Skip to content

Instantly share code, notes, and snippets.

Avatar
🏠
Working from home

Mark Lim peta909

🏠
Working from home
View GitHub Profile
@icecr4ck
icecr4ck / idapython_cheatsheet.md
Last active Nov 24, 2021
Cheatsheet for IDAPython
View idapython_cheatsheet.md
View windows-toolkit.md

Windows Toolkit

Binary

Native Binaries

IDA Plugins Preferred Neutral Unreviewed
View peb_parsing.md

manual import resolution

example from 0f5d5d07c6533bc6d991836ce79daaa1:

_0:00F20012 33 D2                   xor     edx, edx
_0:00F20014 64 8B 52 30             mov     edx, fs:[edx+30h] // TEB->PEB
_0:00F20018 8B 52 0C                mov     edx, [edx+0Ch]    // PEB->LDR_DATA
_0:00F2001B 8B 52 14                mov     edx, [edx+14h]    // LDR_DATA->InMemoryOrderLinks (_LDR_DATA_TABLE_ENTRY)
                                                              // alt: 0xC: InLoadOrderLinks
                                                              // alt: 0x1C: InInitializationOrderLinks
@hasherezade
hasherezade / main.cpp
Last active Mar 10, 2021
Get PEB64 from a WOW64 process
View main.cpp
#include <Windows.h>
#include <iostream>
#include "ntdll_undoc.h"
PPEB get_default_peb()
{
#if defined(_WIN64)
return (PPEB)__readgsqword(0x60);
#else
View cheat_sheet.txt
GDB commands by function - simple guide
---------------------------------------
More important commands have a (*) by them.
Startup
% gdb -help print startup help, show switches
*% gdb object normal debug
*% gdb object core core debug (must specify core file)
%% gdb object pid attach to running process
% gdb use file command to load object
@JamesPHoughton
JamesPHoughton / gist:0f4f269e93a2b85958d8
Created Sep 15, 2014
Recursively unpack zip files in python
View gist:0f4f269e93a2b85958d8
from zipfile import ZipFile
def unpack_zip(zipfile='', path_from_local=''):
filepath = path_from_local+zipfile
extract_path = filepath.strip('.zip')+'/'
parent_archive = ZipFile(filepath)
parent_archive.extractall(extract_path)
namelist = parent_archive.namelist()
parent_archive.close()
for name in namelist: