Greg Lesnewich g-les

## next_data.py
bv.navigate(bv.view, bv.get_next_data_var_start_after(here))

## donut_shellcode_fixed.yar
rule donut_shellcode_fixed
{
meta:
description = "Tested against shellcodes x86/x64 generated by Donut v0.9.3"
author = "Telsy CTI team"
date = "18/11/2021"
condition:
uint8(0) == 0xe8 and // shellcode starts with a call
uint32(1) == uint32(5) and
// xor generator key and xor initial key cannot be null it is 32 bytes

## keybase.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                g-les
                / keybase.md
            
            
              Created
              January 10, 2022 19:22
            
          
    Keybase proof

I hereby claim:

I am g-les on github.
I am glesnewich (https://keybase.io/glesnewich) on keybase.
I have a public key ASC1pkCbjKDRmT41uYt-kT0-3i4YkwNvWM5PUPNx__axaQo

To claim this, I am signing this object:

  
## 100_days_of_yara.yar
/*
Goals for #100DaysofYARA:

better understanding of bitwise operators
use math module beyond general entropy of a section / resource
position specific things beyond what PE module tells us
do some funky stuff with hashing


*/
	rule donut_shellcode_fixed
	{
	meta:
	description = "Tested against shellcodes x86/x64 generated by Donut v0.9.3"
	author = "Telsy CTI team"
	date = "18/11/2021"
	condition:
	uint8(0) == 0xe8 and // shellcode starts with a call
	uint32(1) == uint32(5) and
	// xor generator key and xor initial key cannot be null it is 32 bytes
	/*
	Goals for #100DaysofYARA:

	better understanding of bitwise operators
	use math module beyond general entropy of a section / resource
	position specific things beyond what PE module tells us
	do some funky stuff with hashing


	*/