Skip to content

Instantly share code, notes, and snippets.

@SciresM
SciresM / gw_flash.py
Last active July 24, 2022 15:46
utility for interacting with gateway modchip updates
import sys
from struct import pack as pk, unpack as up
def u32(x):
return x & 0xFFFFFFFF
def tea_update_custom_mac(mac, v, k):
v0, v1 = v[0], v[1]
cur_sum = 0xC6EF3720
k0, k1, k2, k3 = k[0], k[1], k[2], k[3]
#include <cstdint>
#include <cstddef>
#include <cstdbool>
using u32 = uint32_t;
u32 GetRandom(u32 range);
u32 GetCurrentHour();
bool IsFishing();
==========
Map: 000 - Route 1 (Hau’oli Outskirts) / 003 - Route 1 / 010 - Melemele Sea
Tables: 18
Table 1 (Day):
Encounters (Levels 2-3): Ledyba (20%), Pikipek (20%), Yungoos (20%), Grubbin (15%), Caterpie (10%), Buneary (10%), Pichu (5%)
SOS Slot 1 (Levels 2-3): Ledyba (20%), Pikipek (20%), Yungoos (20%), Grubbin (15%), Caterpie (10%), Buneary (10%), Pikachu (5%)
SOS Slot 2 (Levels 2-3): Ledyba (20%), Pikipek (20%), Yungoos (20%), Grubbin (15%), Caterpie (10%), Buneary (10%), Pikachu (5%)
SOS Slot 3 (Levels 2-3): Ledyba (20%), Pikipek (20%), Yungoos (20%), Grubbin (15%), Caterpie (10%), Buneary (10%), Pikachu (5%)
SOS Slot 4 (Levels 2-3): Ledyba (20%), Pikipek (20%), Yungoos (20%), Grubbin (15%), Caterpie (10%), Buneary (10%), Pikachu (5%)
SOS Slot 5 (Levels 2-3): Ledyba (20%), Pikipek (20%), Yungoos (20%), Grubbin (15%), Caterpie (10%), Buneary (10%), Happiny (5%)
==========
Map: 000 - Route 1 (Hau’oli Outskirts) / 003 - Route 1 / 010 - Melemele Sea
Tables: 18
Table 1 (Day):
Encounters (Levels 2-3): Ledyba (20%), Pikipek (20%), Yungoos (20%), Grubbin (15%), Caterpie (10%), Buneary (10%), Pichu (5%)
SOS Slot 1 (Levels 2-3): Ledyba (20%), Pikipek (20%), Yungoos (20%), Grubbin (15%), Caterpie (10%), Buneary (10%), Pikachu (5%)
SOS Slot 2 (Levels 2-3): Ledyba (20%), Pikipek (20%), Yungoos (20%), Grubbin (15%), Caterpie (10%), Buneary (10%), Pikachu (5%)
SOS Slot 3 (Levels 2-3): Ledyba (20%), Pikipek (20%), Yungoos (20%), Grubbin (15%), Caterpie (10%), Buneary (10%), Pikachu (5%)
SOS Slot 4 (Levels 2-3): Ledyba (20%), Pikipek (20%), Yungoos (20%), Grubbin (15%), Caterpie (10%), Buneary (10%), Pikachu (5%)
SOS Slot 5 (Levels 2-3): Ledyba (20%), Pikipek (20%), Yungoos (20%), Grubbin (15%), Caterpie (10%), Buneary (10%), Happiny (5%)
@SciresM
SciresM / ushabti.py
Last active March 28, 2021 22:28
Ushabti predictor for Spelunky 2 seeded runs.
import sys
# Spelunky 2 ushabti prediction for seeded runs, author SciresM.
def u32(v):
return v & 0xFFFFFFFF
def u64(v):
return v & 0xFFFFFFFFFFFFFFFF
from idautils import *
from idaapi import *
from ida_name import *
from idc import *
from ida_hexrays import *
from ida_frame import *
from ida_struct import *
INHERITANCE = {
# Auto Object base classes.
@SciresM
SciresM / cafe_mix.py
Last active December 26, 2020 19:39
import os, sys, zlib, traceback
from Crypto.Cipher import AES
from struct import unpack as up
XORPAD = '3F99BB49B43CBBD339FE5FEA463316A8'.decode('hex')
KEY = 'CAECB4CA65678965CBE67D7A3AFD228C'.decode('hex')
IV = 'A65D5EA2D54AD0436DD46158C191361D'.decode('hex')
def safe_open(path, mode):
import os
@SciresM
SciresM / spelunky2_extract.py
Created September 30, 2020 11:44
Quick and dirty Spelunky 2 asset extraction. Assets are a weird chacha20 variant, there are at least two cryptographic errors due to typos....
import zstd
from struct import pack as pk, unpack as up
import subprocess as sp
# Quick and dirty Spelunky 2 asset extraction, author SciresM.
# Assets are protected by a weird chacha20 variant.
# The developers made an unfortunate set of typos that
# significantly weakens the asset crypto...
def rotate_left(a, b):
from idautils import *
from idaapi import *
from idc import *
from ida_hexrays import *
START_100 = 0x7100770C10
END_100 = 0x710077FC60
START_110 = 0x7100770E30
@SciresM
SciresM / kernel_svc_tables.py
Last active September 4, 2020 05:23
Script for automatically identifying + labeling the Nintendo Switch SVC tables.
from idautils import *
from idaapi import *
from idc import *
from ida_hexrays import *
from ida_bytes import *
from ida_funcs import *
SVC_MAPPINGS = {
0x01 : ("SetHeapSize", "Result %s(uintptr_t *out_address, size_t size);"),
0x02 : ("SetMemoryPermission", "Result %s(uintptr_t address, size_t size, MemoryPermission perm);"),