Skip to content

Instantly share code, notes, and snippets.

View EricZimmerman's full-sized avatar
🤡

Eric EricZimmerman

🤡
View GitHub Profile

Keybase proof

I hereby claim:

  • I am EricZimmerman on github.
  • I am ericrzimmerman (https://keybase.io/ericrzimmerman) on keybase.
  • I have a public key whose fingerprint is 7DFF 42EC C7FB 7656 1244 E0EB BAC3 30D2 D44A 8B05

To claim this, I am signing this object:

@EricZimmerman
EricZimmerman / ThumbCache
Last active January 25, 2024 19:27
ThumbCache*.db parser
using System;
using System.Collections.Generic;
using System.Data;
using System.Diagnostics;
using System.Linq;
using System.Text;
using System.Drawing;
using System.IO;
using System.Threading.Tasks;
@EricZimmerman
EricZimmerman / stub.cs
Created July 22, 2015 12:43
Check for .net 4.6 or greater
private static bool CheckForDotnet46()
{
using (RegistryKey ndpKey = RegistryKey.OpenBaseKey(RegistryHive.LocalMachine, RegistryView.Registry32).OpenSubKey("SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full\\"))
{
int releaseKey = Convert.ToInt32(ndpKey.GetValue("Release"));
return (releaseKey >= 393295);
}
}
@EricZimmerman
EricZimmerman / w10pfdecomp.py
Last active July 4, 2023 09:48 — forked from dfirfpi/w10pfdecomp.py
Windows 10 Prefetch (native) Decompress
#!/usr/bin/python
# -*- coding: utf-8 -*-
#
# Copyright 2015, Francesco "dfirfpi" Picasso <francesco.picasso@gmail.com>
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
@EricZimmerman
EricZimmerman / Win10PrefechDecompress.cs
Last active June 14, 2016 11:13
pinvoke for RtlDecompressBufferEx in c#
using System.Runtime.InteropServices;
namespace Prefetch.XpressStream
{
public class Xpress2
{
// const ushort COMPRESSION_FORMAT_LZNT1 = 2;
// const ushort COMPRESSION_FORMAT_XPRESS = 3;
const ushort CompressionFormatXpressHuff = 4;
copy this to clipboard
PS1="\[\033[32m\][\w]\[\033[0m\]\n\[\033[1;36m\]\u\[\033[1;33m\]-> \[\033[0m\]"
in bash shell, type (note the space at the end)
export
and then copy the string from above after it, like this:
Set-PSReadlineKeyHandler -Key Tab -Function Complete
@EricZimmerman
EricZimmerman / Base64_PS.txt
Last active February 14, 2018 23:09
Base64 PS
cGFyYW0gKCRDb21wdXRlck5hbWUgPSAiLiIsICRGaWxlUGF0aCA9lCIuXEFwcGxpY2F0aW9uc0ludmVudG9yeS5jc3YiKQ0KDQpnZXQtd21pb2JqZWN0lC1xdWVyeSAiU0VMRUNUlCogRlJPTSBXaW4zMl9Qcm9kdWN0liAtY29tcHV0ZXJuYW1lICRDb21wdXRlck5hbWUgfCANCnNvcnQtb2JqZWN0lFZlbmRvciB8lA0Kc2VsZWN0LW9iamVjdCBQU0NvbXB1dGVyTmFtZSxWZW5kb3IsTmFtZSxWZXJzaW9uLENhcHRpb24sRGVzY3JpcHRpb24sSW5zdGFsbERhdGUsSW5zdGFsbExvY2F0aW9uLEluc3RhbGxTb3VyY2UsUGFja2FnZU5hbWUgfA0KZXhwb3J0LWNzdiAtcGF0aCAkRmlsZVBhdGggLWFwcGVuZCA=
@EricZimmerman
EricZimmerman / gitps.txt
Created August 4, 2019 20:54
Update all git repos under a dir in powershell
Get-ChildItem -Directory | foreach { Write-Host "`n■ Getting latest for $_ ↓" | git -C $_.FullName pull -v}
oh-my-posh init pwsh --config "$env:POSH_THEMES_PATH\powerlevel10k_rainbow.omp.json" | Invoke-Expression
Import-Module -Name Terminal-Icons
Set-PSReadLineOption -PredictionViewStyle ListView
Set-PSReadLineOption -PredictionSource history