Skip to content

Instantly share code, notes, and snippets.

View odzhan's full-sized avatar

odzhan

699 followers · 80 following
View GitHub Profile
@odzhan
odzhan / regexp.cpp
Last active May 2, 2024 02:16
Simple regexp example using IRegExp interface.
//
// Simple regexp example using IRegExp interface.
//
/**
# Found 4 matches.
> test@gmail.com
> spam@yahoo.com
@odzhan
odzhan / mask.cpp
Last active May 4, 2024 01:56
Obfuscation with byte substitution
//
// Simple obfuscation using byte substitution
//
#include <cstdio>
#include <cstdint>
#include <cstdlib>
#include <cstring>
#include <cmath>
@odzhan
odzhan / sbox.cpp
Last active April 29, 2024 09:03
Data Masking with Byte Substitution
//
// @modexpblog
//
#include <cstdio>
#include <cstdlib>
#include <cstring>
#include <cstdint>
#include <ctime>
#include <cmath>
#include <fcntl.h>
@odzhan
odzhan / ntdelegate.cpp
Created February 13, 2024 21:47
Delegate NT DLL Table
//
// How to locate the NT Delegate Callback Table in x86 builds of ntdll.dll
//
// @modexpblog
//
#define PHNT_VERSION PHNT_THRESHOLD
#include <phnt_windows.h>
#include <phnt.h>
@odzhan
odzhan / proc_env_exit.cpp
Last active February 2, 2024 08:05
Resolve dynamic address of Process.Environment.Exit in CLR host process using C++
//
// Resolve dynamic address of Process.Environment.Exit in CLR host process using C++
//
// Based on :
// https://www.mdsec.co.uk/2020/08/massaging-your-clr-preventing-environment-exit-in-in-process-net-assemblies/
// https://github.com/yamakadi/clroxide/blob/214222d578bf62b4c7fc860125268f4eecb9f331/examples/patch_exit.rs
// https://github.com/kyleavery/inject-assembly/blob/8db977c0fd1da039df920f9dd4840d4a3ec2aa2c/src/scmain.c
// https://github.com/TheWover/donut/blob/master/loader/test/rdt.cpp ;)
@odzhan
odzhan / rdp_pack.cpp
Last active March 27, 2024 17:27
Compression using RDP API
/**
Compression using undocumented API in rdpbase.dll
RDPCompressEx supports four algorithms : MPPC-8K, MPPC-64K, NCRUSH and XCRUSH.
This code supports all except NCRUSH.
The MPPC compression ratio is very similar to LZSS, so this could be quite useful for shellcode trying to evade detection.
NCRUSH compression appears to work but fails for decompression.
@odzhan
odzhan / szdd.c
Created December 29, 2023 10:36
SZDD compression
// LZ77 compression / decompression algorithm
// this is the compression Microsoft used in Windows *.HLP and *.MRB files
// It is also used with Install Shield files. These files are
// recognizable by the letters SZDD in the first 4 bytes. The file
// names for files compressed in this way are usually the name of the
// file as it would be installed but with the last character replaced
// by '_'
// This program is a complete hack. I am not responsible for the
@odzhan
odzhan / base64.cpp
Last active November 11, 2023 00:31
base64
/**
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
00, 01, 02, 03, 04, 05, 06, 07, 08, 09, 0A, 0B, 0C, 0D, 0E, 0F,
10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 1A, 1B, 1C, 1D, 1E, 1F,
20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 2A, 2B, 2C, 2D, 2E, 2F,
30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 3A, 3B, 3C, 3D, 3E, 3F,
@odzhan
odzhan / ecdlp.c
Last active November 2, 2023 11:04
ECDLP Solver by jB
/****************************************************************
jB's ECDLP Solver v0.02
ECDLP solver over F(p) using Pollard's Rho algorithm,
as described in Guide to Elliptic Curve Cryptography,
by Darrel Hankerson, Alfred Menezes and Scott Vanstone.
You will need MIRACL to compile it.
If you find bugs, have ideas to improve it, or simply want
@odzhan
odzhan / curl_libuv_example.c
Created November 2, 2023 01:48 — forked from clemensg/curl_libuv_example.c
An example on how to use libuv with libcurl's multi interface Should be equally fast on Unixes (uses epoll/kqueue/etc like libev/libevent) but MUCH faster on Windows due to libuv's usage of IO completion ports. Could come in handy if you have to manage several hundreds or thousands of connections!
#include <stdio.h>
#include <stdlib.h>
#include <uv.h>
#include <curl/curl.h>
uv_loop_t *loop;
CURLM *curl_handle;
uv_timer_t timeout;
typedef struct curl_context_s {