Skip to content

Instantly share code, notes, and snippets.

View 00xc's full-sized avatar

Carlos López 00xc

View GitHub Profile
@00xc
00xc / _mm512_tzcnt_si512.rs
Last active July 6, 2023 19:43
Finding the lowest set bit in a 512-bit array using SIMD
#![feature(portable_simd)]
#![feature(stdsimd)]
use core::arch::x86_64::*;
unsafe fn _mm512_tzcnt_si512(v: __m512i) -> Option<usize> {
let zeros = _mm512_setzero_si512();
let mask = _mm512_cmpneq_epi64_mask(v, zeros);
// 63 - lzcnt((v - 1) ^ v);
let unweighted = _mm512_sub_epi64(
@00xc
00xc / cloudinspect.c
Created November 1, 2021 23:24
Hack.lu CTF 2021 - Cloudinspect vulnerable emulated PCI device
/*
* QEMU cloudinspect intentionally vulnerable PCI device
*
*/
#include "qemu/osdep.h"
#include "qemu/units.h"
#include "hw/pci/pci.h"
#include "hw/hw.h"
#include "hw/pci/msi.h"
@00xc
00xc / exploit.c
Last active December 2, 2022 09:16
Hack.lu CTF 2021 - Cloudinspect exploit
/*
* Compile with: cc solve.c -Wall -Wextra -Wpedantic -O0 -static -ffreestanding -o solve
* Run locally with: { stat -c "%s" solve; sleep 1; cat solve; } | ./run_chall.sh
* Run remotely with: { stat -c "%s" solve; sleep 1; cat solve; } | nc flu.xxx 20065
*/
#include <assert.h>
#include <err.h>
#include <fcntl.h>
#include <stdio.h>
@00xc
00xc / extract_winkey.py
Created June 14, 2021 10:25
Script to extract a Windows Product Key
#!/usr/bin/env python3
import winreg, os
def decode_str(digital_product_id):
start = 52
end = start + 15
hexpid = digital_product_id[start:end+1]
@00xc
00xc / binwalk-extract.py
Last active September 8, 2021 16:02
Extracting every embedded file with binwalk
#!/usr/bin/env python3
import sys
import os
import binwalk
import shlex
import subprocess as sp
def dump_file(file, offset, size, outfile):
cmd = "dd if={} of={} bs=1 skip={}".format(file, outfile, offset, size)
if size is not None:
@00xc
00xc / uaf.c
Last active December 2, 2022 09:15
Proof of concept for a use-after-free bug in libbus.
/*
* uaf.c
* This program serves as a proof of concept for a dangling pointer bug in libbus.
* It displays a message if a client context gets corrupted due to it being freed.
* Compile with: gcc uaf.c libbus.a -O3 -Wall -Wextra -o uaf -I<path_to_libbus>/src/ -latomic -pthread
* https://github.com/00xc/libbus
* https://scavengersecurity.com/posts/libbus/
* https://scavengersecurity.com/posts/libbus-uaf/
*/