Igor Skochinsky skochinsky

A traditional table-based DFA implementation looks like this:

uint8_t table[NUM_STATES][256]

uint8_t run(const uint8_t *start, const uint8_t *end, uint8_t state) {
    for (const uint8_t *s = start; s != end; s++)
        state = table[state][*s];
    return state;
}

	#!/usr/bin/env python3
	# initial script by b1n4r1b01 but he deleted his repo
	# https://gist.github.com/woachk/6092f9ae950455dcdf8428c3ce2d639e
	# added python3 support

	import sys
	import struct
	import os

	#
	# arm64_sysregs_ios.py
	# Brandon Azad
	#
	# Based on https://github.com/gdelugre/ida-arm-system-highlight by Guillaume Delugre.
	#

	import idautils
	import idc

	import zipfile
	import httpio
	import sys

	def usage():
	print("httpzip.py <url> [filename]")

	if len(sys.argv)>1:
	url = sys.argv[1]
	else:

	#! python2
	#-------------------------------------------------------------------------------
	# Name: dump_hdr.py
	# Purpose: dump header of a FujiFilm FinePix firmware update
	# see https://reverseengineering.stackexchange.com/questions/22549/identifying-rom-segment-in-unknown-firmware-update-file
	# Author: Igor Skochinsky
	#
	# Created: 16-11-2019
	# Copyright: (c) Igor Skochinsky 2019
	# Licence: MIT

	/*scan for far jumps or calls and print their location and destinations
	jmp: 1= search for jumps(0= calls)
	low16: only consider destinations with offset < 16
	*/
	static scan_jmp_call(jmp, low16)
	{
	// start at the minimal address
	auto a = 0;
	auto x, seg, offs, dest;
	for (a = 0; x != BADADDR; a = x + 5 )// skip 5 bytes (size of far jmp/call opcode)

	## parse and dump Qt resources in current IDB
	from PyQt5 import QtCore
	import os.path
	f = LocByName("?qRegisterResourceData@@YA_NHPBE00@Z")
	for x in XrefsTo(f, idaapi.XREF_ALL):
	if x.type==fl_CN:
	callea = x.frm
	push1 = DecodePreviousInstruction(callea)
	if push1.itype != idaapi.NN_push:
	print "no push at %08X!"% push1.ea

	# convert Intel firmware update capsules to plain binaries

	import sys
	import os.path
	import struct

	fn = sys.argv[1]
	inf = open(fn, "rb")
	inf.seek(0xC8)
	e=[]

	# based on code from http://trendystephen.blogspot.be/2008/01/rich-header.html
	import sys
	import struct

	# I'm trying not to bury the magic number...
	CHECKSUM_MASK = 0x536e6144 # DanS (actuall SnaD)
	RICH_TEXT = 'Rich'
	RICH_TEXT_LENGTH = len(RICH_TEXT)
	PE_START = 0x3c
	PE_FIELD_LENGTH = 4

	struct PFRegionEntry
	{
	UINT32 FileOffset;
	UINT32 Size;
	UINT64 FlashAddress;
	UINT32 NameOffset; //absolute offset
	};

	struct PFHeader
	{