- target: 856 binaries in
/bin
name | frequency (%) | cumulative (%) |
---|---|---|
ld | 14.101200487156945 | 14.101200487156945 |
mv | 10.010240605850349 | 24.111441093007294 |
addi | 9.590532965163105 | 33.7019740581704 |
sd | 8.400851481380371 | 42.10282553955077 |
private rule Macho | |
{ | |
meta: | |
description = "private rule to match Mach-O binaries" | |
condition: | |
uint32(0) == 0xfeedface or uint32(0) == 0xcefaedfe or uint32(0) == 0xfeedfacf or uint32(0) == 0xcffaedfe or uint32(0) == 0xcafebabe or uint32(0) == 0xbebafeca | |
} | |
rule macos_pirrit_install_flash | |
{ |
#include <stdio.h> | |
#include <stdint.h> | |
__attribute__((noinline)) | |
uint64_t ubfx(uint64_t src) { | |
uint64_t ret = 0x5555555555555555; | |
asm volatile ("ubfx %0, %1, #4, #24" | |
: "=r"(ret) | |
: "r"(src)); | |
return ret; |
Windows Registry Editor Version 5.00 | |
[HKEY_CURRENT_USER\Software\Microsoft\Windbg\Workspaces] | |
"Default"=hex:57,44,57,53,01,00,00,00,33,00,00,00,68,00,5c,00,f3,ff,ff,ff,00,\ | |
00,00,00,00,00,00,00,00,00,00,00,90,01,00,00,00,00,00,00,03,02,01,31,43,00,\ | |
6f,00,6e,00,73,00,6f,00,6c,00,61,00,73,00,00,00,00,00,00,00,00,00,00,00,00,\ | |
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ | |
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,02,00,10,00,04,00,19,\ | |
19,19,00,00,00,00,00,01,00,02,00,10,00,04,00,cf,ce,9a,00,00,00,00,00,02,00,\ | |
02,00,10,00,04,00,6f,6d,7e,00,00,00,00,00,03,00,02,00,10,00,04,00,cf,ce,9a,\ |
#include <iostream> | |
#include <Windows.h> | |
#include <vector> | |
#include <algorithm> | |
class OffsetTracker | |
{ | |
std::vector<int> offsets; | |
public: |
diff --git a/src/PE/Binary.cpp b/src/PE/Binary.cpp | |
index 0884c625..34e881bf 100644 | |
--- a/src/PE/Binary.cpp | |
+++ b/src/PE/Binary.cpp | |
@@ -1,5 +1,5 @@ | |
-/* Copyright 2017 R. Thomas | |
- * Copyright 2017 Quarkslab | |
+/* Copyright 2017 - 2021 R. Thomas | |
+ * Copyright 2017 - 2021 Quarkslab | |
* |
.global _main | |
.p2align 4 | |
_main: | |
adr x0, shell | |
mov x1, 0 | |
mov x2, 0 | |
mov x16,#0x3b | |
svc #0x80 | |
ret |
#include <Windows.h> | |
#include <stdio.h> | |
int main() { | |
int a; | |
__asm { | |
fldz; | |
fstenv ss : [esp - 0xc]; | |
pop eax; | |
mov a, eax; |
#include <stdio.h> | |
#include <cpuid.h> | |
#include <stdint.h> | |
int cpu_supports_cet_shadow_stack() { | |
uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0; | |
__cpuid_count(7, 0, eax, ebx, ecx, edx); | |
return (ecx & (1 << 7)) != 0; | |
} |
#include <stdio.h> | |
#include <stdlib.h> | |
#include <sys/stat.h> | |
#include "openssl/err.h" | |
#include "openssl/objects.h" | |
#include "openssl/evp.h" | |
#include "openssl/x509.h" | |
#include "openssl/pkcs7.h" | |
#include "openssl/pem.h" |