williballenthin

"""
search for and patch out known opaque predicates within IDA Pro workspaces.

just run the script and it will manipulate the open database.
therefore, you should probably create a backup first.
"""
import logging
from pprint import pprint

import ida_idp

williballenthin

//------------------------------------------------
//--- 010 Editor v8.0.1 Binary Template
//
//      File: Transactional Registry Transaction Logs (.TxR)
//   Authors: Willi Ballenthin <[email protected]>
//   Version: 0.1
// Reference: https://www.fireeye.com/blog/threat-research/2019/01/digging-up-the-past-windows-registry-forensics-revisited.html
//------------------------------------------------

LittleEndian();

williballenthin

use log::{info};
use actix;
use actix_web::{
    http, middleware, server, App, HttpRequest, HttpResponse,
};

/// These are the possible states that the server can be requested to run.
#[derive(Debug)]
enum ServerState {
    /// Stop the server.

williballenthin

'''
parse SavedState artifacts extracted from OSX.

author: Willi Ballenthin ([email protected])
license: Apache 2.0
'''
import re
import sys
import json
import struct

williballenthin

#!/usr/bin/env python3
'''
bling.py - extract keys from macOS keychains.

installation:
  pip install pytz hexdump vivisect-vstruct-wb tabulate argparse pycryptodome

usage:
  python bling.py /path/to/keychain-db <password> ./path/to/output/directory

williballenthin

'''
author: Willi Ballenthin
email: [email protected]
license: Apache 2.0
'''
import sys
import struct
import collections

williballenthin

'''
parse osx sticky databases.

author: Willi Ballenthin <[email protected]>
license: Apache 2.0

usage:

    $ python extract_stickies.py  /path/to/input.bin  /path/to/output/directory/
'''

williballenthin

"""
derived from plistlib.py -- a tool to generate and parse MacOSX .plist files.

edited by: Willi Ballenthin ([email protected])

changes:
  - remove all but the binary plist parser
  - add support for UID fields, see https://bugs.python.org/issue26707
"""

williballenthin

'''
Identify functions that are referenced as data.

For example, something weird is going on below::

    .text:10001833 BE 60 25 00 10          mov     esi, offset sub_10002560    <<<<
    .text:10001838 8B 45 FC                mov     eax, [ebp+var_4]
    .text:1000183B 89 5F 04                mov     [edi+4], ebx
    .text:1000183E 81 C7 18 02 00 00       add     edi, 218h
    .text:10001844 F3 A5                   rep movsd