Skip to content

Instantly share code, notes, and snippets.

View Midi12's full-sized avatar
🏴‍☠️

Midi12

🏴‍☠️
View GitHub Profile
@Midi12
Midi12 / VMTHook.cpp
Last active October 29, 2018 10:09
Quick x64 virtual function hook class
#include "VMTHook.h"
namespace Detour {
/*
* Constructor
*/
VMTHook::VMTHook(std::uintptr_t** vtable, const std::uint16_t index, std::uintptr_t hook)
: _vtable(vtable), _index(index), _ptr(hook), _orig(0) {
assert(vtable != nullptr);
@Midi12
Midi12 / ossec-aws-waf.sh
Last active February 27, 2020 16:25
OSSEC Active response to add an IP to an AWS WAF IPSet
#!/bin/sh
# Adds an IP to an existing IPSet in AWS Web Application Firewall
# Requirements: Linux with aws cli installed and configured (aws cli needs python)
# Expect: srcip
# Author: Midi12
# Last modified: Feb 25, 2020
# Change this values
IPSETID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" # target ip set identifier
REGION="xx-xxxx-x" # target waf region
@Midi12
Midi12 / sse_pxor_string_encryption_decrypt_poc.py
Created March 19, 2020 09:47
sse pxor string encryption decrypt poc
'''
.text:0000000140007D8C 48 BE 2B 13 85 14 AE A7 C2 BB mov rsi, 0BBC2A7AE1485132Bh <- xmm2_op part 2
.text:0000000140007D96 48 89 74 24 50 mov qword ptr [rsp+170h+var_120], rsi
.text:0000000140007D9B 48 BF F0 F8 D3 3D 23 E3 F1 96 mov rdi, 96F1E3233DD3F8F0h <- xmm2_op part 1
.text:0000000140007DA5 48 89 7C 24 58 mov qword ptr [rsp+170h+var_120+8], rdi
.text:0000000140007DAA 48 B8 5E 60 E0 66 9D 95 EC DF mov rax, 0DFEC959D66E0605Eh <- xmm1_op part 2
.text:0000000140007DB4 48 89 44 24 40 mov qword ptr [rsp+170h+var_130], rax
.text:0000000140007DB9 48 BB 9C 94 D3 3D 23 E3 F1 96 mov rbx, 96F1E3233DD3949Ch <- xmm1_op part 1
.text:0000000140007DC3 48 89 5C 24 48 mov qword ptr [rsp+170h+var_130+8], rbx
.text:0000000140007DC8 66 0F 6F 44 24 40
@Midi12
Midi12 / superfetch_physical_memory_ranges_v2.hpp
Created May 27, 2020 14:57
NtQuerySystemInformation SystemSuperfetchInformation Version 2 (since windows 10.0.18362.1 at least)
// see more @ https://www.unknowncheats.me/forum/general-programming-and-reversing/397104-ntquerysysteminformation-systemsuperfetchinformation.html
#pragma once
#include <cstdint>
#include <vector>
#include "lazy_loader_light.hpp"
#include "ntstatus.hpp"
@Midi12
Midi12 / vector_metaprogramming_sample.cpp
Last active October 29, 2020 15:47
Geometry vector class example with metaprogramming
// Geometry vector class example with metaprogramming
#include <iostream>
#include <string>
#include <cmath>
namespace utils {
template <typename type>
class property {
@Midi12
Midi12 / quick-postgresql-guide.md
Created February 7, 2021 11:52
Quick postgresql guide

Quick PostgreSql guide

Table of content

  • Install
  • Creating a database
  • Creating an user
  • Assigning rights
  • Creating a table
  • Inserting data into a table
  • Querying a table
@Midi12
Midi12 / ida_name_vftable.py
Last active February 15, 2021 18:29
IDA script to rename vftable automatically
from idaapi import *
from idautils import *
from idc import *
from ida_typeinf import *
import re
IS64 = get_inf_structure().is_64bit()
print('64bit mode' if IS64 else '32bit mode')
sub_regex = re.compile(r'sub_[0-9A-F]+')
@Midi12
Midi12 / disposable_struct.dart
Last active March 4, 2021 13:17
Simple memory manager for struct allocated in Dart using ffi
import 'dart:ffi';
// library
final DynamicLibrary _kernel32 = DynamicLibrary.open('kernel32.dll');
typedef HeapAllocNative_t = Pointer Function(Pointer, Uint32, IntPtr);
typedef HeapAlloc_d = Pointer Function(Pointer, int, int);
final HeapAlloc_d pfnHeapAlloc = _kernel32.lookupFunction<HeapAllocNative_t, HeapAlloc_d>('HeapAlloc');
typedef HeapFree_t = Int32 Function(Pointer heap, Uint32 flags, Pointer memory);
@Midi12
Midi12 / decipher_fishcheat.py
Last active April 28, 2021 13:31
Some string cipher resolution in some unknown fish cheat
'''
sub_180001F5C+34 mov rdx, 0C9A201E140208649h
sub_180001F5C+3E mov rcx, 213228A830CCCFFEh
sub_180001F5C+48 mov qword ptr [rbp+var_10], rdx
sub_180001F5C+4C mov qword ptr [rbp+var_10+8], rcx
sub_180001F5C+50 mov rax, 5068B50F657EF22h ; <- encrypted name
sub_180001F5C+5A movups xmm2, [rbp+var_10]
sub_180001F5C+5E mov qword ptr [rbp+ModuleName], rax
sub_180001F5C+62 mov r14, 5638B3DF636EF65h ; <- xor key
sub_180001F5C+6C mov qword ptr [rbp+var_40+8], rcx
import 'dart:collection';
class A {
A();
}
class B extends A {
B() : super();
}