Skip to content

Instantly share code, notes, and snippets.

View Rurik's full-sized avatar

Brian Baskin Rurik

205 followers · 22 following
View GitHub Profile
@Rurik
Rurik / multibyte_xor.py
Last active November 3, 2022 13:05
Generic code to do a multi-byte XOR encoding
def multibyte_xor(data, key): # Python 2
from itertools import izip, cycle
return ''.join(chr(ord(x) ^ ord(y)) for (x,y) in izip(data, cycle(key)))
@Rurik
Rurik / apricorn_keep_alive.py
Created July 7, 2015 16:32
Apricorn Padlock Keep-Alive
import os
import time
while True:
os.mkdir('F:\\A')
time.sleep(10)
os.rmdir('F:\\A')
@Rurik
Rurik / asm_find_math.py
Last active September 16, 2023 17:17
Detect subroutines that may have encryption/encoding routines by finding XOR and shift routines.
# Automatically find XOR/SHL/SHR routines from an executable
# Uses IDAW (text IDA)
# @bbaskin - brian @ thebaskins.com
# While other, more powerful scripts like FindCrypt find known
# algorithms this is used to find custom encoding or modified
# encryption routines
"""
Script results:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
@Rurik
Rurik / gist:6556041
Last active March 6, 2024 21:31
Python functions to compress folder paths to include their environment variable. This is the opposite of os.path.expandvars(). For example, "C:\Windows\system32\cmd.exe" would resolve to "%WINDIR%\system32\cmd.exe".
#@bbaskin
import os
import re
# Thanks to Andrew Havens of Cipher Tech for figuring out how to escape the paranthesis to work with
# both expandvars and regex
def generalize_vars_init():
"""
Initialize a dictionary with the local system's environment variables.