williballenthin

AskText QLabel#counterlabel
{
    color: grey;
}

AskText QLabel#counterlabel[invalid=true]
{
    color: red;
}

williballenthin

"""
search for and patch out known opaque predicates within IDA Pro workspaces.

just run the script and it will manipulate the open database.
therefore, you should probably create a backup first.
"""
import logging
from pprint import pprint

import ida_idp

williballenthin

import re
import collections

import idaapi
import ida_kernwin


class button_hooks_t(ida_kernwin.View_Hooks):
    def __init__(self, v):
        '''

williballenthin

//------------------------------------------------
//--- 010 Editor v8.0.1 Binary Template
//
//      File: Transactional Registry Transaction Logs (.TxR)
//   Authors: Willi Ballenthin <[email protected]>
//   Version: 0.1
// Reference: https://www.fireeye.com/blog/threat-research/2019/01/digging-up-the-past-windows-registry-forensics-revisited.html
//------------------------------------------------

LittleEndian();

williballenthin

use log::{info};
use actix;
use actix_web::{
    http, middleware, server, App, HttpRequest, HttpResponse,
};

/// These are the possible states that the server can be requested to run.
#[derive(Debug)]
enum ServerState {
    /// Stop the server.

williballenthin

'''
parse SavedState artifacts extracted from OSX.

author: Willi Ballenthin ([email protected])
license: Apache 2.0
'''
import re
import sys
import json
import struct

williballenthin

#!/usr/bin/env python3
'''
bling.py - extract keys from macOS keychains.

installation:
  pip install pytz hexdump vivisect-vstruct-wb tabulate argparse pycryptodome

usage:
  python bling.py /path/to/keychain-db <password> ./path/to/output/directory

williballenthin

'''
author: Willi Ballenthin
email: [email protected]
license: Apache 2.0
'''
import sys
import struct
import collections

williballenthin

'''
parse osx sticky databases.

author: Willi Ballenthin <[email protected]>
license: Apache 2.0

usage:

    $ python extract_stickies.py  /path/to/input.bin  /path/to/output/directory/
'''

williballenthin

"""
derived from plistlib.py -- a tool to generate and parse MacOSX .plist files.

edited by: Willi Ballenthin ([email protected])

changes:
  - remove all but the binary plist parser
  - add support for UID fields, see https://bugs.python.org/issue26707
"""