williballenthin

#!/usr/bin/env python2
'''
search for YARA matches in each function within IDA Pro.
upon execution, prompts the user to provide the YARA rules file.

requirements:
  - hexdump
  - yara-python

author: Willi Ballenthin

williballenthin

import logging
import binascii
import collections

import pefile
import hexdump
import unicorn
import keystone
import capstone

williballenthin

set disassembly-flavor intel
set disassemble-next-line on

set history save on
set print pretty on
set pagination off
set confirm off

define xxd
dump binary memory dump.bin $arg0 $arg0+$arg1

williballenthin

(ns capstone-clj.core-test
  (:require [clojure.test :refer :all])
  (:import [capstone.Capstone]))

(deftest basic-capstone
  "
    this is the example from:
    http://www.capstone-engine.org/lang_java.html
  "
  (testing "basic capstone"

williballenthin

williballenthin

# generate via: wevtutil gp Microsoft-Windows-Sysmon /getevents /getmessage

name: Microsoft-Windows-Sysmon
guid: 5770385f-c22a-43e0-bf4c-06f5698ffbd9
helpLink: 
resourceFileName: C:\Windows\Sysmon.exe
messageFileName: C:\Windows\Sysmon.exe
message: 
channels:
  channel:

williballenthin

(def tests [{:name "one top level prop"
             :model {:top-level-prop "A"}
             :query [:top-level-prop]
             :expected {:top-level-prop "A"}}

            {:name "pluck one top level prop"
             :model {:top-level-prop "A" :other-prop "B"}
             ;; even though there are two props at the top level,
             ;;  we are only asking for one.
             :query [:top-level-prop]

williballenthin

#!/usr/bin/env python2
'''
Dump some PE file features from memory images.

author: Willi Ballenthin
email: [email protected]
website: https://gist.github.com/williballenthin/cbc102d561e2eb647f7aec3c3753ba55
'''
import os
import sys

williballenthin

import idc
import idaapi
import idautils


def rename_sub_functions(fva, prefix):
    sub_funcs = set([])
    for f in idautils.Functions():
        for xref in idautils.XrefsTo(f):
            subf = idaapi.get_func(xref.frm)

williballenthin

#!/usr/bin/env python2
'''
Carve PE files from binary data.
Write them into the current directy named after their hash.

Example::

    $ python carvepe.py unallocated.bin
      INFO:__main__:found pe at 0x0, length: 0xd8000
      INFO:__main__:writing pe file to 273ed32b617fd79ed1b88ebd4521a441.bin