psifertex

Welcome to Jordan's grab-bag of common Binary Ninja Snippets.

These snippets are meant to run with the Binary Ninja Snippets Plugin
(http://github.com/Vector35/snippets) though they can all also be pasted
directly into the python console or turned into stand-alone plugins if needed.

To install the entire collection at once, just install the Snippets plugin via
the plugin manager (CMD/CTL-SHIFT-M), confirm the Snippet Editor works
(Tool/Snippets/Snippet Editor), and unzip this bundle (Download ZIP above) into
your Snippets folder.

psifertex

CloseHandle(HANDLE handle) __import("kernel32");
CreateDirectoryA(const char* name, void* security) __import("kernel32");
CreateFileA(const char* name, uint32_t access, uint32_t share, void* security, uint32_t disposition,
CreateFileMappingA(HANDLE file, void* security, uint32_t prot,
CreatePipe(HANDLE* read, HANDLE* write, void* security, uint32_t size) __import("kernel32");
CreateProcessA(const char* app, const char* cmdline, void* processAttr, void* threadAttr,
DeleteFileA(const char* name) __import("kernel32");
ExitProcess(uint32_t exitCode) __import("kernel32") __noreturn;
FindClose(HANDLE find) __import("kernel32");
FindFirstFileA(const char* name, WIN32_FIND_DATAA* data) __import("kernel32");

psifertex

#!/usr/bin/env zsh

# Note:
# CMake, Clang, clang-format, Ninja, git and sed are required to build
#
# Note that currently there is a bug (https://github.com/google/binexport/issues/117)
# that requires applying this patch, remove when resolved
#

if [[ "$OSTYPE" == "darwin"* ]]; then

psifertex

#!/bin/bash
# Standalone verification script for aws-lc-rs executable stack fix
# Run this on an x86_64 Linux machine

WORK_DIR="/tmp/aws-lc-rs-execstack-test"
REPO_URL="https://github.com/aws/aws-lc-rs.git"

echo "============================================================"
echo "  aws-lc-rs Executable Stack Fix Verification"
echo "============================================================"

psifertex

Timestamps for all the talks if people want to watch them. I sent them to OBTS so hopefully they update video descriptions:

https://www.youtube.com/watch?v=lWLVOJrNBW
Day 1 Timestamps
00:00:00 Video Start
00:00:05 Opening slides (no audio)
00:02:30 Jaron Bradley: "Gotta Catch 'em All" (no audio)
00:12:50 Jaron Bradley: "Gotta Catch 'em All" (audio fades in)
00:29:36 Csaba Fitzl & Gergely Kalman: "Breaking the Sound Barrier: Exploiting CoreAudio via Mach Message Fuzzing"
00:51:48 Dillon Franke: "Breaking the Sound Barrier: Exploiting CoreAudio via Mach Message Fuzzing"

psifertex

{
	"Back" : "Escape; Back; Ctrl+[; Meta+O",
	"Forward" : "Forward; Ctrl+[; Meta+I",
	"Change Type..." : "Shift+Y; ",
	"Close Window" : "Ctrl+W; X",
	"Command Palette" : "Ctrl+P; Space",
	"Copy" : "Ctrl+C; Y",
	"Disassembly Graph" : "G, L",
	"Display as\\Binary" : "D",
	"Display as\\Default" : "D",

psifertex

Quick Raw Data Graph

With thanks to willpatera for the google apps script this is based on.

Instructions:

1. Make a new google sheet (add column headers like "uss", "rss" or "vss" as posted in log-memory.py as appropriate)
2. Tools / Script Editor
3. Paste google code.js into the window
4. Run / Setup (Authorize the app)

psifertex

items = {}
def constructs(i):
 match i:
   case Comparison():
      return "comparisons"
   case HighLevelILFor():
      return "for"
   case HighLevelILWhile():
      return "while"
   case HighLevelILDoWhile():

psifertex

from PySide6.QtWidgets import QApplication, QMainWindow, QMessageBox, QPushButton
from PySide6.QtCore import Qt
import sys

class MainWindow(QMainWindow):
    def __init__(self):
        super().__init__()
        self.setWindowTitle("QT Test")
        button = QPushButton("Test Dialog")
        button.clicked.connect(self.button_click)

psifertex

#!/bin/bash
GHIDRAPATH=~/Downloads/ghidra

# https://stackoverflow.com/posts/23002317/revisions
function abspath() {
    # generate absolute path from relative path
    # $1     : relative filename
    # return : absolute path
    if [ -d "$1" ]; then
        # dir