Skip to content

Instantly share code, notes, and snippets.

package main
import (
"swig/plugin"
"swig/ida_kernwin"
)
func InitPlugin() int {
ida_kernwin.Msg("console!")
return plugin.PLUGIN_KEEP
@Jinmo
Jinmo / yey.py
Last active May 17, 2019 01:20
loading IDA colors (clr) file given a path to the file
from ctypes import c_ssize_t, c_void_p, c_int, c_void_p, create_string_buffer, cast, WINFUNCTYPE, CFUNCTYPE, windll, cdll, CDLL
from PyQt5.QtCore import Qt, QTimer, QObject
from PyQt5.QtGui import QResizeEvent, QFocusEvent
from PyQt5.QtWidgets import QWidget, QDialog, QDialogButtonBox, QPushButton, qApp
import os
import sys
import idaapi
import idc
@Jinmo
Jinmo / unload.py
Created May 5, 2019 14:10
Force unloading IDA plugin (or not)
from pkg.internal_api import _ida_lib
import ctypes
functype, lib = _ida_lib()
class qstring(ctypes.Structure):
_fields_ = [
('array', ctypes.c_void_p),
@Jinmo
Jinmo / poc.py
Last active April 16, 2019 12:26
child process console realtime output in IDAPython
import subprocess
import Queue
import threading
import time
import sys
def Popen(*args, **kwargs):
q = Queue.Queue()
done = []
@Jinmo
Jinmo / virtualenv_installer.py
Last active April 4, 2019 13:24
virtualenv installer using builtin modules (python 2.7), also installs pip and wheel
from hashlib import sha256
import os
import sys
import logging
import urllib2
import tempfile
# extracted from https://pypi.org/simple/virtualenv/
VIRTUALENV_URL = 'https://files.pythonhosted.org/packages/33/5d/' \
@Jinmo
Jinmo / tcache-memcpy.c
Created February 15, 2019 15:27
A hard way to do memcpy
// The whole code below does container[2] = buf[0]
#include <stdio.h>
#include <stdlib.h>
#define SIZE 0x100
__attribute__((aligned(0x10)))
long container[] = {0, 0x100 + 0x11, 0};
@Jinmo
Jinmo / bom.py
Last active March 29, 2019 16:54
UTF-8 BOM adder
import os
rootdir = 'EDIT_HERE'
for root, subdirs, files in os.walk(rootdir):
for file in files:
if file.endswith('.c') or file.endswith('.h'):
f = open(root + '/' + file, 'rb')
if f.read(3) != '\xEF\xBB\xBF':
try:
@Jinmo
Jinmo / exp.py
Created January 27, 2019 18:07
codegate 2019 qual: kingmaker execve
from pwn import *
HOST, PORT = "110.10.147.104", 13152
# HOST, PORT = "0.0.0.0", 31338
r = remote(HOST, PORT)
ii = lambda x: r.sendline(str(x))
go = lambda x: (menu(), ii(x))[0]
ii("""1 lOv3 1 2
@Jinmo
Jinmo / _source.c
Last active October 10, 2018 20:24
32/64bit return-to-dl-resolve, when libc is known. couldn't find original article, so rewrote it from memory.. will add link if found.
// gcc % -fno-stack-protector
#include <unistd.h>
int main() {
char buf[16];
read(0, buf, 0x10000);
return 0;
}