valkheim

/*
   This file has been generated by IDA.
   It contains local type definitions from
   the type library 'ntoskrnl.exe'
*/

#define __int8 char
#define __int16 short
#define __int32 int
#define __int64 long long

valkheim

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <err.h>
#include <errno.h>
#include <sched.h>
#include <sys/types.h>

valkheim

/*
https://github.com/sagishahar/lpeworkshop
$ sudo apt install gcc-mingw-w64
$ x86_64-w64-mingw32-gcc windows_service.c -o lpe.exe
*/

#include <windows.h>
#include <stdio.h>

#define SLEEP_TIME 5000

valkheim

<#

Update 2021-05-22
https://raw.githubusercontent.com/MattiasC85/Scripts/master/OSD/Download-AppxFromStore.ps1
https://github.com/microsoftfeedback/WinDbg-Feedback/issues/19
https://www.microsoft.com/en-us/p/windbg-preview/9pgjgd53tn86

Update 2020-02-18
Thanks @BruceDawson0xB for pointing out the flaw in the regex pattern. if %tmp% began with a lowercase char the script would fail.

valkheim

//
// Windows x86 Interrupt Descriptor Table (IDT) hook test
//
// Barakat Soror (https://twitter.com/barakatsoror)
//

#include <Windows.h>

int main(void)
{

valkheim

import os
import re
import sys
import logging
import argparse
import subprocess 

import requests

valkheim

"""
IOCTL decoding into an IOCTL dataclass

See also:

* https://www.osronline.com/article.cfm%5Earticle=229.htm
* http://www.ioctls.net/
* https://github.com/h0mbre/ioctl.py
* https://github.com/nccgroup/DriverBuddy/blob/master/DriverBuddy/ioctl.py
* https://social.technet.microsoft.com/wiki/contents/articles/24653.decoding-io-control-codes-ioctl-fsctl-and-deviceiocodes-with-table-of-known-values.aspx

valkheim

KERNEL=4.10.3

NPROC=$(nproc)
HERE=$(dirname $(readlink -f "$0"))

function log
{
  printf "[+] $1\n"
}

valkheim

[*] ELF sections summary:
    +-------+--------------------+----------+-------+-------+-----------------+ 
    | index |               name |    vaddr |  size | perms |      type       | 
    +-------+--------------------+----------+-------+-------+-----------------+ 
    | 0x0   |                    | 0x0      | 0x0   |  ---  |    SHT_NULL     | 
    | 0x1   | .interp            | 0x400238 | 0x1c  |  r--  |  SHT_PROGBITS   | 
    | 0x2   | .note.ABI-tag      | 0x400254 | 0x20  |  r--  |    SHT_NOTE     | 
    | 0x3   | .note.gnu.build-id | 0x400274 | 0x24  |  r--  |    SHT_NOTE     | 
    | 0x4   | .gnu.hash          | 0x400298 | 0x38  |  r--  |  SHT_GNU_HASH   | 
    | 0x5   | .dynsym            | 0x4002d0 | 0xf0  |  r--  |   SHT_DYNSYM    | 

valkheim

class Trie {
public:
    Trie() {
        memset(children, 0, sizeof(children));
        valid = false;
    }
    
    void insert(string word) {
        // from trie root
        auto node = this;