pierrehpezier

import struct
import magic
from PIL import Image
import sys

img = Image.open(open(sys.argv[1], "rb"))
img_data = b""
for x in range(img.width):
    if len(img_data) >= 2 and not img_data.startswith(b"MZ"):
         print("Not a valid PE file")

pierrehpezier

"""
RC4 Decryption Utility for Malicious Payload Extraction
"""
import sys
import pathlib
import binascii
from Cryptodome.Cipher import ARC4

def main():
    if len(sys.argv) != 3:

pierrehpezier

import binascii
from unicorn import *
from unicorn.x86_const import *
import ida_segment
import ida_bytes
import ida_funcs
import ida_nalt
import idc
import idautils

pierrehpezier

# Copyright (c) 2026 Nextron Systems
# Author: Pierre-Henri Pezier

import idaapi
import idautils
import idc
import re
import struct

from unicorn import *

pierrehpezier

# Copyright (c) 2026 Nextron Systems
# Author: Pierre-Henri Pezier

import idaapi
import idautils
import idc


def _touches_rax(ea):
    """Check if instruction at ea writes to rax/eax/ax/al/ah."""

pierrehpezier

/*
 * Copyright (c) 2026 Nextron Systems
 * Author: Pierre-Henri Pezier
 *
 * POC: Trigger attack chain for the signed kernel rootkit
 *
 * This demonstrates the usermode-to-kernel code execution pipeline:
 *   1. Map a PE payload into process memory
 *   2. Resolve ntoskrnl function RVAs from usermode
 *   3. Build the 56-byte XOR-encrypted command buffer

pierrehpezier

/*
 * Copyright (c) 2026 Nextron Systems
 * Author: Pierre-Henri Pezier
 *
 * POC: Trigger attack chain for the signed kernel rootkit
 *
 * This demonstrates the usermode-to-kernel code execution pipeline:
 *   1. Map a PE payload into process memory
 *   2. Resolve ntoskrnl function RVAs from usermode
 *   3. Build the 56-byte XOR-encrypted command buffer

pierrehpezier

#!/usr/bin/env python3
"""
handshake_hash.py
=================

Emulate the Htsysm49BE01 driver's RE_handshake_hash_v[0..3] in user-mode
via Unicorn so a client can compute the expected verify hash for IOCTL
0xAA023828 without any kernel-mode hooks, breakpoints, or driver patching.

Why this works (and why the driver author thought it wouldn't):