trietptm

A guide to character encoding aware development

By Branden Clark - https://clark.re

• Intro
  • What are character encodings
  • Why does the encoding matter
  • Why do these examples work fine with English
  • How do I tell what encoding a file is in
• Windows

trietptm

You appear to be advocating a new...

• Functional
• Imperative
• Object-oriented
• Procedural
• Stack-based
• "Multi-paradigm"
• Lazy
• Eager

trietptm

from x64dbgpy import pluginsdk

# Put this script in the Python path, and 
# execute the following Python snippets in
# the Python dialog in x64dbg:
#
# from stop_cpuid_detect import *
# trace_cpuid(n=1000)

# the above code will trace through the program

trietptm

#summary Bookmarks List = Hacker Media =

== Blogs Worth It: == What the title says. There are a LOT of pentesting blogs, these are the ones i monitor constantly and value in the actual day to day testing work.

* http://carnal0wnage.blogspot.com/
* http://www.mcgrewsecurity.com/
* http://www.gnucitizen.org/blog/

• http://www.darknet.org.uk/

trietptm

/*
 * Naive hit tracer implementation using DynamoRIO.
 * 
 * Author: axt
 * 
 * Build it with the following commands:
 *	gcc  -Dbbhit_EXPORTS -DSHOW_RESULTS -DSHOW_SYMBOLS -fPIC -I../include -I../ext/include  -DX86_64 -DLINUX  -O2 -fno-stack-protector -o bbhit.c.o  -c bbhit.c
 *	gcc  -fPIC -O2  -DX86_64 -DLINUX -fno-stack-protector -fPIC -shared -lgcc -Wl,--hash-style=both -shared -Wl,-soname,libbbhit.so -o libbbhit.so bbhit.c.o ../lib64/debug/libdynamorio.so.4.2 ../ext/lib64/debug/libdrsyms.so
 */
#include <stddef.h>

trietptm

#! /usr/bin/env python

##########################################################################################
##
## RC4 Crypto
##
##########################################################################################

def rc4crypt(key, data):

trietptm

Choco Install

Install Choco

@"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))" && SET "PATH=%PATH%;%ALLUSERSPROFILE%\chocolatey\bin"

Install Ghidra 9.0.2

choco install ghidra

trietptm

1. Binary editors
  hiew
  bz
  010
  winhex
  binwalk (IDA)
  bindiff (IDA)
  
 2. Disassembling
  IDA (+hexrays plugin) (https://t.me/idapro)

trietptm

//https://github.com/theevilbit/injection/blob/master/ProcessHollowing/ProcessHollowing/ProcessHollowing.cpp

#include <stdio.h>
#include <Windows.h>
#include <winternl.h>

#pragma comment(lib,"ntdll.lib")

EXTERN_C NTSTATUS NTAPI NtTerminateProcess(HANDLE, NTSTATUS);
EXTERN_C NTSTATUS NTAPI NtReadVirtualMemory(HANDLE, PVOID, PVOID, ULONG, PULONG);

trietptm

#include <windows.h>
#include <tlhelp32.h>

DWORD getProcessID() {
  DWORD processID = 0;
  HANDLE snapHandle;
  PROCESSENTRY32 processEntry = {0};

  if( (snapHandle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)) == INVALID_HANDLE_VALUE ) {
    return 0;