Skip to content

Instantly share code, notes, and snippets.

View HoShiMin's full-sized avatar

Александр HoShiMin

488 followers · 0 following
  • OOO "SearchInform"
  • Нижний Новгород, Россия
View GitHub Profile
@HoShiMin
HoShiMin / NtLib.hpp
Created January 5, 2022 23:41
#include <ntstatus.h>
#define NOMINMAX
#define WIN32_NO_STATUS
#define WIN32_LEAN_AND_MEAN
#include <Windows.h>
#include <winternl.h>
#pragma comment(lib, "ntdll.lib")
@HoShiMin
HoShiMin / SyscallStub.asm
Last active November 25, 2021 21:53
Syscalls caller for NativeAPI functions
; You should define the 'AMD64' MASM-preprocessor definition
; at the 'General' MASM properties page in the project properties (for the x64 only).
IFNDEF AMD64
.686P
.XMM
.MODEL FLAT, STDCALL
ENDIF
.CODE
@HoShiMin
HoShiMin / StringsAPI.cpp
Last active February 20, 2024 15:43
#define WIN32_LEAN_AND_MEAN
#define WIN32_NO_STATUS
#include <windows.h>
#undef WIN32_NO_STATUS
#include <string>
#include <sstream>
#include <iomanip>
#include <algorithm>
@HoShiMin
HoShiMin / SymParser.cpp
Created September 24, 2018 21:03
PDB symbols downloader and parser
#include <windows.h>
#include <vector>
#include <string>
#include "SymParser.h"
// Using Wide-versions of DbgHelp functions:
#define DBGHELP_TRANSLATE_TCHAR
// Expose additional declarations from DbgHelp.h:
#define _NO_CVCONST_H
@HoShiMin
HoShiMin / ColoredConsole.h
Last active December 3, 2021 09:43
printf("" $Y "Yellow is %s!" $fill("cool") "");
#pragma once
#include <Windows.h>
void inline pclr(unsigned short attributes) {
static HANDLE hConsole = NULL;
if (!hConsole) hConsole = GetStdHandle(STD_OUTPUT_HANDLE);
SetConsoleTextAttribute(hConsole, attributes);
}
@HoShiMin
HoShiMin / EnjoyTheRing0.pas
Created August 28, 2016 18:35
Обёртка над драйвером EnjoyTheRing0
unit EnjoyTheRing0;
interface
uses
Windows, SysUtils, DriversAPI;
// Загрузка и выгрузка драйвера:
function ETR0GetHandlesCount: Integer; // Количество открытых в данный момент дескрипторов драйвера
function ETR0LoadDriver: Boolean; // Загрузить и запустить драйвер
@HoShiMin
HoShiMin / DbgHelpWrapper.cpp
Created March 7, 2016 20:30
Ещё один простой парсер PDB на DbgHelp с возможностью загрузки отладочных символов
#include "stdafx.h"
#include "DbgHelpWrapper.h"
DbgHelpWrapper::DbgHelpWrapper() {
hProcess = GetCurrentProcess();
}
DbgHelpWrapper::~DbgHelpWrapper() {
DeinitializeDbgHelp();
@HoShiMin
HoShiMin / DIAWrapper.cpp
Last active February 16, 2019 21:07
Удобный парсер PDB-файлов с помощью DIA (входит в Windows Kits)
#include "stdafx.h"
#include "DIAWrapper.h"
// Очистка ресурсов:
VOID DIAWrapper::Cleanup() {
if (pGlobalSymbol) pGlobalSymbol -> Release();
if (pDiaSession) pDiaSession -> Release();
if (pDiaDataSource) pDiaDataSource -> Release();
pGlobalSymbol = NULL;
@HoShiMin
HoShiMin / WinTrust.pas
Created January 26, 2016 21:35
Функция для проверки валидности цифровой подписи бинарника
unit WinTrust;
interface
uses
Windows, System.SysUtils;
// Проверить валидность цифровой подписи:
function IsFileTrusted(const FileName: string): Boolean;
@HoShiMin
HoShiMin / HashMaster.pas
Created December 14, 2015 15:29
Распараллеленная хэшировалка на основе cHash
unit HashMaster;
interface
uses
Windows, Classes, System.SysUtils, System.Threading, cHash, CodepageAPI;
type
THashTask = record
Calculate : Boolean;