roelds

# assumes new Debian Testing VM, for purpose of compiling, running below as root
# uses most libs already available from apt, only compiles lib ntbtls

lsb_release -a
uname -a

wget https://gnupg.org/signature_key.asc
gpg --import signature_key.asc
gpg -k
wget https://www.gnupg.org/signature_key.html

arvati

Mount Destination partition on sdcard

lsblk -f
sudo fdisk /dev/sda
sudo mkfs -t ext4 /dev/sda1
sudo mount -t auto /dev/sda1 /mnt
cd /mnt
sudo su

mkdir -p ./etc/apk

alexander-hanel

Prevent distractions within slack by making the sidebar black.

Slack > Settings > Themes > Create a Custom Theme > "Copy and paste these values to share your custom theme with others" 

Cut and paste the following values

#000000,#000000,#000000,#000000,#000000,#000000,#000000,#000000,#000000,#000000

arvati

How to setup a development environment where Git from WSL integrates with native Windows applications, using the Windows home folder as the WSL home and using Git from WSL for all tools.

Note if using Git for Windows, or any tool on the Windows side that does not use Git from WSL then there will likely be problems with file permissions if using those files from inside WSL.

Tools

These are the tools I use:

• git (wsl) - Command line git from within WSL.
• Fork (windows) - Git GUI (must be used with wslgit)
• wslgit - Makes git from WSL available for Windows applications. Important! Follow the installation instructions and do (at least) the first optional step and then the Usage in Fork instructions.

alexander-hanel

import ctypes

class BYTE2UUID(ctypes.Structure):
    """
    Variant 2 UUIDs
        https://en.wikipedia.org/wiki/Universally_unique_identifier#Encoding
    """
    _fields_ = [
        ("time_low", ctypes.c_uint), ("time_mid", ctypes.c_ushort), ("time_hi_and_version", ctypes.c_ushort),
        ("clock_seq_hi_and_res", ctypes.c_char * 2), ("node", ctypes.c_char * 6)

roelds

HowTo build / make latest brotli Windows 11 binary

I couldn't find latest brotli binary for Win64 / x64, so here is how to compile it on Windows, for Windows: https://github.com/google/brotli

Will use this repo later: https://github.com/Microsoft/vcpkg

Prerequisites

roelds

# for GitHub:
# use this for name:
VERNAME=$(wget -q -O- https://api.github.com/repos/roelds/litaf/releases/latest | jq -r '.name')
# or this for tag name, if jq installed:
VERTAG=$(wget -q -O- https://api.github.com/repos/roelds/litaf/releases/latest | jq -r '.tag_name')
# or if jq not installed:
curl --silent "https://api.github.com/repos/roelds/litaf/releases/latest" | grep -Po "(?<=\"tag_name\": \").*(?=\")"

# latest release tag name, for GitLab:
curl -s https://gitlab.com/gitlab-org/cli/-/releases/permalink/latest | grep -m1 -Eo "releases/[^/]+\"" | awk 'BEGIN { FS="/" } {print $2}' | rev | cut -c2- | rev

roelds

# forkware.yaml
# hosted is github or gitlab
# latest or tag, clone or fork
# n is new line after, r is replace line, b is new line before, i is insert, a is append
---
therepo: prometheus/prometheus
hosted: github
release: latest
method: clone
files:

roelds

#!/usr/bin/fish
#v1.0

echo $argv
set src (yq '.therepo' forkware.yaml)
set host (yq '.hosted' forkware.yaml)
set rel (yq '.release' forkware.yaml)
set meth (yq '.method' forkware.yaml)
echo $src

alexander-hanel

Originally created on 2016-11-06

The Fundamentals of Sharing for Malware Analyst

In most organizations malware analysts are tasked to produce a deliverable derived from static or dynamic analysis. The deliverable could be to extract indicators, understand functionality, write a report or something similar. During this process the analyst will create a number of files and artifacts. These files could be IDBs, memory dumps, yara signature, decoder scripts, pcaps, notes, etc. Once the task has been completed the analyst submits their deliverable and then moves on. In many organizations the files and artifacts are not stored in a way that are accessible to others, which is a shame. Having the data and analysis accessible to others has many positive benefits.

1. Promotes sharing of processes and knowledge between analyst.
2. Removes duplication of labor by allowing analyst to build off of previous research and analysis.
3. Intellectual property and artifacts are not lost when an analyst leaves the organiz