shellcromancer

#!/bin/bash

matched_yara_fn() {
    match_w_rz_cmds=$(yara -s "$1" "$2" | awk -F  ':' '/1/ {printf "%s,aac; afi. @ $(?P %s)\n", $2, $1}');
        
    IFS=$'\n'; while IFS= read -r line; do
        oIFS=$IFS

        IFS=',' read -r match rzcmd <<< "${line}"
        echo "$(rizin -qc "$rzcmd" "$2") contains match for $match";

shellcromancer

rule alg_crypto_rc4 {
    meta:
        descrption = "Identify code for the (A)RC4 cryptographic algorithm."
        author = "@shellcromancer <[email protected]>"
        version = "0.1"
        date = "2022-01-03"
        reference = "https://www.goggleheadedhacker.com/blog/post/reversing-crypto-functions#identifying-rc4-in-assembly"
        reference = "https://0xc0decafe.com/detect-rc4-encryption-in-malicious-binaries/"
        reference = "https://blog.talosintelligence.com/2014/06/an-introduction-to-recognizing-and.html"
    strings:

shellcromancer

rule alg_salsa20 {
    meta:
        desc = "Identify code for the Salsa20 cryptographic algorithm."
        author = "@shellcromancer <[email protected]>"
        version = "0.1"
        last_modified = "2022-01-02"
        reference = "https://www.goggleheadedhacker.com/blog/post/reversing-crypto-functions"
    strings:
        $const16 = "expand 16-byte k" ascii
        $const32 = "expand 32-byte k" ascii

shellcromancer

#!/usr/bin/env python3

from collections import defaultdict
import io
import os
import requests
import sys
from typing import Dict, List
import zipfile

shellcromancer

Keybase proof

I hereby claim:

• I am shellcromancer on github.
• I am shellcromancer (https://keybase.io/shellcromancer) on keybase.
• I have a public key ASAd-lIOgtX3Pl3J20Y6R1D6kB1nFpxnYxBWfW4bXqK5pQo

To claim this, I am signing this object:

shellcromancer

#include <sys/mman.h>
#include <unistd.h>
#include <sys/types.h>

typedef struct {
    int data;
    void (*fp)(int);
} obj1;

typedef struct {

shellcromancer

#include <sys/mman.h>
#include <unistd.h>
#include <sys/types.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>

int backdoor = 0;

struct node {