Skip to content

Instantly share code, notes, and snippets.

View HACKE-RC's full-sized avatar
🌐
Bending the consensus.

Mr. Rc HACKE-RC

🌐
Bending the consensus.
View GitHub Profile

PML4

pwndbg> p/x (*PML4).entries
$5 = {{
    value = 0x100001007
  }, {
    value = 0x0
  } <repeats 255 times>, {
    value = 0x100002007
  }, {

Satisfiability Modulo Theories (SMT) solvers are one of the most interesting topics to learn about in Computer Science. When you first discover them, they feel surprising and magical. You might already have heard of or seen someone use a SMT solver like Z3 for solving CTF challenges or Program Analysis and by the end of this video, you'll have a good grasp of all the required knowledge to get started and use Z3.

I will not use any complicated mathematics to explain these solvers and will deal with only required theory and examples.

SAT Solvers

SMT solvers leverage the powers of another type of solvers called Boolean Satisfiability Problem solvers. As the name suggests, they have something to do with Boolean variables.

These solvers basically take a Boolean expressions and output whether there are possible values for the Boolean variables which result in the expression being true (or satisfiable). When there are no such variables SAT solver outputs unsatisifable.

If the expression is satisfiable t

from z3 import *
square = Int("square")
circle = Int("circle")
triangle = Int("triangle")
solver = Solver()
solver.add(square * square + circle == 16)
solver.add(triangle * triangle * triangle == 27)
solver.add(triangle * square == 6)
@HACKE-RC
HACKE-RC / calling_conventions.md
Created June 9, 2023 15:26
Notes on calling convention

Common calling conventions

  • cdecl
  • fastcall
  • stdcall

CDECL calling convention.

cdecl stands for "C declaration", it is used by most c compiler in the x86 architecture.

Arguments passing in cdecl calling convention

@HACKE-RC
HACKE-RC / change_environment_variables.c
Created April 11, 2023 08:45
Implementation of a function that can change Environment Variable in Windows (actually) by modifying Registry Keys.
#inlclude <windows.h>
#include <stdio.h>
// function to set a environment variable globally by editing the registry keys.
NTSTATUS SetEnvironmentVariableR(LPCSTR lpName, LPCSTR lpValue){
HKEY hKey; // this will hold the handle to the registry key.
// We are going to open the registry key for HKEY_CURRENT_USER\Environment.
RegCreateKey(HKEY_CURRENT_USER, "Environment", &hKey);
// Error check.
@HACKE-RC
HACKE-RC / app.cs
Last active October 17, 2022 12:03
C# code of the .NET assembly used in loader.nim
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace CLRHello1
{
class Program
{
@HACKE-RC
HACKE-RC / loader.nim
Created October 17, 2022 11:56
Nim loader that can load a .NET assembly from memory.
import winim/clr
# buffer contains the dll
var buf: array[3584, byte] = [
byte 0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
0xFF, 0xFF, 0x00, 0x00, 0xB8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x80, 0x00, 0x00, 0x00, 0x0E, 0x1F, 0xBA, 0x0E, 0x00, 0xB4, 0x09, 0xCD,
@HACKE-RC
HACKE-RC / KTHREAD.c
Created May 31, 2022 15:21
The Windows KTHREAD structure.
struct _KTHREAD {
struct _DISPATCHER_HEADER Header;
void *SListFaultAddress;
unsigned int QuantumTarget;
void *InitialStack;
void *StackLimit;
void *StackBase;
unsigned int ThreadLock;
unsigned int CycleTime;
unsigned long CurrentRunTime;
@HACKE-RC
HACKE-RC / ETHREAD.c
Created May 31, 2022 15:04
The Windows ETHREAD structure.
struct _ETHREAD {
struct _KTHREAD Tcb;
union _LARGE_INTEGER CreateTime;
union _LARGE_INTEGER ExitTime;
struct _LIST_ENTRY KeyedWaitChain;
void *ChargeOnlySession;
struct _LIST_ENTRY PostBlockList;
void *ForwardLinkShadow;
void *StartAddress;
struct _TERMINATION_PORT *TerminationPort;
@HACKE-RC
HACKE-RC / TEB.c
Last active October 7, 2023 10:54
The Windows TEB data structure.
struct _TEB {
struct _NT_TIB NtTib;
void *EnvironmentPointer;
struct _CLIENT_ID ClientId;
void *ActiveRpcHandle;
void *ThreadLocalStoragePointer;
struct _PEB *ProcessEnvironmentBlock;
unsigned long LastErrorValue;
unsigned long CountOfOwnedCriticalSections;
void *CsrClientThread;