Skip to content

Instantly share code, notes, and snippets.

Avatar
☣️

epcnt19

☣️
  • Japan
View GitHub Profile
View boot.cmd
qemu-system-x86_64 -nographic -kernel ./linux-4.4.185/arch/x86_64/boot/bzImage -initrd ./busybox/rootfs.img -append "root=/dev/ram rdinit=/bin/sh console=ttyS0"
View 50-cloud-init.yaml
network:
ethernets:
ens3:
addresses: [192.168.122.3/24]
gateway4: 192.168.122.1
dhcp4: false
dhcp6: false
accept-ra: false
nameservers:
addresses: [1.1.1.1]
View sandbox_test.c
#include<stdio.h>
#include<unistd.h>
#include<sys/types.h>
#include<sys/wait.h>
#include<sys/syscall.h>
#include<sys/stat.h>
#define GETCWD 79
#define MKDIR 83
#define RMDIR 84
View sandbox_result.log
[ 213.144561] sys_regist_pid : called
[ 213.144564] search_pid : called
[ 213.144566] search_pid : no hit entry_ptr
[ 213.144567] sys_regist_pid : success adding pid(2195)
[ 213.144569] check_sandbox : detect target pid(2195)
[ 213.144570] sys_regist_syscall : called
[ 213.144572] search_syscall_num : called
[ 213.144573] search_syscall_num : no hit entry_ptr
[ 213.144574] sys_regist_syscall : success adding syscall number(79)
[ 213.144576] check_sandbox : detect target pid(2195)
View kvm_cpuid.py
#!/usr/bin/env python
from __future__ import print_function
from bcc import BPF
b = BPF(text="""
#define EXIT_REASON 10
BPF_HASH(start, u8, u8);
TRACEPOINT_PROBE(kvm, kvm_exit) {
View cpuid.c
#include<stdio.h>
int eax_value = 0;
void cpuid(){
__asm__ volatile ("movl eax_value,%eax \n\t"
"cpuid");
}
View node_drone.js
var RollingSpider = require('rolling-spider');
var temporal = require('temporal');
var keypress = require('keypress');
var record = require('node-record-lpcm16');
var Julius = require('julius-net');
var rollingSpider = new RollingSpider();
keypress(process.stdin);
process.stdin.setRawMode(true);
console.log("[drone event] connecting to rolling spider...");
@epcnt19
epcnt19 / auto.py
Created Oct 23, 2018
drakvuf trace script
View auto.py
#coding:utf-8
import re
import sys
import time
import argparse
import subprocess
import commands
dname_to_id = "xl domid %s"
get_pid = "vmi-process-list %s | grep %s"
View sptdump_result.txt
root@ubuntu:# ../../simple-pt/sptdump
cpu 0 offset 0, 0 KB, writing to ptout.0
cpu 1 offset 0, 0 KB, writing to ptout.1
cpu 2 offset 0, 0 KB, writing to ptout.2
cpu 3 offset 1904, 2048 KB, writing to ptout.3
cpu 4 offset 0, 0 KB, writing to ptout.4
cpu 5 offset 0, 0 KB, writing to ptout.5
cpu 6 offset 0, 0 KB, writing to ptout.6
cpu 7 offset 0, 0 KB, writing to ptout.7
cpu 8 offset 0, 0 KB, writing to ptout.8
View simple-pt_dmesg.txt
[ 2786.576349] start_pt_with_ioctl is called
[ 2786.576353] val 0
[ 2786.576354] oldval 0
[ 2786.576404] start_pt_with_ioctl is called
[ 2786.576406] start_pt_with_ioctl is called
[ 2786.576408] start_pt_with_ioctl is called
[ 2786.576410] start_pt_with_ioctl is called
[ 2786.576411] start_pt_with_ioctl is called
[ 2786.576412] start_pt_with_ioctl is called
[ 2786.576413] start_pt_with_ioctl is called