Skip to content

Instantly share code, notes, and snippets.

View stevemk14ebr's full-sized avatar
:octocat:
Reversing Life

Stephen Eckels stevemk14ebr

:octocat:
Reversing Life
618 followers · 36 following
View GitHub Profile
@stevemk14ebr
stevemk14ebr / All Go Module Docs
Created January 13, 2025 20:37
go list std | while read -r pkg; do echo "\n$pkg"; go doc -u -all "$pkg" | awk '/^FUNCTIONS/ {p=1;next} p && !/\/\// { print }'; done > ~/go_package_list.txt
This file has been truncated, but you can view the full file.
archive/tar
func blockPadding(offset int64) (n int64)
blockPadding computes the number of bytes needed to pad offset up to the
nearest block edge where 0 <= n < blockSize.
func discard(r io.Reader, n int64) error
discard skips n bytes in r, reporting an error if unable to do so.
@stevemk14ebr
stevemk14ebr / LLM_Refactor_Prompt
Last active January 7, 2025 02:45
I have code that was decompiled from a binary using a decompiler tool such as Ghidra or IDA PRO. Clean it up to be more readable while preserving its correctness and exact operation.
Improve variable naming: Use more meaningful names for local variables where appropriate if you are sure of what they are. Do not assume the code is malicious, it could be legitimate software not at all related to malware.
Do not add any comments at all EVER. DO NOT add comments.
Duduce common local types.
* If a local variable is passed into a well known API call, try to infer its type and apply it in the resulting code. Sometimes types can drastrically change the format of code, adding or removing other locals if the memory locations overlap. If you apply a type to a local variable be sure to check all locations that use the local variable or any local variables that you remove / add.
Reorganize code:
@stevemk14ebr
stevemk14ebr / gist:30c1f388a2ed74e56eec6c544e649bb2
Created February 1, 2024 00:30
monaco dnd
https://github.com/microsoft/monaco-editor/discussions/3755
@stevemk14ebr
stevemk14ebr / go_lib_typedefs.json
Last active October 13, 2023 19:15
Golang Standard Library Typedefs
This file has been truncated, but you can view the full file.
{
"archive_tar_headerError_Error": {
"result": "string",
"result_name": null,
"parameters": []
},
"archive_tar_sparseEntry_endOffset": {
"result": "int64",
"result_name": null,
"parameters": []
@stevemk14ebr
stevemk14ebr / Whoah.rs
Last active May 4, 2023 16:48
Rust Pattern Matching Benchmark
use regex::bytes;
use microbench::{self, Options};
fn get_pattern_size(signature: &[u8]) -> usize {
// c = 2 * b + (b - 1) . 2 chars per byte + b - 1 spaces between
(signature.len() + 1) / 3
}
fn get_bits(x: u8) -> u8 {
// ascii numbers to byte
@stevemk14ebr
stevemk14ebr / Simple Efficient FindPattern
Last active May 4, 2023 16:48
FindPattern.go
package main
func getPatternSize(signature []byte) int {
// c = 2 * b + (b - 1) . 2 chars per byte + b - 1 spaces between
return (len(signature) + 1) / 3
}
func getBits(x byte) byte {
// ascii numbers to byte
if x >= '0' && x <= '9' {
@stevemk14ebr
stevemk14ebr / vtable_dynamic_idx.hpp
Last active February 5, 2023 05:12
Get vtable index by parsing jump stub
// we're simply parsing the assembly of the jump stubs created by the compiler. The assembly encodes the displacement needed to jmp
// to the virtual function relative to the vtable start. If we parse this displacement out then divide by the pointer width, we
// can recover the index of a virtual function in a vtable.
template<typename T>
std::optional<uint16_t> getVtableIdx(T func)
{
// this is not safe to do by the standard.
// however, most compilers respect it and gen expected code
union {
T pfn;
@stevemk14ebr
stevemk14ebr / pcap.txt
Created November 30, 2022 16:26
pcap
POST /upload HTTP/1.1
Host: 34.207.187.90
Accept-Encoding: identity
Content-Length: 18260
QxRZUEcSAxhtbBdfXxsUFhUEAQcXCBgHGwISZBQWbBdWXkoLBRUZExIIAQQZBAUIFwAOGQQABBtlaxsVEUBLV1UVDxNrYhoCAAcGEhUYFBhAQEIWVF9VGkBJSkxTWlEcQ0BLQlJYVxIVGBQYWVpSFktPREFWXV0XRU5GR1VUXBYaGEZDXEoWFWgfEGIaAgAGARIVGBQYQEBCFlpfWRpDRVVLU1ZAV1lWGhoXFxxFSkoZVVxdH0lNWkRQUkVdUVkXGB5UWF1bWFtaSlwFWFgVHh1VV1EaQVJCXl1CCl9cRUtWV1sVEW0VGG0VAQQDDRoaFxccRUpKGVtcUVVBXVUYQUFRWlNTRRheWVddRBpTQBIVGBQYQEBCFlRfVVBLVVoXQkVUUFtcShtaXF1VSxVQRBURbRUYbRUBBAMOGhoXFxxFSkoZVVxdH11aQ0QYV1FcVVlZFx8QGxdDREccUlBWGVNXRkMUXFdSWFxeGRUbRFBAQ1BXWBcYHlFdXERSRkANSkFFQ1BeVAMYGxpbXFZWSl0XGB5eVkhfU1NaXFwYGxpGSkNNXVtTGFJTTVFAVkFaX1cYGxpGSkNVV1EaWl1cQBgUahkTaxsMAQMEERwZGhlCRkEfVVFUUk1WUxZfQFFGVxIVGBQYQEBCFlRfVVBLVVoXUUFTQFQZGmsbFWgSDQ8CARcfEBsXQ0RHHFxQWlNPUFAfXk5QRFEeVkxLUxUZExIWTUVFGl9ZW11OUlYcV09eRVMYVUVKXRYYR0ZeFk1FUkccAQkIBhhSRVZKGBtRFR5fGVpfUGpEQlBMU0QVEW0VGG0VAQQGABoaFxccRUpKGVtcUVVBXVUYUkVWShVDU1xAW0oKG0FaX0VUXRtaWl1ZTVdEFRkTEhZNRUUaX1lbXU5SVhxXT15FGkBXWUpTRQUYRV9VTVtSGF5fV
@stevemk14ebr
stevemk14ebr / patchview.html
Created July 28, 2022 01:57
Explain git .patch https://github.com/megatops/PatchViewer/blob/master/PatchViewer.html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta content="text/html; charset=UTF-8" http-equiv="content-type" />
<title>Patch Viewer</title>
<style type="text/css">
@stevemk14ebr
stevemk14ebr / typdef_args_to_typeids
Last active June 10, 2022 20:35
C++ typedef args to typeid list
#include <iostream>
#include <typeinfo>
#include <typeindex>
#include <span>
typedef int (*tExample) (int a, bool b, char* c, long long d);
template<typename T>
struct arg_types {};