Skip to content

Instantly share code, notes, and snippets.

View eybisi's full-sized avatar
👀
hooking functions

Ahmet Bilal Can eybisi

👀
hooking functions
View GitHub Profile

Keybase proof

I hereby claim:

  • I am eybisi on github.
  • I am eybisi (https://keybase.io/eybisi) on keybase.
  • I have a public key ASCVtsAoUfJg_C8in2K1e50m9-PaweJ8wxkPmxzxcpNXiQo

To claim this, I am signing this object:

@eybisi
eybisi / frida-minesweeper.js
Last active May 3, 2018 16:06
minesweeper
setImmediate(function() { //prevent timeout
console.log("[*] Starting script");
Java.performNow(function() {
Java.choose("Draziw.Button.Mines.MainActivity", {
onMatch: function (instance) {
@eybisi
eybisi / sol.py
Created May 14, 2018 12:09
defconquals2018 ELF-Crumble
import itertools
f = open("broken")
brokendata = f.read()
f.close()
head = 0x5ad
tail = 0x8d4
brokenhead = brokendata[0:head]
def socksl(strinput):
length = len(strinput)
arr = [0 for i in range(length)]
i = length - 1
while i >= 0:
char1 = strinput[i]
n = i - 1
arr[i] = chr(ord(char1) ^ 0x5c)
if n < 0:
break
@eybisi
eybisi / x
Created June 25, 2018 20:27
z
from idautils import *
from idaapi import *
from idc import *
from idautils import *
from types import *
def socksl(strinput,first_key,second_key):
length = len(strinput)
arr = [0 for i in range(length)]
i = length - 1
@eybisi
eybisi / dec.py
Created August 30, 2018 15:34
anubis c2 dec
import base64
import sys
t = []
for i in range(256):
t.append(i)
bArr = bytearray(sys.argv[1].encode("utf-8"))
i2 = 0
def swap(i,i2,arr):
@eybisi
eybisi / agent-tesla.py
Created October 3, 2018 19:34
Agent tesla base64 decrypt code
import base64
from Crypto.Cipher import AES
def stringdecrypt(a):
string = base64.b64decode(a)
iv = "@1B2c3D4e5F6g7H8"
key = "\x34\x88\x6D\x5B\x09\x7A\x94\x19\x78\xD0\xE3\x8b\x1b\x5c\xa3\x29\x60\x74\x6a\x5e\x5d\x64\x87\x11\xb1\x2c\x67\xaa\x5b\x3a\x8e\xbf" #to 6a/5e for first iteration
cleartext = AES.new(key[0:32], AES.MODE_CBC, iv).decrypt(string)
return cleartext
@eybisi
eybisi / redalert.py
Created October 4, 2018 11:10
redalert c2 extract
import lxml.etree as etree
from androguard.core.bytecodes import apk
import sys
def main():
# python x.py name.apk
a = apk.APK(sys.argv[1])
a2 = a.get_android_resources()
b = etree.fromstring(a2.get_string_resources(a.get_package()))
try:
@eybisi
eybisi / idk.py
Created October 4, 2018 11:12
another packed malware c2 extractor
import lxml.etree as etree
from androguard.core.bytecodes import apk
import sys
def main():
# python x.py name.apk
a = apk.APK(sys.argv[1])
a2 = a.get_android_resources()
b = etree.fromstring(a2.get_string_resources(a.get_package()))
try:
@eybisi
eybisi / allatorixdemo.py
Last active October 12, 2018 09:06
Finds all ALLATORIxDEMO functions, takes xor keys, decrypts all strings, adds decrypted string as comment to the encrypted strings
from idautils import *
from idaapi import *
from idc import *
from idautils import *
from types import *
def socksl(strinput,first_key,second_key):
length = len(strinput)
arr = [0 for i in range(length)]
i = length - 1