Skip to content

Instantly share code, notes, and snippets.


Alex A. NeatMonster

View GitHub Profile
View preloaded_data.txt,0,0,1,1,1,1,1,1,1,0
NeatMonster /
Created Mar 12, 2020
Contextual menu to enable copying as UUID/bytes list/hex string
import uuid
import ida_bytes
import ida_hexrays
import ida_idaapi
import ida_kernwin
from PyQt5.Qt import QApplication
class Plugin(ida_idaapi.plugin_t):
NeatMonster /
Created Mar 8, 2020
Creates a pattern file from a database
@brief Creates a pattern file from a database
@author neat
import os
import idautils
import ida_bytes
import ida_funcs
import argparse
from construct import Int16ul, Int64ul
def main(args):
with open(args.kernel, 'rb') as f:
data =
sym_addrs = data.find( * 2)
for offset in range(0, len(data), 0x100):
import java.util.HashMap;
import java.util.Map;
import org.objectweb.asm.ClassVisitor;
import org.objectweb.asm.ClassWriter;
import org.objectweb.asm.commons.ClassRemapper;
import os
import sys
from construct import *
BOOT_IMG_HDR = Struct(
"magic" / Const(b"ANDROID!"),
"kernel_size" / Int32ul,
"kernel_addr" / Int32ul,
"ramdisk_size" / Int32ul,
NeatMonster / dmca.txt
Created Apr 21, 2019
Companies that have issued the greatest number of DCMA requests to GitHub as of today
View dmca.txt
97 Pearson
76 Codility
52 Stereoarts
43 Webkul
43 FHAdmin
41 Attributor
37 OffensiveSecurity
35 Odoo
35 Jetbrains
29 Mobiscroll
import ida_netnode
You can also switch the shell into IDC mode and enter del_user_info().
You can also edit your `~/ida-x/cfg/ida.cfg` and set `STORE_USER_INFO` to `NO`.
# This will replace the original user blob with the evaluation version blob.
NeatMonster /
Created Jul 19, 2017
Dumping JPEGs w/ Frida
import frida, sys
images = {}
def on_message(message, data):
global image
if message['type'] == 'send':
if message['payload'].startswith('['):
message = message['payload']
save = message[message.index(']')+1:]
NeatMonster / value-profiling.diff
Created Jul 3, 2017
This small patch adds support for value profiling into AFL 2.44b.
View value-profiling.diff
diff -Naur a/llvm_mode/afl-llvm-rt.o.c b/llvm_mode/afl-llvm-rt.o.c
--- a/llvm_mode/afl-llvm-rt.o.c 2017-02-01 02:59:41.000000000 +0100
+++ b/llvm_mode/afl-llvm-rt.o.c 2017-06-29 15:55:53.052681442 +0200
@@ -304,3 +304,205 @@
+/* This function is called on every indirect call, but only if the binary has
+ been compiled with -fsanitize-coverage=trace-pc,indirect-calls. */