Josh R. jershmagersh

## 3hr_workshop.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                jershmagersh
                / 3hr_workshop.md
            
            
              Created
              April 3, 2024 15:51
            
              
                3hr_workshop.md
              
          
30 min - Introducing Workshop Resources and Content 


The workshop will begin by familiarizing participants with the tools used in the workshop, including:


Binary Ninja (https://binary.ninja/) and Binary Ninja’s user-interface (UI) components that we will be using throughout the workshop (mainly the disassembler, decompiler, Python REPL, and scripting interfaces)


Binary Ninja’s Decompiler, which uses Binary Ninja Intermediate Languages (BNILs - https://docs.binary.ninja/dev/bnil-overview.html). These BNILs will be used to assist with understanding disassembled instructions during our reverse engineering process


## generate_api_code_with_db_context.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              1 star
            
          
                jershmagersh
                / generate_api_code_with_db_context.md
            
            
              Last active
              February 26, 2024 01:54
            
          
    Can you write Python that extracts the copied_alphabet string from the __builtin_strncpy in this function and uses it to decrypt data wtihin the dec_sc_buff variable using the binary ninja API? 👤
🤖 To extract the copied_alphabet string and decrypt data within the dec_sc_buff variable using the Binary Ninja API, you can follow these steps:
Extract the copied_alphabet string directly from the provided HLIL.
Implement the decryption logic based on the operation described in the HLIL for modifying dec_sc_buff.
Use the Binary Ninja API for any additional operations needed.
Here is a Python example that accomplishes this:

  
## sidekick_writing_api.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                jershmagersh
                / sidekick_writing_api.md
            
            
              Last active
              February 24, 2024 23:48
            
          
    How can I recursively get a highlevelil.HighLevelILCall from a nested set of operands? 👤
🤖 To recursively get a HighLevelILCall from a nested set of operands in a High-Level Intermediate Language (HLIL) instruction, you can define a recursive function that traverses the operands of each instruction. If an operand is itself an instruction (which is common in HLIL, where operands can be complex expressions), the function recursively examines it until it finds an instruction of type HighLevelILCall. Here's how you could implement such a function:
import binaryninja
from binaryninja.highlevelil import HighLevelILInstruction, HighLevelILOperation

def find_hlil_call_recursively(instr):
   # Base case: If the instruction is a call, return it


## RC4.c
/*
    robin verton, dec 2015
    implementation of the RC4 algo
*/

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

#define N 256   // 2^8

## hooks.cpp
    /* place hooks and track PE section */
    HOOK_GET_ORIG(this, "ntdll.dll", NtProtectVirtualMemory);
    HOOK_GET_ORIG(this, "ntdll.dll", NtWriteVirtualMemory);
    HOOK_GET_ORIG(this, "ntdll.dll", NtCreateThread);
    HOOK_GET_ORIG(this, "ntdll.dll", NtMapViewOfSection);
    HOOK_GET_ORIG(this, "ntdll.dll", NtResumeThread);
    HOOK_GET_ORIG(this, "ntdll.dll", NtDelayExecution);
    HOOK_GET_ORIG(this, "ntdll.dll", NtAllocateVirtualMemory);
    HOOK_GET_ORIG(this, "Kernel32.dll", CreateProcessInternalW);

## gist:446a1f01d8cca8e7fc0c
private void btnDecode_Click(object sender, EventArgs e)
{
	this.pbRoge.Image = Resources.bob_roge;
	byte[] dat_secret = Resources.dat_secret;
	string text = "";
	for (int i = 0; i < dat_secret.Length; i++)
	{
		byte b = dat_secret[i];
		text += (char)((b >> 4 | ((int)b << 4 & 240)) ^ 41);
	}

## ex.c
#include <stdio.h>
#include <string.h>

int main(int argc, char ** argv) {

    const char dat_secret[] = "// dat_secret = System.IO.MemoryStream";
    long int secret_len = strlen(dat_secret);

    char text[secret_len];


## generate.rb
#!/usr/bin/ruby

$UPLOAD_DIR = "/var/www/uploads"
$HOME = "/var/www"

files = Dir.entries $UPLOAD_DIR

files.each do |file|
	if file.to_s.include? ".mp4"
		html_file_name = "#{file[0,file.length-4]}.html"

## admin_dlink.html
<html>
<head>
<meta http-equiv=Content-Type content="no-cache">
<meta http-equiv=Content-Type content="text/html; charset=utf-8">

<title>D-LINK SYSTEMS, INC | WIRELESS ROUTER | HOME</title>
<script>

-snip-

## gist:6749314
Here's the first few lines found:

Josh:vulnSpider jr$ ruby vulnSpider.rb
Would you like to search for plugins?
y
Getting most popular tags...
Starting with the most popular: widget
Grabbing links...

Plugin: Image Store
	/*
	robin verton, dec 2015
	implementation of the RC4 algo
	*/

	#include <stdio.h>
	#include <string.h>
	#include <stdlib.h>

	#define N 256 // 2^8
	/* place hooks and track PE section */
	HOOK_GET_ORIG(this, "ntdll.dll", NtProtectVirtualMemory);
	HOOK_GET_ORIG(this, "ntdll.dll", NtWriteVirtualMemory);
	HOOK_GET_ORIG(this, "ntdll.dll", NtCreateThread);
	HOOK_GET_ORIG(this, "ntdll.dll", NtMapViewOfSection);
	HOOK_GET_ORIG(this, "ntdll.dll", NtResumeThread);
	HOOK_GET_ORIG(this, "ntdll.dll", NtDelayExecution);
	HOOK_GET_ORIG(this, "ntdll.dll", NtAllocateVirtualMemory);
	HOOK_GET_ORIG(this, "Kernel32.dll", CreateProcessInternalW);
	private void btnDecode_Click(object sender, EventArgs e)
	{
	this.pbRoge.Image = Resources.bob_roge;
	byte[] dat_secret = Resources.dat_secret;
	string text = "";
	for (int i = 0; i < dat_secret.Length; i++)
	{
	byte b = dat_secret[i];
	text += (char)((b >> 4 \| ((int)b << 4 & 240)) ^ 41);
	}
	#include <stdio.h>
	#include <string.h>

	int main(int argc, char ** argv) {

	const char dat_secret[] = "// dat_secret = System.IO.MemoryStream";
	long int secret_len = strlen(dat_secret);

	char text[secret_len];
	#!/usr/bin/ruby

	$UPLOAD_DIR = "/var/www/uploads"
	$HOME = "/var/www"

	files = Dir.entries $UPLOAD_DIR

	files.each do \|file\|
	if file.to_s.include? ".mp4"
	html_file_name = "#{file[0,file.length-4]}.html"
	<html>
	<head>
	<meta http-equiv=Content-Type content="no-cache">
	<meta http-equiv=Content-Type content="text/html; charset=utf-8">

	<title>D-LINK SYSTEMS, INC \| WIRELESS ROUTER \| HOME</title>
	<script>

	-snip-
	Here's the first few lines found:

	Josh:vulnSpider jr$ ruby vulnSpider.rb
	Would you like to search for plugins?
	y
	Getting most popular tags...
	Starting with the most popular: widget
	Grabbing links...

	Plugin: Image Store