Skip to content

Instantly share code, notes, and snippets.

@xrl
xrl / script.py
Created March 23, 2012 08:44
Mr. JC's fabulous script
#!/usr/bin/python
"""
This class is used to search the av.db file generated by Memoryze by Mandiant.
#ProTip: Ensure you enumerate strings in memory when you run Memoryze for best results.
This class takes two arguments:
The path to the av.db file
The string you are searching for
"""
from optparse import OptionParser
@xrl
xrl / connection.hs
Created March 27, 2012 22:40
The maybe monad with IO?
connect_uri :: U.URI -> Identity -> IO (Maybe Socket)
connect_uri uri id = do
auth <- U.uriAuthority uri
sock <- socktype
let host = U.uriRegName auth
let port = U.uriPort auth
return $ connect host port sock id
where socktype
| U.uriScheme uri == "tcp:" = Just S.Stream
| otherwise = Nothing
@xrl
xrl / indexing.fail.log
Created April 6, 2012 10:06
Ruby 1.9.2p290 hard fail
/mnt/apps/rx/staging/releases/20120406093245/vendor/bundle/ruby/1.9.1/gems/activesupport-3.1.3/lib/active_support/dependencies.rb:240: [BUG] Segmentation fault
ruby 1.9.2p290 (2011-07-09 revision 32553) [x86_64-linux]
-- control frame ----------
c:0063 p:0012 s:0238 b:0238 l:000230 d:000237 BLOCK /mnt/apps/rx/staging/releases/20120406093245/vendor/bundle/ruby/1.9.1/gems/activesupport-3.1.3/lib/active_support/dependencies.
c:0062 p:0054 s:0236 b:0236 l:000235 d:000235 METHOD /mnt/apps/rx/staging/releases/20120406093245/vendor/bundle/ruby/1.9.1/gems/activesupport-3.1.3/lib/active_support/dependencies.
c:0061 p:0019 s:0231 b:0231 l:000230 d:000230 METHOD /mnt/apps/rx/staging/releases/20120406093245/vendor/bundle/ruby/1.9.1/gems/activesupport-3.1.3/lib/active_support/dependencies.
c:0060 p:0206 s:0225 b:0225 l:000224 d:000224 METHOD /usr/lib/ruby/1.9.1/rexml/encoding.rb:48
c:0059 p:0012 s:0218 b:0218 l:000217 d:000217 METHOD /usr/lib/ruby/1.9.1/rexml/source.rb:55
c:0058 p:0055 s:0214 b:0214 l:000213 d:000213 ME
@xrl
xrl / make.out
Created April 11, 2012 23:31
Suricata on GCC 4.7/Mac OS X Lion
1.9.3-p125 :008 > Dir["*.c"].select{|x| x != "suricata.c"}.each{|x| file = x[0..-2]+"o"; system("make #{file}"}; nil
1.9.3-p125 :009?>
1.9.3-p125 :010 > ^C
1.9.3-p125 :010 > Dir["*.c"].select{|x| x != "suricata.c"}.each{|x| file = x[0..-2]+"o"; system("make #{file}")}; nil
gcc-4.7 -DHAVE_CONFIG_H -I. -I.. -I../libhtp -I/opt/local/include -g -O2 -Wextra -Wall -fno-strict-aliasing -fno-tree-pre -Wno-unused-parameter -std=gnu99 -DOS_DARWIN -march=native -DLIBPCAP_VERSION_MAJOR=1 -DHAVE_PCAP_SET_BUFF -DUNITTESTS -DREVISION="74721ba" -MT alert-debuglog.o -MD -MP -MF .deps/alert-debuglog.Tpo -c -o alert-debuglog.o alert-debuglog.c
mv -f .deps/alert-debuglog.Tpo .deps/alert-debuglog.Po
gcc-4.7 -DHAVE_CONFIG_H -I. -I.. -I../libhtp -I/opt/local/include -g -O2 -Wextra -Wall -fno-strict-aliasing -fno-tree-pre -Wno-unused-parameter -std=gnu99 -DOS_DARWIN -march=native -DLIBPCAP_VERSION_MAJOR=1 -DHAVE_PCAP_SET_BUFF -DUNITTESTS -DREVISION="74721ba" -MT alert-fastlog.o -MD -MP -MF .deps/alert-fastlog.Tpo -c
@xrl
xrl / suricata.o.out
Created April 17, 2012 08:36
GCC with -v
xavierlange $> make suricata.o
/usr/local/bin/gcc-4.7 -DHAVE_CONFIG_H -I. -I.. -I../libhtp -I/opt/local/include -v -Wextra -Wall -fno-strict-aliasing -fno-tree-pre -Wno-unused-parameter -std=gnu99 -DOS_DARWIN -march=native -DLIBPCAP_VERSION_MAJOR=1 -DHAVE_PCAP_SET_BUFF -DUNITTESTS -DREVISION="61d5fe3" -MT suricata.o -MD -MP -MF .deps/suricata.Tpo -c -o suricata.o suricata.c
Using built-in specs.
COLLECT_GCC=/usr/local/bin/gcc-4.7
Target: x86_64-apple-darwin11.3.0
Configured with: ../configure --enable-languages=c,c++,fortran,java,objc,obj-c++ --prefix=/usr/local/Cellar/gcc/4.7.0/gcc --datarootdir=/usr/local/Cellar/gcc/4.7.0/share --bindir=/usr/local/Cellar/gcc/4.7.0/bin --program-suffix=-4.7 --with-gmp=/usr/local/Cellar/gmp/5.0.4 --with-mpfr=/usr/local/Cellar/mpfr/3.1.0 --with-mpc=/usr/local/Cellar/libmpc/0.9 --with-system-zlib --enable-stage1-checking --enable-plugin --enable-lto --disable-multilib --disable-nls
Thread model: posix
gcc version 4.7.0 (GCC)
COLLECT_GCC_OPTIONS='-mmacosx-version-min=10.7.
@xrl
xrl / setup.log
Created July 1, 2012 01:37
Boundary Setup Not Super Smooth
root@depot:/usr/local/src# ./setup_meter.sh -d -i OHAI
Detected Ubuntu 10.04.2...
Auto generating ec2 tags for this meter....<html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1>The server encountered an error while processing this request:<br><pre>{error,badarg,
[{ets,insert,[8239095,{1,1433}]},
{folsom_sample_uniform,update,2},
{folsom_metrics_histogram,update,2},
{folsom_ets,notify,4},
{folsom_metrics,histogram_timed_update,2},
{tag_resource,resource_exists,2},
module Sunspot
class ResqueSessionProxy < Sunspot::SessionProxy::AbstractSessionProxy
attr_reader :original_session
delegate :config, :delete_dirty?, :dirty?,
:new_search, :search,
:new_more_like_this, :more_like_this,
:remove, :remove!,
if instance.respond_to?(:index)
instance.index
message = "success"
else
message = "#{model_klass} could not be indexed"
end
VS
message = if instance.respond_to?(:index)
@xrl
xrl / m2parser.hs
Created August 23, 2012 05:12
mongrel2 parser
#!/usr/bin/env runhaskell
import qualified Data.Attoparsec as AP
import qualified Data.ByteString as BS
import qualified Data.ByteString.Char8 as C8
sp = 32
co = 58
main = do
contents <- readFile "test.txt"
AP.parseTest p (C8.pack contents)
Metriks::Timer#update registry object_id: 61657080, values: {"http-requests"=>#<Metriks::Timer:0x00000009968260 @meter=#<Metriks::Meter:0x00000009967ce8 @count=#<Atomic:0x00000009967c98 @ref=#<Atomic::InternalReference:0x00000009967c70>>, @start_time=1360792896.9902613, @last_tick=#<Atomic:0x00000009967b80 @ref=#<Atomic::InternalReference:0x00000009967b58>>, @m1_rate=#<Metriks::EWMA:0x00000009967b30 @alpha=0.07995558537067671, @interval=5.0, @initialized=true, @rate=#<Atomic:0x00000009967b08 @ref=#<Atomic::InternalReference:0x00000009967ae0>>, @uncounted=#<Atomic:0x00000009967ab8 @ref=#<Atomic::InternalReference:0x00000009967a90>>>, @m5_rate=#<Metriks::EWMA:0x00000009967a68 @alpha=0.01652854617838251, @interval=5.0, @initialized=true, @rate=#<Atomic:0x00000009967a40 @ref=#<Atomic::InternalReference:0x00000009967a18>>, @uncounted=#<Atomic:0x000000099679f0 @ref=#<Atomic::InternalReference:0x000000099679c8>>>, @m15_rate=#<Metriks::EWMA:0x000000099679a0 @alpha=0.005540151995103271, @interval=5.0, @initialized=tru