hshrzd

## readme.md

      
              3 files
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                hshrzd
                / readme.md
            
            
              Created
              June 4, 2021 17:36
                — forked from lancejpollard/readme.md
            
              
                System Call List for Windows, Mac, and Linux
              
          
windows-syscall-nt-csv (from here)
windows-syscall-32k-csv (from here)
mac (from here and here)


## pe_file.cpp
typedef struct _IMAGE_DOS_HEADER
{
  _WORD e_magic;
  _WORD e_cblp;
  _WORD e_cp;
  _WORD e_crlc;
  _WORD e_cparhdr;
  _WORD e_minalloc;
  _WORD e_maxalloc;
  _WORD e_ss;

## scrdec18-VC8.exe

      
              2 files
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                hshrzd
                / scrdec18-VC8.exe
            
            
              Created
              February 17, 2021 23:04
                — forked from bcse/scrdec18-VC8.exe
            
              
                Windows Script Decoder 1.8 (Decoding JScript.Encoded)
              
          
            View raw
        
    
## strref.py
import idautils

sc = idautils.Strings()
for s in sc:
	curr_str = str(s)
	str_offset = s.ea

	for xref in idautils.XrefsTo(s.ea):
		func = idaapi.get_func(xref.frm)
		if not func:

## immunity_list_calls_via_reg.py
#!/usr/bin/env python

"""
(c) hAsh, 2015 run via ImmunityDbg
"""
__VERSION__ = '0.3.1'
__AUTHOR__ = 'hAsh'

import immlib
import pefile
	typedef struct _IMAGE_DOS_HEADER
	{
	_WORD e_magic;
	_WORD e_cblp;
	_WORD e_cp;
	_WORD e_crlc;
	_WORD e_cparhdr;
	_WORD e_minalloc;
	_WORD e_maxalloc;
	_WORD e_ss;
	import idautils

	sc = idautils.Strings()
	for s in sc:
	curr_str = str(s)
	str_offset = s.ea

	for xref in idautils.XrefsTo(s.ea):
	func = idaapi.get_func(xref.frm)
	if not func:
	#!/usr/bin/env python

	"""
	(c) hAsh, 2015 run via ImmunityDbg
	"""
	__VERSION__ = '0.3.1'
	__AUTHOR__ = 'hAsh'

	import immlib
	import pefile