Skip to content

Instantly share code, notes, and snippets.

@EvanMcBroom
EvanMcBroom / pic-and-string-literals-2.md
Last active Oct 6, 2021
Pic and String Literals Part 2
View pic-and-string-literals-2.md

PIC and String Literals Part 2

I previously wrote about how to use macro metaprogramming to simplify using string literals in position independent code (PIC). The results are summarized in the below code snippet and the article can be read on GitHub.

void f() {
    // Example 1: The Pic idiom for instantiating a string
    char picString1[]{ 'a', 'b', 'c' };
@EvanMcBroom
EvanMcBroom / arnold.md
Last active May 4, 2021
IllBeBack - An Undocumented Function
View arnold.md

IllBeBack - An Undocumented Function

Microsoft purchased the software Softricity SoftGrid in 2006 and renamed it to Microsoft Application Virtualization, or App-V for short. Windows shipped with several libraries in System32 and SysWOW64 to support App-V.

AppVTerminator.dll

One App-V library stands out from all the rest because it only has one exported function named IllBeBack... That's right! A library signed by Microsoft, with Terminator in the name, that only has a single callable function named IllBeBack.

@EvanMcBroom
EvanMcBroom / pic-and-string-literals.md
Last active Aug 27, 2021
Position Independent Code and String Literals
View pic-and-string-literals.md

Position Independent Code and String Literals

A common programming idiom when writing position independent code (PIC) is to expand a string literal into its individual characters when instantiating a local variable.

void f() {
    // Example 1: A normal instantiation with a string literal
    char a[]{ "a long string" };

 // Example 2: The Pic idiom for instantiating a string
@EvanMcBroom
EvanMcBroom / switch-statements-with-full-strings.md
Last active Dec 27, 2020
Switch Statements with Full Strings
View switch-statements-with-full-strings.md

Switch Statements with Full Strings

C++11 introduced the constexpr keyword for defining a constant expression. A constant expression is a variable or function that may be evaluated at compile time. This has many uses, including extending a switch statement to support full strings.

Constant Expression Hash Functions

C++ only supports using an integer as the condition in a switch statement and an integer that is known at compile time in a case statement. You can define a hash function and use it to convert a string to an integer to use in a switch statement. If you define that hash function as a constexpr you can use it to convert a string literal to an integer to use in a case statement as well.

@EvanMcBroom
EvanMcBroom / fireeye-tools.md
Last active Sep 29, 2021
FireEye Red Team Tools - Notes
View fireeye-tools.md

FireEye Red Team Tools - Notes

These are my notes on FireEye's yara rules for it's red team's tools.

These are the public projects that I could identify to be directly associated with a tool:

Project Source
AndrewSpecial https://github.com/hoangprod/AndrewSpecial
BloodHound https://github.com/BloodHoundAD/BloodHound