idiom

import "dotnet"
rule net_reactor_obfuscated {
    strings:
        $s1 = "#GUlD" fullword
        $s2 = "#GUID" fullword
        $s3 = "#Blop" fullword
        $s4 = "#Blob" fullword
    condition:
        dotnet.is_dotnet and all of them
}

idiom

enum XLoaderStrings
{
  USERNAME = 0x0,
  LOCALAPPDATA = 0x1,
  USERPROFILE = 0x2,
  APPDATA = 0x3,
  TEMP = 0x4,
  ProgramFiles = 0x5,
  CommonProgramFiles =0x6,
  ALLUSERSPROFILE = 0x7,

idiom

import ida_kernwin

registered_actions = ida_kernwin.get_registered_actions()

for action_name in registered_actions:
    print(f'name: {action_name}')
    print(f'label: {ida_kernwin.get_action_label(action_name)}')
    print(f'icon: {ida_kernwin.get_action_icon(action_name)}')
    print(f'tooltip: {ida_kernwin.get_action_tooltip(action_name)}')
    print(f'state: {ida_kernwin.get_action_state(action_name)}')

idiom

def add_bookmark(offset, comment, check_duplicate=True):
        """

        :param offset:
        :param comment:
        :param check_duplicate:
        :return:
        """
        for bslot in range(0, 1024, 1):
            slotval = idc.get_bookmark(bslot)

idiom

References

• https://github.com/byt3bl33d3r/OffensiveNim
• https://ajpc500.github.io/nim/Shellcode-Injection-using-Nim-and-Syscalls/
• https://github.com/khchen/winim/blob/master/winim/inc/windef.nim

idiom

Contents

1. Web Analysis Tools
2. Analysis Librarys
3. Ida Plugins
4. File Formats
5. Yara
6. File Id and labelling
7. Reverse Engineering Papers

---

Web Analysis Tools

idiom

import sys

"""
NTCreateFile DesiredAccess Masks

0x120189
0x100181
0x12019f
0x1200a0

idiom

`C:\Program Files\IDA Pro 7.4\python\3\idc.py:5121: SyntaxWarning: "is not" with a literal. Did you mean "!="?
  if newtype is not '':`
  

--- FIX --- 
To resolve the above error change line 5121 to 
 
`if newtype is not None:`
 

idiom

rule cve_2017_8759{
meta:
sample = "0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684"
strings:
$header = "{\\rt"
$wsdl = "7700730064006C003D006800740074007000"
condition:
$header in (0..50) and $wsdl
}

idiom

function B(C){
	var D = new ActiveXObject("CDO.Message");
	var E = D.BodyPart;
	E.ContentTransferEncoding = "base64";
	E.Charset = "windows-1251";
	var F = E.GetEncodedContentStream();
	F.WriteText(C);
	F.Flush();
	F = E.GetDecodedContentStream();
	F.Charset = "utf-8";