williballenthin

import os
import sys
import logging

import pefile
import ucutils
import unicorn
import capstone
import argparse

williballenthin

rule stack_strings
{
    meta:
        author = "William Ballenthin"
        email = "william.ballenthin@fireeye.com"
        license = "Apache 2.0"
        copyright = "FireEye, Inc"
        description = "Match x86 that appears to be stack string creation."

    strings:

williballenthin

#!/usr/bin/env python2
'''
search for YARA matches in each function within IDA Pro.
upon execution, prompts the user to provide the YARA rules file.

requirements:
  - hexdump
  - yara-python

author: Willi Ballenthin

williballenthin

import logging
import binascii
import collections

import pefile
import hexdump
import unicorn
import keystone
import capstone

williballenthin

set disassembly-flavor intel
set disassemble-next-line on

set history save on
set print pretty on
set pagination off
set confirm off

define xxd
dump binary memory dump.bin $arg0 $arg0+$arg1

williballenthin

(ns capstone-clj.core-test
  (:require [clojure.test :refer :all])
  (:import [capstone.Capstone]))

(deftest basic-capstone
  "
    this is the example from:
    http://www.capstone-engine.org/lang_java.html
  "
  (testing "basic capstone"

williballenthin

williballenthin

# generate via: wevtutil gp Microsoft-Windows-Sysmon /getevents /getmessage

name: Microsoft-Windows-Sysmon
guid: 5770385f-c22a-43e0-bf4c-06f5698ffbd9
helpLink: 
resourceFileName: C:\Windows\Sysmon.exe
messageFileName: C:\Windows\Sysmon.exe
message: 
channels:
  channel:

williballenthin

(def tests [{:name "one top level prop"
             :model {:top-level-prop "A"}
             :query [:top-level-prop]
             :expected {:top-level-prop "A"}}

            {:name "pluck one top level prop"
             :model {:top-level-prop "A" :other-prop "B"}
             ;; even though there are two props at the top level,
             ;;  we are only asking for one.
             :query [:top-level-prop]

williballenthin

#!/usr/bin/env python2
'''
Dump some PE file features from memory images.

author: Willi Ballenthin
email: william.ballenthin@fireeye.com
website: https://gist.github.com/williballenthin/cbc102d561e2eb647f7aec3c3753ba55
'''
import os
import sys