icecr4ck

PostgreSQL cheatsheet

Get a root postgres shell

sudo -u postgres psql

Shell commands

icecr4ck

IDAPython CTREE

Important links

• Hex-Rays Decompiler Primer
• hexrays.hpp

Description

The CTREE is built from the optimized microcode (maturity at CMAT_FINAL), it represents an AST-like tree with C statements and expressions. It can be printed as C code.

icecr4ck

Format a USB drive on Linux

Identify the volume

lsusb
sudo fdisk -l
df -h # if already mounted

icecr4ck

Mount a Windows qcow2 image on Linux

1. Convert .qcow2 image to raw image

qemu-img convert -p -O raw image.qcow2 image.raw

2. Get the startsector of the partition you want to mount with the command file
3. Multiply the startsector value by 512 (referenced as SS_OFFSET in the next steps)
4. Create a directory where to mount the partition with mkdir /mnt/image
5. Run the mount command as follows to mount the partition

icecr4ck

Virtualisation

Definitions and architecture

Basics

Virtualisation: hardware assisted virtualisation where the VM’s processor matches host computer’s processor.

Emulation: faking the hardware to virtualise OSes using a different processor than the host computer's processor.

icecr4ck

Ansible

Configuration

In /etc/ansible/ansible.cfg by default, but the path can be overwritten by creating a file .ansible.cfg in the home directory.

Create a hosts file in /etc/ansible to add the hosts, it is possible to create groups with [group_name].

# /etc/ansible/hosts

icecr4ck

import idautils
import ida_range
import ida_hexrays as hr

class decryptor(hr.mop_visitor_t):

    def visit_mop(self, op, type, is_target):
        if op.t != hr.mop_f:
            return 0

icecr4ck

import idaapi

class ExamplePlugin(idaapi.plugin_t):
    flags = idaapi.PLUGIN_DRAW
    comment = "This plugin does nothing useful"
    help = "No help is needed"
    wanted_name = "Example"
    wanted_hotkey = "Alt-F11"

    def init():

icecr4ck

IDAPython cheatsheet

Important links

• Porting IDAPython plugins to IDA 7.4
• Hex-Rays IDAPython official documentation

Basic commands

Get informations on the binary

icecr4ck

{
	"Miasm\\IR graph" : "Ctrl+Shift+M",
	"Miasm\\IR graph (simplified)" : "Ctrl+Shift+I",
	"Disassembly Graph" : "Ctrl+Shift+G",
	"Hex Editor" : "Ctrl+Shift+H",
	"Strings" : "Ctrl+Shift+S",
	"Triage Summary" : "Ctrl+Shift+T"
}