Dump-GUY

'''
IDA plugin to display the calls and strings referenced by a function as hints.

Installation: put this file in your %IDADIR%/plugins/ directory.
Author: Willi Ballenthin <william.ballenthin@fireeye.com>
Licence: Apache 2.0
'''
import idc
import idaapi
import idautils

hfiref0x

typedef struct tagCREATELINKDATA {
    ULONG  dwFlags;
    WCHAR szLinkName[MAX_PATH];     // + 0x20C
    WCHAR szExeName[MAX_PATH];      // + 0x414
    WCHAR szParams[MAX_PATH];       // + 0x61C
    WCHAR szWorkingDir[MAX_PATH];   // + 0x824
    WCHAR szOriginalName[MAX_PATH]; // + 0xA2C
    WCHAR szExpExeName[MAX_PATH];   // + 0xC34
    WCHAR szProgDesc[MAX_PATH];     // + 0xE3C
    WCHAR szFolder[MAX_PATH];       // + 0x1044

williballenthin

#!/usr/bin/env python3
'''
A simplified FLOSS implementation that only supports stackstrings.

requirements:
  - yara-python
  - unicorn

author: Willi Ballenthin
email: william.ballenthin@fireeye.com

securitytube

//   Dll Hijacking via Thread Creation 
// Author - Vivek Ramachandran 
//  Learn Pentesting Online --  http://PentesterAcademy.com/topics and http://SecurityTube-Training.com 
// Free Infosec Videos --  http://SecurityTube.net 



#include <windows.h>
#define SHELLCODELEN	2048

nacx

import os

# Automatically set the __all__ variable with all
# the available plugins.

plugin_dir = "plugins"

__all__ = []
for filename in os.listdir(plugin_dir):
    filename = plugin_dir + "/" + filename

lusis

import argparse
from mock import Mock

m = Mock()

parser = argparse.ArgumentParser()
subparsers = parser.add_subparsers()

query_group = subparsers.add_parser('query')
add_group = subparsers.add_parser('add')