Skip to content

Instantly share code, notes, and snippets.

Keybase proof

I hereby claim:

  • I am learn-more on github.
  • I am learn_more (https://keybase.io/learn_more) on keybase.
  • I have a public key ASCbRTPJzY3UgD4_e0862d4vS13CANf49qaDZbvGxaRU0go

To claim this, I am signing this object:

@learn-more
learn-more / dump_imports.py
Created April 20, 2020 20:28
Dump unique imported modules
import sys
import pefile
import glob
import os
def main(base_dir):
print('Printing the first occurence of an import from', base_dir)
known_imports = []
for filename in glob.iglob(os.path.join(base_dir, '**', '*.exe'), recursive=True):
#include <windows.h>
#include <objbase.h>
#include <shlobj.h>
#include <shlwapi.h>
#include <shellapi.h>
#include <atlbase.h>
#include <atlcom.h>
#include <atlwin.h>
#include <atlsimpcoll.h>
@learn-more
learn-more / analyze_binaries.py
Created June 10, 2017 19:43
Analyze ReactOS binaries from a build dir
import sys
import os
import re
import pefile
CMAKE_PREFIX = '# Install script for directory: '
MANIFEST_DIR = pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_RESOURCE']
IMPORT_DIR = pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_IMPORT']
MANIFEST_ID = pefile.RESOURCE_TYPE['RT_MANIFEST']
INCLUDE_FILES = ('.exe', '.dll', '.acm', '.ax', '.cpl', '.drv', '.ocx')
@learn-more
learn-more / rossym-py3.py
Last active November 24, 2022 08:20
rossym plugin for ida
'''
PROJECT: ReactOS RosSym IDA Extension - python 3.x
LICENSE: MIT (https://spdx.org/licenses/MIT)
PURPOSE: Decode RosSym symbols
COPYRIGHT: Copyright 2017-2019 Mark Jansen (mark.jansen@reactos.org)
'''
import idaapi
import idautils
import struct
import ctypes
@learn-more
learn-more / dump_IPropertyStore.cpp
Last active August 24, 2018 14:01
dump IPropertyStore
#include <atlbase.h>
#include <atlcom.h>
#include <atlcomcli.h>
#include <comdef.h>
#include <Propvarutil.h>
#include <shobjidl.h>
#include <atlsafe.h>
#include <strsafe.h>
#pragma comment(lib, "Propsys.lib")