Skip to content

Instantly share code, notes, and snippets.

@lucasg
lucasg / ida_get_guid.py
Created June 13, 2019 14:43
Read memory as GUID via IDA
import ida_bytes
import binascii
def get_guid(address):
data1 = ida_bytes.get_dword(address)
data2 = ida_bytes.get_word(address + 4)
data3 = ida_bytes.get_word(address + 6)
data4 = ida_bytes.get_bytes(address + 8, 8)
@lucasg
lucasg / apiset_extension.h
Created March 27, 2019 23:51
SSTIC 2019 article appendix
// ApisetExtension.h
#pragma once
typedef struct _API_SET_EXTENSION {
API_SET_NAMESPACE Namespace;
API_SET_NAMESPACE_ENTRY Entry;
API_SET_VALUE_ENTRY ValueEntry;
} API_SET_EXTENSION, *PAPI_SET_EXTENSION;
typedef struct _API_SET_NAMES {
@lucasg
lucasg / fancy_aes.py
Last active June 17, 2018 09:33
SSTIC 2018 Level 4 exploit script
sbox = (0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5,
0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0,
0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc,
0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a,
0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0,
0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
@lucasg
lucasg / download_pdb_database.py
Created January 16, 2018 10:21
Download pdb and PE files from microsoft symbol store
import os
import re
import sys
import logging
import argparse
import subprocess
import requests
@lucasg
lucasg / apisetlookup.c
Last active November 9, 2023 10:14
Api set library lookup resolver
#include <windows.h>
#include <stdint.h>
#include <stdbool.h>
#include <stdio.h>
#include <sal.h>
#include <assert.h>
#ifdef _X86_
#error "This snippet only build in 64-bit due to heavy use of uintptr arithmetics."
#endif
@lucasg
lucasg / dash-doggybag.py
Last active March 3, 2024 20:03
Bulk downloader for dash docsets (official and user contributed)
#!/usr/bin/env python3
import sys
import json
import os
import os.path
import shutil
import logging
import tempfile
import glob
import argparse
@lucasg
lucasg / gtk_popup_makefile
Created August 27, 2014 15:02
gtk_popup_makefile
ARCH = win
# lin osx
GTK_ROOT_FOLDER = "F:/dev/gtk"
TARGET = bug.exe
COMP = gcc
# COMP = g++
@lucasg
lucasg / gtk_popup
Created August 27, 2014 15:01
gtk popup whose entries are being masked when pressing TAB
#include <gtk/gtk.h>
#include <glib/gstdio.h>
/*
* Network Configuration window being popped-up
*/
typedef struct network_conf_t
{
GtkWidget *window ;
GtkWidget *vbox_frames ;
@lucasg
lucasg / Worksheet generation
Created April 22, 2014 12:51
Worksheet generation for stackoverflow question (using python)
from itertools import chain
import random
import json
import xlwt
'''
Constraints needed to be fullfilled
'''
scenarios = {
import ttk
import Tkinter as tk
def insert_message(columns, (user,message,time), messageid):
for col, var in zip(columns, (user,message,time) ):
col.insert("", "end", "", values=(var,), tags=(messageid))