Skip to content

Instantly share code, notes, and snippets.

Avatar

Nir nirizr

View GitHub Profile
@nirizr
nirizr / idatag.py
Last active Oct 26, 2021
Force IDA's G (goto) dialog to ignore the backtick/tag marker used in windbg when one copies and pastes
View idatag.py
try:
from PyQt5.QtWidgets import qApp, QTextEdit, QLineEdit, QComboBox, QPushButton
except ImportError:
from PySide.QtGui import qApp, QTextEdit, QLineEdit, QComboBox, QPushButton
def handle_tags(text):
# text handling is actually done here.
# we could improve this by doing something more clever than just a replace
# say, extend when ` are present without the full 8 bytes following, or
@nirizr
nirizr / full_upsert.py
Last active May 18, 2022
sqlalchemy upsert supporting delayed ORM insertion and duplicate removal (inside a single query)
View full_upsert.py
def upsert(session, model, rows):
table = model.__table__
stmt = postgresql.insert(table)
primary_keys = [key.name for key in inspect(table).primary_key]
update_dict = {c.name: c for c in stmt.excluded if not c.primary_key}
if not update_dict:
raise ValueError("insert_or_update resulted in an empty update_dict")
stmt = stmt.on_conflict_do_update(index_elements=primary_keys,
@nirizr
nirizr / idapython_get_stack_refs.py
Last active Jan 26, 2022
IDAPYTHON: List all references to all stack variables of a function
View idapython_get_stack_refs.py
import idc, idaapi, idautils, ida_xref
def find_stack_members(func_ea):
members = {}
base = None
frame = idc.GetFrame(func_ea)
for frame_member in idautils.StructMembers(frame):
member_offset, member_name, _ = frame_member
members[member_offset] = member_name
if member_name == ' r':
@skochinsky
skochinsky / rich.py
Created Apr 13, 2017
MSVC PE Rich header parser with compiler version display
View rich.py
# based on code from http://trendystephen.blogspot.be/2008/01/rich-header.html
import sys
import struct
# I'm trying not to bury the magic number...
CHECKSUM_MASK = 0x536e6144 # DanS (actuall SnaD)
RICH_TEXT = 'Rich'
RICH_TEXT_LENGTH = len(RICH_TEXT)
PE_START = 0x3c
PE_FIELD_LENGTH = 4
@yossorion
yossorion / what-i-wish-id-known-about-equity-before-joining-a-unicorn.md
Last active May 21, 2022
What I Wish I'd Known About Equity Before Joining A Unicorn
View what-i-wish-id-known-about-equity-before-joining-a-unicorn.md

What I Wish I'd Known About Equity Before Joining A Unicorn

Disclaimer: This piece is written anonymously. The names of a few particular companies are mentioned, but as common examples only.

This is a short write-up on things that I wish I'd known and considered before joining a private company (aka startup, aka unicorn in some cases). I'm not trying to make the case that you should never join a private company, but the power imbalance between founder and employee is extreme, and that potential candidates would