andreafioraldi

#!/usr/bin/env python3
'''
  Copyright (c) 2020-2021, Andrea Fioraldi


  Redistribution and use in source and binary forms, with or without
  modification, are permitted provided that the following conditions are met:

  1. Redistributions of source code must retain the above copyright notice, this
     list of conditions and the following disclaimer.

icecr4ck

IDA Microcode notes

References

• Ilfak's presentation at Recon 2018
• Microcode in pictures
• Hex-Rays Microcode API vs. Obfuscating Compiler
• Scripts vds10, vds11, vds12 and vds13 from Hex-Rays SDK

Implementation

sudhackar

import ctypes
import struct

s = set()
t = set()
for x in range(2**16):
    y = (((x & 0xFFC) << 16) - 0x14C437BE) ^ ((x & 0xF0) << 8) | ((x & 0xFFC) << 8) |  ((x >> 8) << 24) |  x & 0xFC
    y = ctypes.c_uint32(y).value
    # print hex(x), hex(y)
    if not y in s:

bhaskarvk

This approach uses update-alternatives to manage GCC and LLVM/CLANG C/C++ compiler toolchains. Although tested on Linux Mint 18.3, this approach should work on any Debian based distro or for that matter any Linux distro with update-alternatives support, provided the packages are installed correctly.

There are 3 files

• gcc-alternatives.sh installs GCC versions 5/6/7 and sets up alternatives for gcc/g++/cpp/gfortran.
• llvm-clang-alternatives.sh installs LLVM and CLANG versions 4/5 and sets up alternatives for various LLVM and CLANG programs including clang and clang++.
• cc-alternatives.sh sets up alternatives for the cc, cxx, and the ld commands. This script can be used to change systemwide default compiler/linker combination to either GCC or CLANG.

Once these scripts are run you can change the system GCC/CLANG versions by running sudo update-alternatives --config gcc|clang. To change the default compiler/linker combo used by t

yellowbyte

32-bit ELF binary

how to assemble and link:

nasm -f elf32 -o <filename>.o <filename>.asm
ld -m elf_i386 -o <filename> <filename>.o

template code (hello world):

section .text
global _start

kvaps

set timeout=3

menuentry 'Linux diskless' --class os {

     insmod efi_gop
     insmod efi_uga

     # set server from option 66 (tftp-server-name) if not exist, use next_server
     if ! net_get_dhcp_option net_default_server ${net_default_interface} 66 string; then
         echo '        using next_server option instead.'

williballenthin

# build wine Docker image
pushd wine; docker build -t wine .; popd

# build x11 Docker image for IDA
pushd ida; docker build -t wine/ida .; popd

# demonstrate x11 forwarding works
docker run -ti --rm -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix wine/ida xclock

# interactive shell in container

timm

class Rx:
  "has the nums of a treatment, its name and rank"
  def __init__(i,lst):
     i.rx, i.lst = lst[0], lst[1:]
     i.mean = sum(i.lst)/len(i.lst)
     i.rank = 0
  def __repr__(i):
    return 'rank #%s %s at %s'%(i.rank,i.rx,i.mean) 

def a12s(lst,rev=True,enough=0.66):