Skip to content

Instantly share code, notes, and snippets.

Working from home

Mark Lim peta909

Working from home
View GitHub Profile
icecr4ck /
Last active Aug 9, 2022
Cheatsheet for IDAPython

Windows Toolkit


Native Binaries

IDA Plugins Preferred Neutral Unreviewed

manual import resolution

example from 0f5d5d07c6533bc6d991836ce79daaa1:

_0:00F20012 33 D2                   xor     edx, edx
_0:00F20014 64 8B 52 30             mov     edx, fs:[edx+30h] // TEB->PEB
_0:00F20018 8B 52 0C                mov     edx, [edx+0Ch]    // PEB->LDR_DATA
_0:00F2001B 8B 52 14                mov     edx, [edx+14h]    // LDR_DATA->InMemoryOrderLinks (_LDR_DATA_TABLE_ENTRY)
                                                              // alt: 0xC: InLoadOrderLinks
 // alt: 0x1C: InInitializationOrderLinks
hasherezade / main.cpp
Last active May 27, 2022
Get PEB64 from a WOW64 process
View main.cpp
#include <Windows.h>
#include <iostream>
#include "ntdll_undoc.h"
PPEB get_default_peb()
#if defined(_WIN64)
return (PPEB)__readgsqword(0x60);
View cheat_sheet.txt
GDB commands by function - simple guide
More important commands have a (*) by them.
% gdb -help print startup help, show switches
*% gdb object normal debug
*% gdb object core core debug (must specify core file)
%% gdb object pid attach to running process
% gdb use file command to load object
JamesPHoughton / gist:0f4f269e93a2b85958d8
Created Sep 15, 2014
Recursively unpack zip files in python
View gist:0f4f269e93a2b85958d8
from zipfile import ZipFile
def unpack_zip(zipfile='', path_from_local=''):
filepath = path_from_local+zipfile
extract_path = filepath.strip('.zip')+'/'
parent_archive = ZipFile(filepath)
namelist = parent_archive.namelist()
for name in namelist: