Skip to content

Instantly share code, notes, and snippets.

View neomafo88's full-sized avatar
🏠
Remote

Neoma Fong neomafo88

🏠
Remote
View GitHub Profile
@domenukk
domenukk / funsafe.sh
Last active August 21, 2023 03:14
Funsafe Rust Jail (for HackIM CTF 2023)
#!/bin/bash
echo "Your code please."
FOLDER=$(mktemp -d)
cp flag.txt "$FOLDER"
cd "$FOLDER"
mkdir src
cat <<EOF > Cargo.toml
[package]
name = "funsafe"
@X-Junior
X-Junior / Statc_Stealer.py
Created August 16, 2023 16:09
Statc Stealer String Decryptor
import struct , sys , pefile , validators , re , base64
from capstone import *
from capstone.x86 import *
'''
Author: Mohamed Ashraf (@X__Junior)
Usage:
python3 Statc_Stealer.py path_to_sample
'''
@0xdevalias
0xdevalias / _deobfuscating-unminifying-obfuscated-web-app-code.md
Last active June 13, 2024 23:41
Some notes and tools for reverse engineering / deobfuscating / unminifying obfuscated web app code
@aemmitt-ns
aemmitt-ns / ida.rs
Last active June 5, 2023 16:39
use radius2 api to solve IDA ctf challenge
use radius2::{Radius, RadiusOption, State, vc};
fn main() {
let options = [RadiusOption::SimAll(true)];
let mut radius = Radius::new_with_options(Some("challenge"), &options);
let mut state = radius.callsym_state("main");
let flag = state.symbolic_value("flag", 8*0x18);
state.constrain_bytes(&flag, "[ -~]");
radius.set_argv_env(&mut state, &[vc(0), flag.clone()], &[]);
@DavidBuchanan314
DavidBuchanan314 / widevine_fixup.py
Last active April 24, 2024 06:24
Patch aarch64 widevine blobs from ChromeOS to work on non-ChromeOS linux, including platforms with 16K page size like Apple Silicon / Asahi Linux
"""
MIT License
Copyright (c) 2023 David Buchanan
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
@shawwn
shawwn / llama_sizes.txt
Created March 5, 2023 18:07
The size of each file distributed with LLaMA, for reference. See https://github.com/shawwn/llama-dl
./tokenizer_checklist.chk 50
./tokenizer.model 499723
./7B/checklist.chk 100
./7B/consolidated.00.pth 13476939516
./7B/params.json 101
./13B/checklist.chk 154
./13B/consolidated.00.pth 13016334699
./13B/consolidated.01.pth 13016334699
./13B/params.json 101
./30B/checklist.chk 262
from base64 import b64decode
from Crypto.Cipher import ARC4
#s = "mpntingadxedMTBjMDc2NGZiNDNiOTYzMjk3NjhkZTRmM2ZlOWMyMGE5NDAwMGUwMzFmMmQ0ZGIxMDdlOGY3ODE4ZWJlMGVhNzlhNTQ="
s = "wfycyqhbrwfxMWFjMWYxOGM1MjljZDI1M2UxNjUzNDY2ZTRlNDYwNDk5MWUxYjc2OTVjODc2YWYxOTI0YTgxYzUwMWQ4NGUzZGIxZjYwMGVjZWViNDhkYTYyMTkyNjQ0MjllYzhhMDUyZjg2MGM3NGEyYjZkYmU="
def decrypt_string(s):
key = s[:12].encode()
data = bytes.fromhex(b64decode(s[12:]).decode())
c = ARC4.new(key=key)
@tahaconfiant
tahaconfiant / shlayer_decrypt.py
Created December 23, 2022 15:14
command line script to decrypt OSX/Shlayer.F C2 configuration
# author : taha@confiant.com aka lordx64
# OSX/Shlayer.F C2 config extracting from DMG files
# copyright 2022 - All rights reserved
# compatible python 3.8
# Note on installation on mac:
# brew install gmp
# then: env "CFLAGS=-I/usr/local/include -L/usr/local/lib" pip3 install pycrypto
from Crypto.Cipher import AES
import argparse
@0xca7
0xca7 / gist:696e4e65f72c9aac442340c9d7ef9131
Created December 23, 2022 09:54
highlight and decrypt strings in recordbreaker malware
//TODO recordbreaker string decryption via selection
//Applied to sample: 746669c6be1807fdafbc7ee3f1e958e1b584fa31688742bcc044d269af94b0d8 (sha256)
//@author 0xca7
//@category _NEW_
//@keybinding
//@menupath
//@toolbar
import ghidra.app.script.GhidraScript;
import ghidra.program.model.mem.*;