This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
from idc import * | |
from ctypes import c_uint32 | |
def bruteforce_word(dword1,dword2): | |
for i in range(0,256) : | |
for j in range(0,256) : | |
k = 0 | |
result = c_uint32(0xffffffff) | |
while k < 2 : | |
if k == 0 : |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/*2nd level dropper : DLL main function*/ | |
{ | |
/*[...]*/ | |
pavtr_listelem Elem = gList; | |
while ( Elem != NULL ) | |
{ | |
HANDLE hThread = CreateThread(NULL,NULL,Avtr_ThreadProc,Elem,0); | |
if ( ! hThread ) | |
break; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
DWORD WINAPI Avtr_ThreadProc( pavtr_listelem Elem ) | |
{ | |
if ( !Elem ) | |
return 1; | |
if ( Elem->technique == 0x80000000 ) | |
{ | |
if ( Avtr_getKernelRoutines() ) | |
{ | |
int priv_value = Elem->privilege_value; | |
if ( ! --priv_value ) //1 => ordinary user |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
typedef struct _avtr_listelem | |
{ | |
struct _avtr_listelem* next; | |
struct _avtr_listelem* prev; | |
DWORD technique; /*0x08*/ | |
DWORD privilege_value; /*0x0C*/ | |
DWORD n_tries; /*0x10*/ | |
DWORD milliseconds; /*0x14*/ | |
} avtr_listelem, *pavtr_listelem; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/* | |
VM by Souhail Hammou : custom instruction set | |
data space and stack space are customizable. | |
Important : In calculations the VM is using unsigned values. | |
*/ | |
#include <stdio.h> | |
#include <stdint.h> | |
#include <conio.h> | |
#define TRUE 1 | |
#define FALSE 0 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <Windows.h> | |
#define NTHREADS 5 | |
DWORD WINAPI Thread(LPVOID Parameter) | |
{ | |
while (1) | |
CloseHandle(FindFirstChangeNotificationA("C:\\", FALSE, FILE_NOTIFY_CHANGE_FILE_NAME)); | |
} | |
void main() | |
{ | |
HANDLE hLastThread; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
pid = /*Locate the service's pid with the help of NtQuerySystemInformation*/; | |
for( Page = 0x1000; Page < 0x7fffffff; Page += 0x1000 ) | |
{ | |
Page_cp = Page; | |
OldProtection = CommunicateServiceVirtualProtect( | |
pid, //We give the service its own pid | |
Page, //Address of the page in the service's process | |
PAGE_EXECUTE_READWRITE, //Change to the most permissible protection to avoid crashes | |
0x1000 | |
); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <stdio.h> | |
#include <stdlib.h> | |
#include <stdint.h> | |
#include <string.h> | |
#define SUMS_SZ 0x10000 * sizeof(int16_t) | |
#define VM_SZ sizeof(initial_state) | |
typedef int16_t WORD; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
from idc import * | |
root = 0x1300 | |
flag = '' | |
def tobits(s): | |
result = [] | |
for c in s: | |
bits = bin(ord(c))[2:] | |
bits = '00000000'[len(bits):] + bits |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# HXP CTF 2017 - revenge_of_the_zwiebel 100 pts | |
# Writeup link : https://rce4fun.blogspot.com/2017/11/hxp-ctf-2017-revengeofthezwiebel.html | |
# Souhail Hammou | |
from idc import * | |
from idaapi import * | |
def AddIfNotInDict(dict,index): | |
if index == -1: | |
raise Exception("Invalid index value !") |
NewerOlder