ek0

// Returns an OBJECT_NAME_INFORMATION object pointed by name
// Caller must free `name` after usage
UNICODE_STRING* GetObjectNameInformation(HANDLE object_handle)
{
    ULONG length = 0;
    UNICODE_STRING* obj = (UNICODE_STRING*)malloc(sizeof(UNICODE_STRING));
    NTSTATUS(*myNtQueryObject)(HANDLE, ObjectInfoClass, UNICODE_STRING*, uint32_t, PULONG) = (NTSTATUS(*)(HANDLE, ObjectInfoClass, UNICODE_STRING*, uint32_t, PULONG))GetProcAddress(GetModuleHandle("ntdll"), "NtQueryObject");
    NTSTATUS status = myNtQueryObject(object_handle, ObjectNameInformation, obj, sizeof(UNICODE_STRING), &length);
    if (!NT_SUCCESS(status) && (status == 0xc0000004 || status == 0x80000005))
    {

ek0

// adder.cpp : This file contains the 'main' function. Program execution begins and ends there.
//

#include <iostream>
#include <cstdint>
#include <intrin.h>
//#include <mmintrin.h>
//#include <emmintrin.h>

uint64_t add(uint64_t a, uint64_t b)

ek0

param([Parameter(Mandatory=$true)] [String]$File)

# PATH of your RE projects.
$re_path = "D:\RE\"
$temp_filename  = Split-Path $File -leaf
if(-not (Test-Path ($re_path + $temp_filename + "\") -PathType Container))
{
    # Add subfolder
}
else

ek0

void DumpPages(void* address)
{
    MEMORY_BASIC_INFORMATION mem_info;
    FILE* desc = nullptr;
    FILE* bin = nullptr;
    char module_name[MAX_PATH] = { 0 };
    char desc_filename_buffer[MAX_PATH] = { 0 };
    char bin_filename_buffer[MAX_PATH] = { 0 };
    char buffer[0x1000] = { 0 };
    snprintf(desc_filename_buffer, MAX_PATH, "desc_%#016" PRIx64 ".txt", address);

ek0

import ctypes
import ctypes.wintypes

class GUID(ctypes.Structure):
    _fields_ = [("Data1", ctypes.wintypes.DWORD),
                ("Data2", ctypes.wintypes.WORD),
                ("Data3", ctypes.wintypes.WORD),
                ("Data4", ctypes.c_ubyte * 8)]
    def __repr__(self):
        return "{0:08X}-{1:04X}-{2:04X}-{3:02X}{4:02X}-{5:02X}{6:02X}{7:02X}{8:02X}{9:02X}{10:02X}".format(self.Data1, 

ek0

#include <iostream>
#include <iomanip>

#include <QBDI.h>

int Test(int a, int b)
{
	return a + b;
}

ek0

def crefs_from(address = here()):
    current = ida_xref.get_first_cref_from(address)
    while current != ida_idaapi.BADADDR:
        yield current
        current = ida_xref.get_next_cref_from(address, current)

def crefs_to(address = here()):
    current = ida_xref.get_first_cref_to(address)
    while current != ida_idaapi.BADADDR:
        yield current

ek0

inline void InitializeListHead(LIST_ENTRY* list_head)
{
    list_head->Flink = list_head;
    list_head->Blink = list_head;
}

inline int IsListEmpty(LIST_ENTRY* list_head)
{
    return list_head->Flink == list_head;
}

ek0

/* NOTE: This is an autogenerated file; please do not edit. */

CustomIDAMemo
{
    qproperty-line-fg-default: white;
    qproperty-line-fg-regular-comment: #0E8F1D;
    qproperty-line-fg-insn: #B6B6B6;
    qproperty-line-fg-dummy-data-name: #CA0003;
    qproperty-line-fg-regular-data-name: #C50003;
    qproperty-line-fg-demangled-name: #0DA9FF;

ek0

def get_arg_1(call_address):
    """ Returns the arg 1 initialization address given a call to a function """
    addr = call_address
    while GetOpnd(addr, 0) != "rcx":
        addr = PrevHead(addr)
    return addr