Skip to content

Instantly share code, notes, and snippets.


codecolorist ChiChou

View GitHub Profile
ChiChou /
Last active Aug 4, 2020
iproxy based on frida
import asyncio
import concurrent.futures
import frida
pool = concurrent.futures.ThreadPoolExecutor(max_workers=4)
def make_handler(dev: frida.core.Device, port:int, buffer_size=4096):
async def handler(reader, writer):
import idc
import idautils
import idaapi
import ida_funcs
import ida_name
import ida_bytes
import ida_nalt
import ida_hexrays as hr
import os
# preinstalled python is python2
filename = '/'.join(map(os.environ.get, ('TARGET_TEMP_DIR', 'FULL_PRODUCT_NAME'))) + '.xcent'
evil = '''
ChiChou /
Last active May 26, 2020
Recursively scan all executables in a folder and generate IDA databases in parallel

Recursively scan all executables (PE, ELF and MachO!) in a folder and generate IDA databases in parallel


node batch.js [path]

import frida
import struct
import plistlib
class Channel(object):
def __init__(self, name=''): = name = frida.get_usb_device()
self.pipe ='lockdown:%s' % name)
ChiChou / pwn2own.json
Created Dec 16, 2019
Pwn2Own bugs from ZDI offcial site
View pwn2own.json
"idYear": "11",
"idBase": 249,
"zdiId": "ZDI-11-249",
"zdiCan": "ZDI-CAN-1159",
"affectedVendors": "Microsoft",
"cve": "CVE-2011-1347",
"publishDate": "2011-08-09",
"lastUpdate": "",
ChiChou / test.js
Last active May 17, 2019 trace child process without enable_spawn_gating()
View test.js
const fs = require('fs')
const { promisify } = require('util')
const frida = require('frida')
async function main() {
const read = promisify(fs.readFile)
const source = await read('trace.js')
const opt = { runtime: 'v8' }
View cfprefs.m
#import <Foundation/Foundation.h>
#include <sandbox.h>
int sandbox_init_with_parameters(const char* profile,
uint64_t flags,
const char* const parameters[],
char** errorbuf);
#define SANDBOX_PROFILE "/System/Library/Frameworks/WebKit.framework/Versions/A/Resources/"
ChiChou / sort-ver.js
Created Feb 25, 2019 sort by version
View sort-ver.js
(() => {
const trs = document.querySelector('table').querySelectorAll('tr')
const rows = [], 3, trs.length - 1)
const footer = trs[trs.length - 1]
const sorted = rows.sort((a, b) => {
const parse = tr => tr.querySelector('td:nth-of-type(2) a').textContent
.map(s => parseInt(s, 10))
View int64.babel.js
import { Struct } from "./utils";
function operator(target, name, descriptor) {
const oldValue = descriptor.value;
descriptor.value = function() {
if (arguments.length != oldValue.length)
throw Error("Not enough arguments for function " + name);
for (let arg of arguments)
if (!(arg instanceof Int64))