This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import argparse | |
from mock import Mock | |
m = Mock() | |
parser = argparse.ArgumentParser() | |
subparsers = parser.add_subparsers() | |
query_group = subparsers.add_parser('query') | |
add_group = subparsers.add_parser('add') |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import os | |
# Automatically set the __all__ variable with all | |
# the available plugins. | |
plugin_dir = "plugins" | |
__all__ = [] | |
for filename in os.listdir(plugin_dir): | |
filename = plugin_dir + "/" + filename |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// Dll Hijacking via Thread Creation | |
// Author - Vivek Ramachandran | |
// Learn Pentesting Online -- http://PentesterAcademy.com/topics and http://SecurityTube-Training.com | |
// Free Infosec Videos -- http://SecurityTube.net | |
#include <windows.h> | |
#define SHELLCODELEN 2048 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python3 | |
''' | |
A simplified FLOSS implementation that only supports stackstrings. | |
requirements: | |
- yara-python | |
- unicorn | |
author: Willi Ballenthin | |
email: william.ballenthin@fireeye.com |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
typedef struct tagCREATELINKDATA { | |
ULONG dwFlags; | |
WCHAR szLinkName[MAX_PATH]; // + 0x20C | |
WCHAR szExeName[MAX_PATH]; // + 0x414 | |
WCHAR szParams[MAX_PATH]; // + 0x61C | |
WCHAR szWorkingDir[MAX_PATH]; // + 0x824 | |
WCHAR szOriginalName[MAX_PATH]; // + 0xA2C | |
WCHAR szExpExeName[MAX_PATH]; // + 0xC34 | |
WCHAR szProgDesc[MAX_PATH]; // + 0xE3C | |
WCHAR szFolder[MAX_PATH]; // + 0x1044 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
''' | |
IDA plugin to display the calls and strings referenced by a function as hints. | |
Installation: put this file in your %IDADIR%/plugins/ directory. | |
Author: Willi Ballenthin <william.ballenthin@fireeye.com> | |
Licence: Apache 2.0 | |
''' | |
import idc | |
import idaapi | |
import idautils |