Cr4sh

#include "stdafx.h"

#define DB(_val_) __asm __emit (_val_)

#define INVALID_SYSCALL (DWORD)(-1)

// code selectors
#define CS_32   0x23
#define CS_64   0x33

Cr4sh

void **find_sys_call_table(void *kernel_addr, int kernel_size)
{
    /*
        Check for the system_call_fastpath() signature, hand-written piece of
        assembly code from arch/x86/kernel/entry_64.S:

            ja      badsys
            mov     rcx, r10
            call    sys_call_table[rax * 8]
            mov     [rsp + 20h], rax

Cr4sh

$$ enum active proceses
r $t0 = nt!PsActiveProcessHead

.for (r $t1 = poi(@$t0);
      (@$t1 != 0) & (@$t1 != @$t0);
      r $t1 = poi(@$t1))
{
    r? $t2 = #CONTAINING_RECORD(@$t1, nt!_EPROCESS, 
        ActiveProcessLinks)

Cr4sh

### Keybase proof

I hereby claim:

  * I am Cr4sh on github.
  * I am d_olex (https://keybase.io/d_olex) on keybase.
  * I have a public key whose fingerprint is 9DEA 2C4E E86D ACDB 4313  F192 7572 EE56 6093 29C3

To claim this, I am signing this object:

Cr4sh

'''

Extract SW SMI handlers information from
Intel DQ77KB board SMRAM dump.

Example:

$ python smi_handlers.py TSEG.bin
0xcc: 0xd70259d8
0xb8: 0xd706673c

Cr4sh

#!/usr/bin/env python

import sys, os
from subprocess import Popen, PIPE
from struct import pack, unpack
from portio import *

def hexdump(data, width = 16, addr = 0):

    ret = ''

Cr4sh

/*
    JTAGenum

    Given a Arduino compatible microcontroller JTAGenum scans
    pins[] for basic JTAG functionality. After programming 
    your microcontroller open a serial terminal with 115200 
    baud and send 'h' to see usage information. 

    SETUP:
    Define the pins[] and pinnames[] map of pin names to pins 

Cr4sh

/*
 * fork.c
 * Experimental fork() on Windows.  Requires NT 6 subsystem or
 * newer.
 *
 * Copyright (c) 2012 William Pitcock <nenolod@dereferenced.org>
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.

Cr4sh

void TestCopy()
{
    BOOL                cond = FALSE;
    IFileOperation     *FileOperation1 = NULL;
    IShellItem         *isrc = NULL, *idst = NULL;
    BIND_OPTS3          bop;
    SHELLEXECUTEINFOW   shexec;
    HRESULT             r;

    do {

Cr4sh

/** 
 * Declaration
 */

/*
    'tfp_format' really is the central function for all tinyprintf. For each output character 
    after formatting, the 'putf' callback is called with 2 args:

    - an arbitrary void* 'putp' param defined by the user and passed unmodified from 'tfp_format';
    - the character;