Barakat

#include <wdm.h>
#include <ntddkbd.h>

//
// Per-device object extension
//
typedef struct _DEVICE_EXTENSTION
{
  //
  // Driver must not be deleted as long as there is a pending IRP

Barakat

/* Run as admin */
#include <Windows.h>
#include <stdio.h>

int main(void)
{
	const HANDLE SharedSection = OpenFileMappingW(FILE_MAP_READ,
	                                              FALSE,
	                                              L"Global\\ToyDriverSharedSection");

Barakat

//
// sysenter/KiFastCallEntry/IA32_SYSENTER_EIP hooking driver
//
// Barakat Soror (https://twitter.com/barakatsoror)
//

#include <wdm.h>
#include <intrin.h>

#ifndef _X86_

Barakat

#include <wdm.h>

#ifndef _X86_
#error "Only x86 is supported"
#endif

//
// If you disassemble any service, you will see that it moves the service index to EAX in the first
// instruction. The index is right after the first byte of the MOV opcode. This behavior looks stable
// and is used by Sysinternals Procmon.

Barakat

#include "pch.h"

#include <xmmintrin.h>
#include <immintrin.h>
#include <random>
#include <chrono>
#include <chrono>
#include <functional>
#include <cstdio>

Barakat

#include <Windows.h>
#include <cassert>
#include <cstring>
#include <cstdio>
#include <cinttypes>
#include <random>

int main()
{
    static const unsigned char hunter_shellcode[] = {

Barakat

#!python3
# -*- coding: utf-8 -*-
# pip install unicorn
import unicorn
import unicorn.x86_const
import struct


def required_mapping_size(size):
    page_size = 4096

Barakat

#include <Windows.h>
#include <iphlpapi.h>
#include <cstdio>

#pragma comment(lib, "iphlpapi.lib")

static void Ip4ToString(DWORD ip4, char ip4_string[16])
{
  if (ip4 == 0)
  {

Barakat

#!python
# -*- coding: utf-8 -*-
import struct
import socket
import logging
import sys

logging.basicConfig(stream=sys.stdout, level=logging.DEBUG)

Barakat

#ifndef MBEDTLS_CONFIG_H
#define MBEDTLS_CONFIG_H

#define MBEDTLS_PLATFORM_C
#define MBEDTLS_GCM_C
#define MBEDTLS_PKCS1_V15
#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
#define MBEDTLS_SSL_PROTO_TLS1_2
#define MBEDTLS_AES_C
#define MBEDTLS_ASN1_PARSE_C