NyaMisty

JETSAM="/System/Library/LaunchDaemons/com.apple.jetsamproperties.D21.plist"
DAEMON="misty.qtierdaemon"
sudo plutil -Version4 -Daemon -Override -key "$DAEMON" -dict $JETSAM
sudo plutil -Version4 -Daemon -Override -key "$DAEMON" -key ActiveHardMemoryLimit -int 256 $JETSAM
sudo plutil -Version4 -Daemon -Override -key "$DAEMON" -key ActiveSoftMemoryLimit -int 256 $JETSAM
sudo plutil -Version4 -Daemon -Override -key "$DAEMON" -key InactiveHardMemoryLimit -int 256 $JETSAM
sudo plutil -Version4 -Daemon -Override -key "$DAEMON" -key InactiveSoftMemoryLimit -int 256 $JETSAM
sudo plutil -Version4 -Daemon -Override -key "$DAEMON" -key EnergyEfficiencyMode -string UserInterface $JETSAM

NyaMisty

"""
summary: drawing custom graphs
description:
  Showing custom graphs, using `ida_graph.GraphViewer`. In addition,
  show how to write actions that can be performed on those.
keywords: graph, actions
"""

from __future__ import print_function
# -----------------------------------------------------------------------

NyaMisty

#*TEMPLATE*
#*TEMPLATE* Rename or copy this file without the .TEMPLATE extension
#*TEMPLATE*
#------------------------------------------------------------------------------
# JEB Custom Keyboard Shortcuts
#------------------------------------------------------------------------------

# Uncomment and add your own keyboard shortcuts for the actions for which you'd like to override the default shortcuts
# Example: by default, Jump is mapped to the 'G' key; the following line (minus the # character) can be used to remap the action to CTRL+J:
#jump=Ctrl+J

NyaMisty

WSL2 Systemd, 2022 (Windows 11) version

Install genie

https://github.com/arkane-systems/genie

Fix genie on latest Windows 11

See Issue arkane-systems/genie#267

NyaMisty

#include <stdio.h>
#include <stdlib.h>

static void* mem_scan(const void* addr, size_t size, const char* hex_pattern) {
    union pattern_holder {
        struct {
            unsigned char content : 8;
            unsigned char mask : 8;
        };
        wchar_t pat_char;

NyaMisty

#!./tclkit

## prepare runtime environment
proc init {} {
	## mount optional.pak (for tcltwofish)
	set optionalPak installbuilder/paks/optional.pak
	vfs::mk4::Mount $optionalPak $optionalPak -readonly

	## adjust library search path
	set ::auto_path [list $tcl::kitpath/lib/tcl$::tcl_version $tcl::kitpath/lib $tcl::kitpath/libraries $optionalPak/linux-x64 $tcl::kitpath]

NyaMisty

Windows 10 / Windows 11 Hyper-V Port Excluded issue

When you enable HyperV and WSL on the same machine, there'll usually tons of ports being used, see netsh int ipv4 show excl proto=tcp

HNS WinNat

These excluded ports are managed by winnat (see https://stackoverflow.com/questions/65272764/ports-are-not-available-listen-tcp-0-0-0-0-50070-bind-an-attempt-was-made-to).

HNS is a supporting service for HyperV, managing all HyperV vEthernet adapters and Nat related things.

NyaMisty

Resync Local Types in IDA

Sometimes there's some inconsistency between local types and structs view.

Typically, you can see the type in the "Structures" view are zero-lengthed, which should normally be the same size as local type's one.

When this happens, you'll not be able to rename the structure fields in HexRay Decompiler's view, and both hotkey N and right-clicking the item won't show the rename popup.

After reverse engineering the hexx64.dll, I found that IDA tries to do the following things:

NyaMisty

IDAPython CTREE

Important links

• Hex-Rays Decompiler Primer
• hexrays.hpp

Description

The CTREE is built from the optimized microcode (maturity at CMAT_FINAL), it represents an AST-like tree with C statements and expressions. It can be printed as C code.

NyaMisty

# -*- coding: utf-8 -*-
import json
import idaapi
import idc

processFields = [
    "ScriptMethod",
    "ScriptString",
    "ScriptMetadata",
    "ScriptMetadataMethod",