ergot86

What to debug?

Hyper-v worker process

• User mode debugging (easy).
• Symbols available.
• Attack surface: mostly Gen-1 VMs, device emulation, x86 emulation (for MMIO accesses).

Debugging options:

1. Attach to running process with WinDbg.

hugsy

#
# Port to binary ninja of the script written during the Off-by-One Security stream 
# (https://youtu.be/FnIQTL9w-Ow) to synchronize GEF with Binary Ninja
# Requires `rpyc` and `pygments`
#
# In IDA, first download and load https://gist.githubusercontent.com/hugsy/714e0038d5d0b1deb7fad1907928252f/raw/87bd608a859c1699f9fc2fb556394d618747bdc8/binja_rpyc_snippet.py
#
# @_hugsy_
#
import rpyc

anthonyprintup

// Created by Anthony Printup on 4/21/2023.
#pragma once

#include <algorithm>
#include <bitset>
#include <cstdint>
#include <exception>
#include <functional>
#include <ranges>

Washi1337

using System.Text;
using AsmResolver;
using AsmResolver.DotNet;
using AsmResolver.DotNet.Builder.Metadata.Blob;
using AsmResolver.DotNet.Builder.Metadata.Strings;
using AsmResolver.DotNet.Code.Cil;
using AsmResolver.DotNet.Signatures;
using AsmResolver.IO;
using AsmResolver.PE;
using AsmResolver.PE.DotNet.Builder;

HACKE-RC

Common calling conventions

• cdecl
• fastcall
• stdcall

CDECL calling convention.

cdecl stands for "C declaration", it is used by most c compiler in the x86 architecture.

Arguments passing in cdecl calling convention

kconner

macOS Internals

Understand your Mac and iPhone more deeply by tracing the evolution of Mac OS X from prelease to Swift. John Siracusa delivers the details.

Starting Points

How to use this gist

You've got two main options:

SeanPesce

// Author: Sean Pesce
//
// Manual implementations of the CONCAT operations produced by the Ghidra decompiler.
// These definitions are helpful for compiling re-implementations of native code using
// decompiler output (e.g., with gcc).
//
// Note that these implementations would be outperformed by minimal C preprocessor macros
// that replicate the same logic.

mmozeiko

This downloads standalone 64-bit MSVC compiler, linker & other tools, also headers/libraries from Windows SDK into portable folder, without installing Visual Studio. Has bare minimum components - no UWP/Store/WindowsRT stuff, just files & tools for 64-bit native desktop app development.

Run python.exe portable-msvc.py and it will download output into msvc folder. By default it will download latest available MSVC & Windows SDK - currently v14.32.17.2 and v10.0.22621.0.

You can list available versions with python.exe portable-msvc.py --show-versions and then pass versions you want with --msvc-version and --sdk-version arguments.

To use cl.exe/link.exe from output folder, first run setup.bat - after that PATH/INCLUDE/LIB env variables will be setup to use all the tools as usual. You can also use clang-cl.exe with these includes & libraries.

To use clang-cl.exe without running setup.bat, pass extra /winsysroot msvc argument (msvc is folder name where output is stored).

edygert

# Script author: Matt Graeber (@mattifestation)
# logman start AMSITrace -p Microsoft-Antimalware-Scan-Interface Event1 -o AMSITrace.etl -ets
# Do your malicious things here that would be logged by AMSI
# logman stop AMSITrace -ets

$OSArchProperty = Get-CimInstance -ClassName Win32_OperatingSystem -Property OSArchitecture
$OSArch = $OSArchProperty.OSArchitecture

$OSPointerSize = 32
if ($OSArch -eq '64-bit') { $OSPointerSize = 64 }

ek0

// adder.cpp : This file contains the 'main' function. Program execution begins and ends there.
//

#include <iostream>
#include <cstdint>
#include <intrin.h>
//#include <mmintrin.h>
//#include <emmintrin.h>

uint64_t add(uint64_t a, uint64_t b)