db 50 66 c7 45 f2 3a 00 66 c7 45 f4 5c 00 66 89 5d f6 ff 15}

      $makeCommandFile_prefix_2 = {53 8b 45 08 33 db 89 5d fc 66 83 78 02 3a 0f 85 ?? ?? ?? ?? 66 8b 48 04 66 83 f9 5c 74 0a 66 83 f9 2f 0f 85 ?? ?? ?? ?? 66 8b 00 66 c7 45 e6 3a 00 66 89 45 e4 8d 45 e4 50 66 c7 45 e8 5c 00 66 89 5d ea ff 15}

      $makeCommandFile_prefix_3 = {53 56 8b 75 08 33 db 66 83 7e 02 3a 89 5d fc 0f 85 ?? ?? ?? ?? 66 8b 46 04 66 3d 5c 00 74 0a 66 3d 2f 00 0f 85 ?? ?? ?? ?? 66 8b 06 66 89 45 e4 8d 45 e4 50 66 c7 45 e6 3a 00 66 c7 45 e8 5c 00 66 89 5d ea ff 15}

      $makeCommandFile_prefix_4 = {8b 45 08 66 83 78 02 3a 0f 85 ?? ?? ?? ?? 0f b7 48 04 66 83 f9 5c 74 0a 66 83 f9 2f 0f 85 ?? ?? ?? ?? 66 8b 00 6a 3a 66 89 45 e8 58 66 89 45 ea 6a 5c 58 66 89 45 ec 33 c0 66 89 45 ee 8d 45 e8 50 ff 15}

notareverser

#!/usr/bin/env python3

import sys
import argparse
import os
import hashlib

def parseArguments():
    parser = argparse.ArgumentParser(description="Rename files based on their MD5")
    parser.add_argument('file',

notareverser

#!/usr/bin/env python3


import argparse
import sys
import json

import logging

notareverser

#!/usr/bin/env python3


import argparse
import sys
import mmap
import logging

from collections import defaultdict

notareverser

import operator

def compileTime(data):
  from struct import unpack_from as suf
  if data[0:2] == b'\x4d\x5a':
    peOffset = suf("<H",data,0x3c)[0]
    if data[peOffset:peOffset+4] == b'\x50\x45\0\0':
      return suf("<L",data,peOffset+8)[0]
  return None

notareverser

// https://github.com/NozomiNetworks/upx-recovery-tool
rule UPX_nozomi_x86
{
  strings: $sig = { 50 e8 ?? ?? 00 00 eb  5a 58 59 97 60 8a 54 24 20 e9 ?? ?? 00 00 60 8b 74 24 24 8b 7c 24 2c 83 cd}
  condition: any of them
}

rule UPX_nozomi_x64
{
  strings:

notareverser

import idaapi as ia, idc

def PLUGIN_ENTRY(): return nop()
class nop(ia.plugin_t):
 flags = ia.PLUGIN_UNL
 comment = "NOP"
 help = "select bytes, run"
 wanted_name = "NOP bytes..."
 wanted_hotkey = "Ctrl+Shift+N"

notareverser

#include <idc.idc>


static lmd5(fmd5)
{
    auto result,size, nb, x;
    size=strlen(fmd5);
    result="";
    for (x = 0; x < size; x++)
    {