Skip to content

Instantly share code, notes, and snippets.


rain1 rain-1

View GitHub Profile

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

  • Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
  • Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
  • Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
  • Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
  • Kill switch: If the website is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru

View checksum-colorizer.go
package main
import (
rain-1 / another way
Last active Mar 12, 2019
View another way
#lang racket
(require racket/stream)
(define (make-prefix len)
(lambda (tail)
(append (make-list len '_) (cons 'o tail))))
(define (k-combinations k n)
(cond ((= k 0)
rain-1 / serialize-lisp.rkt
Created Feb 17, 2019
View serialize-lisp.rkt
#lang racket
;; This implements a baby lisp interpreter using closure conversion pass before execution
;; It supports serialization of closures (e.g. for partial evaluation/staging) and reading back and executing those objects
(require data/queue)
;; closure conversion for lambda calculus
;; the input language is:
rain-1 / set.rkt
Created Mar 4, 2019
generalized set! in racket - failed idea
View set.rkt
#lang racket
(require (for-syntax racket/syntax))
(define toplevel 'foo)
(define-syntax (set^ stx)
(syntax-case stx ()
[(_ (attr x) y)
(with-syntax ([set-attr! (format-id #'toplevel "set-~a!" (syntax-e #'attr))])
View closure-conversion.rkt
#lang racket
;; this is a stand alone simple version of the closure conversion part of the hoist pass from the tarot compiler
;; see for more.
(require data/queue)
;; closure conversion for lambda calculus
;; the input language is:
rain-1 / grammar-1.rkt
Last active Feb 7, 2019
parsing with grammars
View grammar-1.rkt
#lang racket
;(start, (ACCEPT))
;(start, (READ #\a, sym))
;(start, (READ #\b, sym))
;(start, (READ #\(, "sexps"), PUSH(#\)))
;(sym, (ACCEPT))
;(sym, (READ #\a, sym))
;(sym, (READ #\b, sym))
rain-1 / dcs.rkt
Last active Jan 27, 2019
Dotted Canonical S-expressions - DCSexps
View dcs.rkt
#lang racket
;; printing s-exps as DCS and TDCS, plus examples of what DCS and TDCS look like
(define (dcs l)
(cond ((pair? l)
(display ".")
(dcs (car l))
(dcs (cdr l))))
rain-1 / minikanren.scm
Created Jan 6, 2019
minikanren.scm - based off orchid-hybrid mirukanren. works in Chez
View minikanren.scm
;; utils
(define (assp p l)
(if (null? l)
(if (p (caar l))
(car l)
(assp p (cdr l)))))
rain-1 / example.tsv
Last active Dec 17, 2018
Tab Separated Values file format specification version 2.0
View example.tsv
Name Age Address
Paul 23 1115 W Franklin
Bessy the Cow 5 Big Farm Way
Zeke 45 W Main St
You can’t perform that action at this time.