Skip to content

Instantly share code, notes, and snippets.

View alexander-hanel's full-sized avatar
😶

Alexander Hanel alexander-hanel

😶
View GitHub Profile
@bcse
bcse / scrdec18-VC8.exe
Created February 15, 2012 10:13
Windows Script Decoder 1.8 (Decoding JScript.Encoded)
@neomatrix369
neomatrix369 / PerformanceRelated.md
Last active November 3, 2023 20:27
Interesting links in the areas of HPC, low latency, mechanical harmony/sympathy, garbage collection
@Neo23x0
Neo23x0 / yara_performance_guidelines.md
Last active April 30, 2024 10:39
YARA Performance Guidelines

This Gist has been transfered into a Github Repo. You'll find the most recent version here.

YARA Performance Guidelines

When creating your rules for YARA keep in mind the following guidelines in order to get the best performance from them. This guide is based on ideas and recommendations by Victor M. Alvarez and WXS.

  • Revision 1.4, October 2020, applies to all YARA versions higher than 3.7
@rkitover
rkitover / make.log
Created April 9, 2016 00:20
llvm won't link
[ 89%] Built target not
[ 89%] Built target yaml-bench
[ 89%] Built target gtest
[ 89%] Built target gtest_main
[ 89%] Built target LTO_exports
[ 90%] Linking CXX shared library ../../lib/libLTO.so
../../lib/libLLVMScalarOpts.a: could not read symbols: Memory exhausted
collect2: error: ld returned 1 exit status
*** Error 1 in . (tools/lto/CMakeFiles/LTO.dir/build.make:255 'lib/libLTO.so')
*** Error 1 in . (CMakeFiles/Makefile2:12494 'tools/lto/CMakeFiles/LTO.dir/all')
void TestCopy()
{
BOOL cond = FALSE;
IFileOperation *FileOperation1 = NULL;
IShellItem *isrc = NULL, *idst = NULL;
BIND_OPTS3 bop;
SHELLEXECUTEINFOW shexec;
HRESULT r;
do {
@nitrocode
nitrocode / getDictValueFromPath.py
Last active July 21, 2020 22:00
Gets a value from a dictionary using a list key path
#!/usr/bin/env python
def getDictValueFromPath(listKeys, jsonData):
"""Retrieve value from a dictionary using a list of keys.
>>> mydict = {
'a': {
'b': {
'c': '1'
}
@trietptm
trietptm / rol-ror.py
Created August 3, 2016 16:27 — forked from vqhuy/rol-ror.py
python rol, ror operation implement
###########################################################################
# Rotating bits (tested with Python 2.7)
from __future__ import print_function # PEP 3105
# max bits > 0 == width of the value in bits (e.g., int_16 -> 16)
# Rotate left: 0b1001 --> 0b0011
rol = lambda val, r_bits, max_bits: \
(val << r_bits%max_bits) & (2**max_bits-1) | \
'''
IDA plugin to display the calls and strings referenced by a function as hints.
Installation: put this file in your %IDADIR%/plugins/ directory.
Author: Willi Ballenthin <william.ballenthin@fireeye.com>
Licence: Apache 2.0
'''
import idc
import idaapi
import idautils
@worawit
worawit / eternalblue_merge_shellcode.py
Last active April 3, 2024 12:25
Windows x64 and x86 kernel shellcode for eternalblue exploit
# This file has no update anymore. Please see https://github.com/worawit/MS17-010
import sys
from struct import pack
if len(sys.argv) < 4:
print('Usage: {} sc_x86 sc_x64 sc_out'.format(sys.argv[0]))
sys.exit()
sc_x86 = open(sys.argv[1], 'rb').read()
sc_x64 = open(sys.argv[2], 'rb').read()
//**********************************************************************`
//* This is an include file generated by Message Compiler. *`
//* *`
//* Copyright (c) Microsoft Corporation. All Rights Reserved. *`
//**********************************************************************`
#pragma once
#include <wmistr.h>
#include <evntrace.h>
#include "evntprov.h"
//