Skip to content

Instantly share code, notes, and snippets.

View mabj's full-sized avatar

Marcos Álvares mabj

18 followers · 4 following
View GitHub Profile
@mabj
mabj / calls_compression_pseudo_003.py
Last active January 12, 2020 23:33
class Compressor:
def init(level):
buffer = List(level*2)
def add(element):
tmp = None
if not element:
return tmp
if len(buffer) == level*2:
@mabj
mabj / calls_compression_snip_004.py
Created January 10, 2020 12:22
class NGram:
def __init__(self, order):
self.order = order
self.buffer = []
def add(self, element):
tmp = None
if not element:
return tmp
@mabj
mabj / calls_compression_snip_004_output.txt
Created January 10, 2020 12:23
[INFO] [2020-01-08 16:37:03,477] <module>(): [+] Original buffer: ['0', '1', '2', '2', '2', '2', '0', '1', '2', '2', '2', '2']
[INFO] [2020-01-08 16:37:03,477] <module>(): [+] Compressed list: [['0', 2], ['1', 2], ['2', 8]]
[INFO] [2020-01-08 16:37:03,477] <module>(): [+] Compression rate: 75.00%
@mabj
mabj / calls_compression_looper.cpp
Created January 13, 2020 11:32
#define _WIN32_WINNT 0x0501
#define _GLIBCXX_USE_C99 1
#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
#include <iostream>
#include <string>
#include <sstream>
@mabj
mabj / HexCopy.py
Created June 6, 2020 14:32 — forked from herrcore/HexCopy.py
IDA Plugin for quickly copying disassembly as encoded hex bytes (updated for IDA 7xx)
############################################################################################
##
## One-Click Hex Copy!
##
## Updated for IDA 7.xx
##
## All credit for actual IOCTL decode logic:
## http://www.osronline.com/article.cfm?article=229
##
## Big thanks to @gaasedelen for the IDA 7 update ideas:
@mabj
mabj / smokeloader_pe.py
Created June 10, 2020 16:11
#!/usr/bin/env python
# -*- coding: utf-8 -*-
from lief import PE
# Constants
IMAGE_BASE = 0x02060000
ENTRY_POINT_OFFSET = 0x734
CODE_PAYLOAD_FILE = 'explorer_02060000.bin'
DATA_PAYLOAD_FILE = 'explorer_00B60000.bin'
FILE_ALIGNMENT = 0x200