lallousx86

// https://support.microsoft.com/en-us/help/323809/how-to-get-information-from-authenticode-signed-executables
#include <windows.h>
#include <wincrypt.h>
#include <wintrust.h>
#include <stdio.h>
#include <tchar.h>

#pragma comment(lib, "crypt32.lib")

lallousx86

#
# Export marked location sorted by their address
#

# Get marked locations
Locs = []
idx = 0
while True:
    s = idc.GetMarkComment(idx)
    if s is None:

lallousx86

//-------------------------------------------------------------------------
PDWORD FindFuncEATAddressSlot(
    HMODULE hModule,
    LPCSTR FuncName)
{
    if (hModule == nullptr)
        return nullptr;

    ULONG_PTR Base = ULONG_PTR(hModule);

lallousx86

 public static class ListViewExtensions
    {
        public static string GetItemsString(
            this System.Windows.Forms.ListViewItem lvi,
            string SurroundL = "\"",
            string SurroundR = "\"",
            string Join = "\t")
        {
            List<string> s = new List<string>();
            foreach (System.Windows.Forms.ListViewItem.ListViewSubItem CurSub in lvi.SubItems)

lallousx86

    public static class XmlExtensions
    {
        static public string GetAttrValue(
            this XmlNode node, 
            string AttrName)
        {
            try
            {
                return node.Attributes[AttrName].Value;
            }

lallousx86

import idaapi
import idautils
import idc

def get_rop_gadget_string(addr):
    gb = []

    while True:
        # Decode
        i = idautils.DecodeInstruction(addr)