spnow

############################################################################################
##
## Quick IOCTL Decoder!
##
## All credit for actual IOCTL decode logic:
##      http://www.osronline.com/article.cfm?article=229
## 
##
## To install:
##      Copy script into plugins directory, i.e: C:\Program Files\IDA 6.8\plugins

spnow

from phply.phpparse import parser
import phply.phplex as phplex
from phply.phpast   import *
import sys
import copy
import os.path
import pickle
import subprocess
import traceback

spnow

#include <stdlib.h> 
#include <stdio.h>

void main(int argc, char *argv[])
{
   if( argv[1][0] == 'f' ) {
      if( argv[1][1] == 'o' ) {
         if( argv[1][2] == 'o' ) {
            if( argv[1][3] == '\x00' ) {
               printf( "good password\n" );

spnow

#!/usr/bin/env python

import subprocess, time, os, sys

#TODO: kill any already-running bluelog instances

cmd = ['./bluelog', '-m', '-t', '-f', '-a0', '-n', '-v']
p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)

mru_macs = []

spnow

Practice Challenges

• HSVM sum challenge
• pCTF 2013 "cone" challenge
• CSAW 2013 reversing 300

Resources/Writeups

• Eindbazen "cone" writeup
• Rolf Rolle's z3 based solution to some math problem
• SMT Solvers for Software Security

spnow

-------------------------------
ODbgScript english plugin by E3
site : http://odbgscript.sf.net
-------------------------------

1. About OllyScript and ODbgScript
2. Status
 2.1 What's new?
3. Documentation
 3.1 Language

spnow

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script Host\Settings]
"Enabled"="0"

spnow

// Generic Zeus malware unpacker (ResumeThread)
// by Miroslav Stampar (@stamparm)
// http://about.me/stamparm

VAR ResumeThread
VAR msg
VAR xname
VAR xloc
VAR xsize

spnow

# -*- coding: utf-8 -*-

# LICENSE INFORMATION:
#   Please treat this script as CC0

from immlib import *

imm = Debugger()

class KamikazeHook(LogBpHook):

spnow

from immlib import *
from immutils import *
import getopt
import pefile
imm = Debugger()

def main(args):
    
    if args:
        usage()