Skip to content

Instantly share code, notes, and snippets.

class Shrimp:
def __init__(self, name, pH, kH, gH):
self.name = name
self.kH = kH
self.pH = pH
self.gH = gH
def canSurvive(self, pH,kH,gH):
print("="*10)
print(self.name)
@Areizen
Areizen / download.py
Created June 30, 2022 18:47
Dirty download app from playstore
from re import sub
import subprocess
import sys
import re
from bs4 import BeautifulSoup
import time
def dump_layout():
path_out = subprocess.check_output(["adb", "shell", "uiautomator", "dump"])
path_out = path_out.split(b': ')[1]
@Areizen
Areizen / uninstall.py
Last active July 23, 2020 18:40
Uninstall Device administrator applications
#!/usr/bin/python3
import frida
import subprocess
import sys
if len(sys.argv) !=2:
print(f"[-] Usage : python3 {sys.argv[0]} <package_to_uninstall>")
sys.exit(-1)
def message(message, data):
@Areizen
Areizen / bypass_throttle.js
Created June 11, 2020 09:56
Bypass android throttle when pincode is wrong
/*
Run this script :
$> frida -U -l bypass-throttle.js gatekeeperd
Explainations :
Bypass android throttle when pincode is wrong
Frida enumeration :
import argparse
import json
predefined_struct = {
"UnityEngine_Vector3_o" : [("float","x"),("float","y"),("float","z")]
}
def extract_class_methods(methods_informations, clazz):
"""
We check if the signature start with the class we want to hook, if so
var library_name = "libil2cpp.so";
var library_loaded = 0;
var base_address = 0;
// frida -U -l script.js -f com.youmusic.magictiles --no-pause
var parse_tile_base_o = function(tile_base_o) {
return {
tileSizeX : tile_base_o.add(0x6c).readFloat(),
@Areizen
Areizen / mupdf_encrypted_exfiltration.py
Created April 30, 2020 17:48
POC of pdf-insecurity.com
from binascii import hexlify
import sys
import re
# PDF TEMPLATE, index number should be shifted enough to avoid collision with number of the object
# we want to exfiltrate
PDF_TEMPLATE = """%PDF-2.0
100 0 obj
import sys
import zlib
import json
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad
magic_number = b"ACBJA\x01\x00"
def uncipherAES(data : bytes):
const simulated_latitude = 48.8534
const simulated_longitude = 2.3488
Java.perform(function(){
const Location = Java.use('android.location.Location')
var location = Location.$new("gps")
location.setLatitude(simulated_latitude)
location.setLongitude(simulated_longitude)
@Areizen
Areizen / smudge_attack_adb.py
Last active June 11, 2020 14:02
Smudge attack
#!/usr/bin/python2.7
# coding: utf8
import subprocess
import time
import itertools as it
import commands
import sys
base_command = "adb shell "