mrexodia

<?xml version="1.0" encoding="UTF-8"?>
<ufwb version="1.9">
    <grammar name="Decrypted iTunes Library" start="id:148" author="Mr. eXoDia" email="mr.exodia.tpodt@gmail.com" fileextension="itl" uti="com.apple.itunes.db">
        <description>Grammar for decrypted iTunes Library files.</description>
        <structure name="Defaults" id="149" repeatmin="0" repeatmax="-1" encoding="ISO_8859-1:1987" endian="little" signed="no"/>
        <structure name="iTunes Library" id="148" repeatmin="0" repeatmax="-1" extends="id:149" order="variable">
            <structref name="hdfm" id="152" repeatmin="0" repeatmax="-1" structure="id:151"/>
            <structref name="msdh" id="154" repeatmin="0" repeatmax="-1" structure="id:153"/>
        </structure>
        <structure name="hdfm" id="151" length="this.headerLength" repeatmin="0" repeatmax="-1" extends="id:149" endian="big">

mrexodia

#include <winsock2.h>
#include <windows.h>
#include <ws2tcpip.h>
#pragma comment(lib, "Ws2_32.lib")

/*
THIS IS FOR DEBUGGING ONLY, DO NOT RUN THIS CODE IN PRODUCTION UNDER ANY CIRCUMSTANCE!
https://github.com/dev-frog/C-Reverse-Shell/blob/master/re.cpp
https://github.com/tudorthe1ntruder/reverse-shell-poc/blob/master/rs.c
https://eternallybored.org/misc/netcat/

mrexodia

<?xml version="1.0" encoding="UTF-8"?>
<ufwb version="1.9">
    <grammar name="Encrypted iTunes Library" start="id:4" author="Mr. eXoDia" email="mr.exodia.tpodt@gmail.com" fileextension="itl" uti="com.apple.itunes.db">
        <description>Grammar for encrypted iTunes Library files.</description>
        <structure name="Defaults" id="5" encoding="ISO_8859-1:1987" endian="little" signed="no"/>
        <structure name="iTunes Library" id="4" extends="id:5">
            <structref name="hdfm" id="8" structure="id:7"/>
            <binary name="encryptedData" id="9" length="remaining">
                <description>This chunk of data is encrypted using AES/ECB/NoPadding with the key &quot;BHUILuilfghuila3&quot;. After decryption, you have to inflate the data using ZLIB.

mrexodia

//
// An implementation of GetModuleHandle and GetProcAddress that works with manually mapped modules, forwarded exports,
// without a CRT standard library, and uses no Windows API or dependencies.
//
// Author: Bill Demirkapi
// License: MIT, appended at the bottom of this document if you care about licensing and want to credit me in your own project.
//

#include <Windows.h>
#include <winternl.h>

mrexodia

# Website: https://software.intel.com/content/www/us/en/develop/articles/pin-a-binary-instrumentation-tool-downloads.html
# License: https://software.intel.com/sites/landingpage/pintool/pinlicense.txt
# This snippet: https://gist.github.com/mrexodia/f61fead0108603d04b2ca0ab045e0952
# TODO: lunix support

# Thanks to Francesco for showing me this method
CPMAddPackage(
    NAME IntelPIN
    VERSION 3.18
    URL https://software.intel.com/sites/landingpage/pintool/downloads/pin-3.18-98332-gaebd7b1e6-msvc-windows.zip

mrexodia

// Emulate IDA's xref window
//@author Duncan Ogilvie
//@category Analysis
//@keybinding X
//@menupath Navigation.IDA References
//@toolbar
// Reference: https://www.reddit.com/r/ghidra/comments/h07yoo/comment/fukuj1c

import ghidra.app.cmd.data.CreateArrayCmd;
import ghidra.app.decompiler.ClangFuncNameToken;

mrexodia

<?xml version="1.0" encoding="UTF-8" ?> 

<bzexclusions>

<!-- Editable Exclusions: You may edit this file.  WARNING: ONLY FOR ADVANCED USERS! -->
<!--                      To restore the defaults, remove this file (it will return).-->
<!--                                                                                 -->
<!-- Rule 1: All the excludefname_rule below are case insensitive.                   -->
<!--                                                                                 -->
<!-- Rule 2: a file must match ALL criteria on the line to be excluded from backup.  -->

mrexodia

#include <cstdio>
#include <cstdint>
#include <cstring>
#include <type_traits>

#include <Windows.h>

void read_memory(const void* address, void* dst, size_t len)
{
    printf("read_memory(%p, %zu)\n", address, len);

mrexodia

ClearTypes

AddStruct ST
AppendMember char, a
AppendMember int, y
SizeofType ST
VisitType ST

AddType "unsigned int", DWORD
SizeofType DWORD

mrexodia

#include <windows.h>
#include <stdio.h>

int gtfo(const char* text = "")
{
    printf("gtfo! (%s)\n", text);
    return -1;
}

int main(int argc, char* argv[])