Skip to content

Instantly share code, notes, and snippets.

View SiD3W4y's full-sized avatar

Tanguy Dubroca SiD3W4y

108 followers · 22 following
View GitHub Profile
@SiD3W4y
SiD3W4y / exploit.c
Last active March 1, 2021 11:02
tokyowesterns eebpf exploit
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <unistd.h>
#include <err.h>
#include <sys/socket.h>
#include <linux/bpf.h>
#include <linux/filter.h>
#include <bpf/bpf.h>
@SiD3W4y
SiD3W4y / keykoolol.py
Created May 4, 2020 16:23
keykoolol solving script (FCSC quals 2020)
import sys
import binascii
from pwn import *
# AES stuff
Sbox = (
0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,
0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,
0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,
@SiD3W4y
SiD3W4y / solver.py
Created April 19, 2020 19:43
Solver for you wa shockwave, PlaidCTF 2020
from z3 import *
check_data = [
[2, 5, 12, 19, 3749774],
[2, 9, 12, 17, 694990],
[1, 3, 4, 13, 5764],
[5, 7, 11, 12, 299886],
[4, 5, 13, 14, 5713094],
[0, 6, 8, 14, 430088],
[7, 9, 10, 17, 3676754],
@SiD3W4y
SiD3W4y / qiling_bf.py
Created March 29, 2020 21:25
Memoization solution using qiling for VolgaCTF 2020 - f-hash task
from qiling import *
from unicorn import *
import struct
BASE = 0x555555554000
REC_START = BASE + 0x13b0
REC_END = BASE + 0x1424
INLAST = False
@SiD3W4y
SiD3W4y / nid_resolve.py
Created January 3, 2020 22:00
Resolve imports names for PSP elf files (NID)
# Resolve sce NIDs
# @category: PSP
from java.io import File
from generic.continues import RethrowContinuesFactory
from ghidra.app.util.bin import RandomAccessByteProvider
from ghidra.app.util.bin.format.elf import ElfHeader
nid_map = {
0x91e4f6a7: "sceKernelLibcClock",
@SiD3W4y
SiD3W4y / entity_spawn_clean.c
Last active August 21, 2019 17:14
Entity spawning logic for Zelda a Link to the past
// Function setting the position and id properties during spawn
void entity_spawn(u8* bindata, u8 entity_id)
{
// Globals
const u8* unk_arr_1 = (const u8*)0x8227c73; // ROM ptr
u8* unk_arr_2 = (u8*)0x2006b80; // RAM ptr
u8* entity_class = (u8*)0x30031d2; // Entity class array
u8* unk_arr_4 = (u8*)0x3003322;
u8* entity_low_y_pos = (u8*)0x3003102; // entity_low_y_pos
u8* entity_high_y_pos = (u8*)0x3003122; // entity_high_y_pos
@SiD3W4y
SiD3W4y / trace_function_detection.py
Created August 9, 2019 10:10
Binary ninja snippet script to add trace based function detection on gba roms (through mgba)
# Trace function detection
#
# Binary ninja script for trace based function detection on gba using
# the 'tracing' branch of this fork: https://github.com/SiD3W4y/mgba
path = get_open_filename_input("mgba trace file")
if not path:
show_message_box("Function detection", "Please specify a file")
lines = open(path, "r").readlines()
@SiD3W4y
SiD3W4y / mgba_bl.c
Last active July 31, 2019 23:52
#include <stdint.h>
#include <stdio.h>
union ARMOperand {
uint8_t reg;
int32_t immediate;
};
struct ARMInstructionInfo {
uint32_t opcode;
@SiD3W4y
SiD3W4y / gmod_api.json
Last active July 10, 2019 11:32
gmod api function description in json format
[
{
"category": "client",
"name": "EFFECT:Render",
"args": []
},
{
"category": "client",
"name": "EFFECT:StartTouch",
"args": []
@SiD3W4y
SiD3W4y / memdiff.py
Created May 1, 2019 23:23
Do memory diffing on specific block sizes
import struct
import sys
def diffing(oldbuff, newbuff, op):
offsets = set()
for i in range(0, min(len(oldbuff), len(newbuff))):
if op(oldbuff[i], newbuff[i]):
offsets.add(i)