mabj

#!/usr/bin/env python
# -*- coding: utf-8 -*-
from lief import PE

# Constants
IMAGE_BASE = 0x02060000
ENTRY_POINT_OFFSET = 0x734
CODE_PAYLOAD_FILE = 'explorer_02060000.bin'
DATA_PAYLOAD_FILE = 'explorer_00B60000.bin'
FILE_ALIGNMENT = 0x200

mabj

############################################################################################
##
## One-Click Hex Copy!
##
## Updated for IDA 7.xx
##
## All credit for actual IOCTL decode logic:
##      http://www.osronline.com/article.cfm?article=229
##
## Big thanks to @gaasedelen for the IDA 7 update ideas:

mabj

#define _WIN32_WINNT 0x0501
#define _GLIBCXX_USE_C99 1

#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
#include <iostream>
#include <string>
#include <sstream>

mabj

class Compressor:
    def init(level):
        buffer = List(level*2)

    def add(element):
        tmp = None
        if not element:
            return tmp

        if len(buffer) == level*2:

mabj

compressors = []
for i in range(1,level):
    compressors.append(Compressor(i))
for e in data:
    e1 = checksum(e)
    c = compressors[0]
    out = c.add(e1)
    for c in compressor[1:]:
        out = c.add(out)

mabj

['call_0', 'call_1', 'call_2', 'call_2', 'call_2', 'call_2', 'call_0', 'call_1', 'call_2', 'call_2', 'call_2', 'call_2']
[{'label': 'call_0', 'repeated': 2}, {'label': 'call_1', 'repeated': 2}, {'label': 'call_2', 'repeated': 8}]

mabj

import os
import sys
import logging
import hashlib
import numpy
from random import randint

from itertools import groupby, chain

logger = logging.getLogger(__name__)

mabj

data = [0, 1, 2, 2, 2, 2, 0, 1, 2, 2, 2, 2]
lrs = calculate_lrs(data)  # [0, 1, 2, 2, 2, 2]  <= First While
       
while lst:
    lrs = calculate_lrs()
# [2, 2]                                         <= Second while

mabj

data = []
for entry in log_entries:
    c = checksum(entry)
    data.append(c)

map = {}
lrs = True
while lrs:
    lrs = calculate_lrs(data)
    while lrs:

mabj

(line1, c_001)
(line3, c_002) x5
(line4, c_003) x5
(line6, c_004) x3
(line7, c_005)