Borja Merino BorjaMerino

## AA.cpp
/*

This was the first version - the newer version also includes *When* it was loaded also.

https://gist.github.com/olliencc/e166a64ca211c51eb69111f26ce57bc1

*/

## gist:d1534a3b563df9f1d5188c435b98f212
# @BorjaMerino (Alpine Security)
import lznt1, argparse, os, struct

TAG = b'\xC6\xA5\x79\xEA'
CHUNK_ID = b'\x49\x44\x41\x54'
DWORD = 4

def get_header(png):

    with open(png, "rb") as file:

## LowUtilities.cpp
//
// An implementation of GetModuleHandle and GetProcAddress that works with manually mapped modules, forwarded exports,
// without a CRT standard library, and uses no Windows API or dependencies.
//
// Author: Bill Demirkapi
// License: MIT, appended at the bottom of this document if you care about licensing and want to credit me in your own project.
//

#include <Windows.h>
#include <winternl.h>

## gist:a43cc46071151c25bd83
### Keybase proof

I hereby claim:

  * I am BorjaMerino on github.
  * I am borjamerino (https://keybase.io/borjamerino) on keybase.
  * I have a public key whose fingerprint is 5A29 5A19 7679 EA52 7236  87FE A619 EC45 526A E877

To claim this, I am signing this object:
	/*

	This was the first version - the newer version also includes When it was loaded also.

	https://gist.github.com/olliencc/e166a64ca211c51eb69111f26ce57bc1

	*/
	# @BorjaMerino (Alpine Security)
	import lznt1, argparse, os, struct

	TAG = b'\xC6\xA5\x79\xEA'
	CHUNK_ID = b'\x49\x44\x41\x54'
	DWORD = 4

	def get_header(png):

	with open(png, "rb") as file:
	//
	// An implementation of GetModuleHandle and GetProcAddress that works with manually mapped modules, forwarded exports,
	// without a CRT standard library, and uses no Windows API or dependencies.
	//
	// Author: Bill Demirkapi
	// License: MIT, appended at the bottom of this document if you care about licensing and want to credit me in your own project.
	//

	#include <Windows.h>
	#include <winternl.h>
	### Keybase proof

	I hereby claim:

	* I am BorjaMerino on github.
	* I am borjamerino (https://keybase.io/borjamerino) on keybase.
	* I have a public key whose fingerprint is 5A29 5A19 7679 EA52 7236 87FE A619 EC45 526A E877

	To claim this, I am signing this object: