Skip to content

Instantly share code, notes, and snippets.

View whitequark's full-sized avatar
🐈‍⬛

Catherine whitequark

🐈‍⬛
View GitHub Profile
# /// script
# requires-python = "~=3.11"
# dependencies = [
# "colored==2.3.0",
# "z3-solver==4.14.1.0"
# ]
# ///
import os
import sys
@whitequark
whitequark / log_func_rename.py
Last active April 23, 2025 12:28
Binary Ninja snippets
#Extract function name from log calls
#
logger = "LogFuncRename"
def log_func_rename(log_function, name_index):
func_votes = defaultdict(lambda: defaultdict(lambda: 0))
for call_site in log_function.caller_sites:
if not isinstance(call_site.hlil.operands[0], HighLevelILConstPtr):
continue
if call_site.hlil.operands[0].constant != log_function.start:
@whitequark
whitequark / meow.md
Last active April 24, 2025 03:01
reverse engineering tools

"%" means not tested by me personally.

Reference material

  • syscall.sh: Linux ARMv7/AArch64/x86/x86_64 ABI and syscall tables

Disassemblers and decompilers

  • Binary Ninja: interactive native code disassembler, decompiler, and debugger
    • BinExport: companion tool for BinDiff
      • when building, replace the BN SDK it downloads with a path to BN API library
    • SENinja: symbolic execution engine for BN with a debugger-like API, based on Z3
@whitequark
whitequark / x64_arm64_sysmain.sdb.xml.diff
Created July 26, 2024 05:05
Difference between (two random revisions of) c:\windows\appcompat\sysmain.sdb between x64 and arm64 platforms
This file has been truncated, but you can view the full file.
diff --git a/x64_sysmain.sdb.xml b/arm64_sysmain.sdb.xml
index 3fbe1b5..b978574 100644
--- a/x64_sysmain.sdb.xml
+++ b/arm64_sysmain.sdb.xml
@@ -1,5 +1,5 @@
<?xml version="1.0" encoding="utf-8" standalone="yes"?>
-<SDB xmlns:xs="http://www.w3.org/2001/XMLSchema" path=".\data\sysmain.sdb">
+<SDB xmlns:xs="http://www.w3.org/2001/XMLSchema" path=".\data_arm64\sysmain.sdb">
<INDEXES>
<INDEX>
@whitequark
whitequark / sysmain.sdb.xml.part
Created July 26, 2024 03:59
Every `GenericInstaller` in the Windows apppatch database (if your binary matches any of these you'll get an UAC prompt)
<EXE>
<NAME type="xs:string">*</NAME>
<WILDCARD_NAME type="xs:string">*</WILDCARD_NAME>
<APP_NAME type="xs:string">Tarma Installer</APP_NAME>
<VENDOR type="xs:string">Tarma</VENDOR>
<EXE_ID type="xs:string" baseType="xs:base64Binary">{22187a8c-2c98-41f6-8ed6-6f653fe134c7}</EXE_ID>
<APP_ID type="xs:base64Binary" />
<RUNTIME_PLATFORM type="xs:int">37</RUNTIME_PLATFORM>
<MATCHING_FILE>
<NAME type="xs:string">*</NAME>
@whitequark
whitequark / qspi_iostream.py
Last active August 1, 2024 16:02
Amaranth 0.5 demo with a pipelined QSPI core impemented using streams
from amaranth import *
from amaranth.lib import enum, data, wiring, stream, io
from amaranth.lib.wiring import In, Out, connect, flipped
from amaranth.sim import Simulator
class IOStream(wiring.Component):
def __init__(self, width, *, meta_layout=0, latency=0):
self._latency = latency
@whitequark
whitequark / spi_serdes.py
Created June 18, 2024 02:49
Amaranth 0.5 demo with a pipelined SPI core (easily extendable to QSPI) impemented using streams
from amaranth import *
from amaranth.lib import data, wiring, stream, io
from amaranth.lib.wiring import In, Out
from amaranth.sim import Simulator
class BitSerializer(wiring.Component):
def __init__(self, *, width, length):
self._length = length
@whitequark
whitequark / cxxrtl_debug_server_spec.md
Last active September 25, 2024 12:51
CXXRTL debug server protocol
@whitequark
whitequark / ELEMENT_ISSUES.md
Last active August 12, 2023 19:19
Element issues
  1. (Desktop 1.11.34) Edit events increase unread count, and like in (2) there isn't even any way to find out what was edited besides educated guessing
  2. (Desktop 1.11.34) New messages in threads increase unread count, but there is no easy way to get to the thread that had a new message (like it is for clicking on the room for normal messages)
  3. (Desktop 1.11.34) Thread view is stuffed into the same sidebar as other auxiliary info. I want auxiliary info to be narrow, and the thread view to be wide (ideally replacing the normal view when I'm in a thread); right now this requires constant manual resizing
  4. (Android 1.5.32 no GMS) Notifications sometimes/often arrive in batches hours after the messages arrived on Desktop Element and I responded to them later
  5. (Android 1.5.32) If I lock my phone with Element open on it and unlock it later, sometimes Element blocks without any redraw or indication for >>seconds, which causes the overall OS UI to behave weirdly and not let me do much
  6. (Desktop 1.11.34) Room
@whitequark
whitequark / gist:ed0d0967efab26f2699a7251bf0bd40d
Last active March 13, 2023 11:30
Godox X1T on-air protocol description
CH1 is at 2.413G, format is 250kbps FSK.
All packet bits are inverted wrt nRF24L01+.
<PACKET>:
0xAA 0xAA 0xAA 0xAA 0xC3 0x68 0xC3 0x68 <PAYLOAD>
<PAYLOAD>:
<CONTROL>
<CONFIG>