Skip to content

Instantly share code, notes, and snippets.

View peta909's full-sized avatar
🏠
Working from home

Mark Lim peta909

🏠
Working from home
33 followers · 5 following
View GitHub Profile
@peta909
peta909 / Wow64Hook.cpp
Created August 27, 2020 16:21 — forked from hoangprod/Wow64Hook.cpp
Wow64Hook example
#include "stdafx.h"
#include <iostream>
LPVOID lpJmpRealloc = nullptr;
DWORD Backup_Eax, Handle, Address_1, New, Old, *DwSizee;
const DWORD_PTR __declspec(naked) GetGateAddress()
{
__asm
{
@peta909
peta909 / main.cpp
Created November 14, 2020 15:46 — forked from hasherezade/main.cpp
Get PEB64 from a WOW64 process
#include <Windows.h>
#include <iostream>
#include "ntdll_undoc.h"
PPEB get_default_peb()
{
#if defined(_WIN64)
return (PPEB)__readgsqword(0x60);
#else
@peta909
peta909 / x96shell_msgbox.asm
Created May 8, 2021 01:47 — forked from aaaddress1/x96shell_msgbox.asm
x96 Windows Shellcode: one payload able to used in both 32-bit & 64-bit
; x96 shellcode (x32+x64) by [email protected]
; yasm -f bin -o x96shell_msgbox x96shell_msgbox.asm
section .text
bits 32
_main:
call entry
entry:
mov ax, cs
sub ax, 0x23
jz retTo32b
@peta909
peta909 / idapython_ctree.md
Created January 16, 2022 12:11 — forked from icecr4ck/idapython_ctree.md
Notes on CTREE usage with IDAPython

IDAPython CTREE

Important links

Description

The CTREE is built from the optimized microcode (maturity at CMAT_FINAL), it represents an AST-like tree with C statements and expressions. It can be printed as C code.

@peta909
peta909 / PE PACKER
Created October 19, 2023 12:22 — forked from securitygab/PE PACKER
A simple x86 packer that uses APLib,
#########################################
# Created by @kuroi_dotsh - KuroiSH #
# Website: https://dengisan.nl/ #
# E-mail: [email protected] #
#########################################
;
; The executable is stored in the final section, so that it does not need
; relocations (as we can simply load it over our own headers and pad with
; virtualsize to keep our module running).
@peta909
peta909 / ida_mc_notes.md
Created December 22, 2024 12:57 — forked from icecr4ck/ida_mc_notes.md
Some notes about the IDA Microcode (intermediate language).