Skip to content

Instantly share code, notes, and snippets.

View Rurik's full-sized avatar

Brian Baskin Rurik

211 followers · 22 following
View GitHub Profile
@OALabs
OALabs / boxstarter_oalabs_x86vm.ps1
Last active December 17, 2022 22:03
Boxstarter - One click malware analysis tools installer for 32bit VM
Set-ExecutionPolicy Unrestricted;
iex ((New-Object System.Net.WebClient).DownloadString('http://boxstarter.org/bootstrapper.ps1'));
get-boxstarter -Force;
Install-BoxstarterPackage -PackageName 'https://gist.githubusercontent.com/OALabs/afb619ce8778302c324373378abbaef5/raw/4006323180791f464ec0a8a838c7b681f42d238c/oalabs_x86vm.ps1';
@cji
cji / win_vm_kerneldbg.md
Last active April 30, 2021 13:07
Steps to successfully debug the Windows kernel between 2 VMWare VMs

Open the debugger VM's .vmx file. delete the existing serial0 lines (used for printing, not needed) add these lines:

serial0.present = "TRUE"
serial0.pipe.endPoint = "client"
serial0.fileType = "pipe"
serial0.yieldOnMsrRead = "TRUE"
serial0.tryNoRxLoss = "FALSE"
serial0.startConnected = "TRUE"
@Rurik
Rurik / asm_find_math.py
Last active September 16, 2023 17:17
Detect subroutines that may have encryption/encoding routines by finding XOR and shift routines.
# Automatically find XOR/SHL/SHR routines from an executable
# Uses IDAW (text IDA)
# @bbaskin - brian @ thebaskins.com
# While other, more powerful scripts like FindCrypt find known
# algorithms this is used to find custom encoding or modified
# encryption routines
"""
Script results:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
@williballenthin
williballenthin / parse_windows_timestamp.py
Created April 4, 2013 18:56
Parse a hex encoded Windows timestamp into a readable ISO formatted timestamp.
def parse_windows_timestamp(hex_str):
"""
@type hex_str: str
@param hex_str: A string that contains a hex encoded QWORD (8 bytes) that are a Windows timestamp.
@rtype: str
@return: A string that contains an ISO formatted timestamp.
"""
import struct, binascii
from datetime import datetime
return datetime.utcfromtimestamp(float(struct.unpack_from("<Q", binascii.unhexlify(hex_str.replace(" ", "")))[0]) * 1e-7 - 11644473600).isoformat("T")