CyberMonitor

##############################################################################
#
# Name: hello_world_plugin.py
# Auth: @cmatthewbrooks
# Desc: A test plugin to learn how to make these work; Specifically, how to
#       have multiple actions within the same plugin.
#
#       In plain English, IDA will look for the PLUGIN_ENTRY function which
#       should return a plugin object. This object can contain all the 
#       functionality itself, or it can have multiple actions.

CyberMonitor

filter Expand-DefenderAVSignatureDB {
<#
.SYNOPSIS

Decompresses a Windows Defender AV signature database (.VDM file).

.DESCRIPTION

Expand-DefenderAVSignatureDB extracts a Windows Defender AV signature database (.VDM file). This function was developed by reversing mpengine.dll and with the help of Tavis Ormandy and his LoadLibrary project (https://github.com/taviso/loadlibrary). Note: Currently, "scrambled" databases are not supported although, I have yet to encounter a scrambled database. Thus far, all databases I've encountered are zlib-compressed.

CyberMonitor

Introduction

As the Ghidra open source community is growing, trying to document the new projects around Ghidra. Feel free to fork the gist and propose improvements.

CPU support

• New 6502 language module for Ghidra
• Atmel AVR helpers for Ghidra - ATmega328p
• Processor definitions for DMG and CGB in Ghidra - Gameboy CPU (LR35902) (WiP)
• ghidra based disassembly of the x68000's IPL.

CyberMonitor

<?xml version="1.0" encoding="UTF-8" ?>
<Annotations start="0" num="136" total="136">
  <Annotation about="www.hexacorn.com/blog/*" timestamp="0x00056c66ba2859bd" href="Chd3d3cuaGV4YWNvcm4uY29tL2Jsb2cvKhC9s6HR64zbAg">
    <Label name="_cse_turlh5vi4xc" />
    <AdditionalData attribute="original_url" value="http://www.hexacorn.com/blog/" />
  </Annotation>
  <Annotation about="www.clearskysec.com/blog/*" timestamp="0x00056c66b5b68989" href="Chp3d3cuY2xlYXJza3lzZWMuY29tL2Jsb2cvKhCJk9qt64zbAg">
    <Label name="_cse_turlh5vi4xc" />
    <AdditionalData attribute="original_url" value="https://www.clearskysec.com/blog/" />
  </Annotation>

CyberMonitor

<?xml version="1.0" encoding="UTF-8" ?>
<Annotations start="0" num="136" total="136">
  <Annotation about="www.hexacorn.com/blog/*" timestamp="0x00056c66ba2859bd" href="Chd3d3cuaGV4YWNvcm4uY29tL2Jsb2cvKhC9s6HR64zbAg">
    <Label name="_cse_turlh5vi4xc" />
    <AdditionalData attribute="original_url" value="http://www.hexacorn.com/blog/" />
  </Annotation>
  <Annotation about="www.clearskysec.com/blog/*" timestamp="0x00056c66b5b68989" href="Chp3d3cuY2xlYXJza3lzZWMuY29tL2Jsb2cvKhCJk9qt64zbAg">
    <Label name="_cse_turlh5vi4xc" />
    <AdditionalData attribute="original_url" value="https://www.clearskysec.com/blog/" />
  </Annotation>