yarienkiva’s gists

yarienkiva / ctfd_submission_monitor.py

Last active November 29, 2025 15:43

Because I like being able to see all the flags being submitted :)

	import os
	import time
	import requests

	API_URL = os.environ.get("API_URL", "https://ctf.heroctf.fr/api/v1").rstrip("/")
	CTFD_TOKEN = os.environ.get(
	"CTFD_TOKEN",
	"ctfd_TOKEN_GOES_HERE",
	)

yarienkiva / vbox_unattended_install_support.txt

Last active November 21, 2025 23:25

VirtualBox's documentation is so piss poor that it doesn't include the list of supported OS' that it supports Unattended Install for. This list was compiled from the VirtualBox source code downloaded from GitHub. Hopefully someone else finds this useful. #VirtualBox List of Supported Linux OS

	# grep -r 'class Unattended'
	...
	src/VBox/Main/include/UnattendedInstaller.h:class UnattendedWindowsSifInstaller : public UnattendedInstaller
	src/VBox/Main/include/UnattendedInstaller.h:class UnattendedWindowsXmlInstaller : public UnattendedInstaller
	src/VBox/Main/include/UnattendedInstaller.h:class UnattendedOs2Installer : public UnattendedInstaller
	src/VBox/Main/include/UnattendedInstaller.h:class UnattendedLinuxInstaller : public UnattendedInstaller
	src/VBox/Main/include/UnattendedInstaller.h:class UnattendedDebianInstaller : public UnattendedLinuxInstaller
	src/VBox/Main/include/UnattendedInstaller.h:class UnattendedUbuntuPreseedInstaller : public UnattendedDebianInstaller
	src/VBox/Main/include/UnattendedInstaller.h:class UnattendedUbuntuAutoInstallInstaller : public UnattendedDebianInstaller
	src/VBox/Main/include/UnattendedInstaller.h:class UnattendedRhelInstaller : public UnattendedLinuxInstaller

yarienkiva / idapython_rename_JNI_first_arg.py

Created July 12, 2025 01:52

	import idaapi
	import idautils
	import ida_hexrays

	jnienv_tinfo = idaapi.tinfo_t()
	idaapi.parse_decl(jnienv_tinfo, idaapi.cvar.idati, "JNIEnv *env;", 0)

	for func_ea in idautils.Functions():
	name = idaapi.get_name(func_ea)
	if not name.startswith("Java_"):

yarienkiva / ida_rename_locals_to_func_params.py

Created February 16, 2025 10:07

IDAPython script that renames all local vars that hold the return value of a specific function (websGetVar). The new name is based on the second parameter passed to websGetVar.

	import idaapi
	import idautils
	import time
	import re

	__author__ = "yarienkiva" # though the script is based on mrspicky by pat0s


	LOGGING_FUNC = {
	# func_name : interesting arg num

yarienkiva / sm4_unguard.py

Last active February 16, 2025 10:20

Got nerd-sniped, here's code to "unguard" (invert) the key schedule algorithm of SM4

	#!/usr/bin/env python
	# encoding: utf-8

	from z3 import *
	import struct
	import os

	# fmt: off
	S = (
	0xd6, 0x90, 0xe9, 0xfe, 0xcc, 0xe1, 0x3d, 0xb7, 0x16, 0xb6, 0x14, 0xc2, 0x28, 0xfb, 0x2c, 0x05,

yarienkiva / pot2miel.py

Created August 1, 2024 19:56

Dump all tcp sessions going through the docker interface to seperate files.

	# this was coded months ago and I have no idea if it worked / still works
	from scapy.all import AsyncSniffer, wrpcap, TCPSession, IP, TCP
	from scapy.config import Conf
	import threading
	import logging
	import queue
	import time
	import sys

	logging.basicConfig(format="%(levelname)s:%(message)s", level=logging.INFO)

yarienkiva / music_express_unpacker.py

Last active May 16, 2024 14:02

	import base64
	import sys
	import os
	import io

	from PIL import Image
	from pythonnet import load

	load("coreclr")

yarienkiva / rizzler.py

Created February 26, 2024 17:31

Extract telegram chad_id and bot_token from web requests using MitM (with Fiddler). Future version will probably use Drakvuf instead of VBox.

	from tqdm import tqdm
	import subprocess
	import logging
	import email
	import time

	logging.basicConfig(level=logging.INFO)

	VM_USERNAME = "..."
	VM_PASSWORD = "..."

yarienkiva / find_array_rc4_state_from_memdump.py

Created February 14, 2024 13:41

Recover the plaintext by extracting the internal state (a C array) of a RC4 algorithm in a memory dump of the stack.

	import subprocess
	import sys
	import re

	CIPHERTEXT = ...


	class RC4:
	def __init__(self, key: bytes) -> None:
	self.S = list(range(256))

yarienkiva / find_array_rc4_state_from_mem.py

Created February 14, 2024 13:23

Recover the plaintext by extracting the internal state (a Python list) of a RC4 algorithm in memory.

	import subprocess
	import re

	PID = int(subprocess.check_output(["pgrep", "-f", ... ]))
	CIPHERTEXT = ...

	LIST_INIT_DOC = b"list(iterable=(), /)\n--\n\nBuilt-in mutable sequence.\n\nIf no argument is given, the constructor creates a new empty list.\nThe argument must be an iterable if specified."


	class RC4:

Alol yarienkiva