Skip to content

Instantly share code, notes, and snippets.

View skochinsky's full-sized avatar

Igor Skochinsky skochinsky

230 followers · 5 following
View GitHub Profile
@skochinsky
skochinsky / jeff_core10.j
Last active June 19, 2016 21:00
core java classes from ME 10.0.25.1048
; found JEFF at 0x00022C04?
; JEFF length=00020D94
; class 0/235
.class public super abstract com/intel/crypto/CertificateChain
.super java/lang/Object
.const [o304] = Int 16384 ; 0x00004000
.field protected static final MAX_CERTIFICATE_CHAIN_LENGTH I
@skochinsky
skochinsky / oath10.j
Last active June 19, 2016 16:51
from Intel IPT OATH Application_fw10.0.0_v3.0.jeff
; class 0/41
.class public super com/intel/dal/ipt/framework/AppletImpl
.super com/intel/util/IntelApplet
.field protected mIptf Lcom/intel/dal/ipt/framework/IptFramework;
.field mReplyBuffer [B
.field mInitialized Z
@skochinsky
skochinsky / checkcast.j
Last active July 21, 2017 22:45
.version 49 0
.class public super com/intel/crypto/NotInitializedException
.super com/intel/crypto/CryptoException
.method public <init> : ()V
.code stack 1 locals 1
L0: aload_0
L1: invokespecial Method com/intel/crypto/CryptoException <init> ()V
L4: return
@skochinsky
skochinsky / guids.txt
Created July 4, 2016 16:27
UEFI file/section GUIDs collection
; AMI
[GUID_FILE]
; ACPI tables
16D0A23E-C09C-407d-A14A-AD058FDD0CA1=ACPI
11D8AC35-FB8A-44d1-8D09-0B5606D321B9=DSDT
95DFCAE5-BB28-4d6b-B1E2-3AF3A6BF434F=PTID
FB045DB2-598E-485A-BA30-5D7B1B1BD54D=AOAC
60AC3A8F-4D66-4CD4-895A-C3F06E6665EE=iFfsAcpiTables
5B232086-350A-42c7-A70E-3497B5765D85=OEMSSDT
299141BB-211A-48a5-92C0-6F9A0A3A006E=PPMACPI
@skochinsky
skochinsky / gist:6cd55c768f99e08d45b11041940d9562
Created August 8, 2016 12:02
{
real_time:956280.161440 global_time:588919, event:`SYSCALL: socketcall' (state:ENTERING_SYSCALL) tid:18704, ticks:260023746443
eax:0xffffffda ecx:0xbfb415f4 edx:0x0 ebx:0x11 esp:0xbfb414fc ebp:0x80f48ef8 esi:0xb5f50000 edi:0x0 eip:0x70000002 eflags:0x246 xcs:0x73 xss:0x7b xds:0x7b xes:0x7b xfs:0x0 xgs:0x33 orig_eax:0x66
}
{
real_time:956280.161458 global_time:588920, event:`SYSCALLBUF_RESET' tid:18704, ticks:260023746443
}
{
real_time:956280.161644 global_time:588921, event:`SYSCALL: socketcall' (state:EXITING_SYSCALL) tid:18704, ticks:260023746443
eax:0xfffffff5 ecx:0xbfb415f4 edx:0x0 ebx:0x11 esp:0xbfb414fc ebp:0x80f48ef8 esi:0xb5f50000 edi:0x0 eip:0x70000002 eflags:0x246 xcs:0x73 xss:0x7b xds:0x7b xes:0x7b xfs:0x0 xgs:0x33 orig_eax:0x66
@skochinsky
skochinsky / gist:181e6e338d90bb7f2693098dc43c6d54
Last active November 29, 2017 14:13
Phoenix $PFH trailer
struct PFRegionEntry
{
UINT32 FileOffset;
UINT32 Size;
UINT64 FlashAddress;
UINT32 NameOffset; //absolute offset
};
struct PFHeader
{
@skochinsky
skochinsky / rich.py
Created April 13, 2017 13:03
MSVC PE Rich header parser with compiler version display
# based on code from http://trendystephen.blogspot.be/2008/01/rich-header.html
import sys
import struct
# I'm trying not to bury the magic number...
CHECKSUM_MASK = 0x536e6144 # DanS (actuall SnaD)
RICH_TEXT = 'Rich'
RICH_TEXT_LENGTH = len(RICH_TEXT)
PE_START = 0x3c
PE_FIELD_LENGTH = 4
@skochinsky
skochinsky / cap2bin.py
Created September 2, 2017 19:18
# convert Intel firmware update capsules to plain binaries
import sys
import os.path
import struct
fn = sys.argv[1]
inf = open(fn, "rb")
inf.seek(0xC8)
e=[]
@skochinsky
skochinsky / qt5res.py
Created September 5, 2018 17:15
Qt5 resourse dumper for IDA
## parse and dump Qt resources in current IDB
from PyQt5 import QtCore
import os.path
f = LocByName("?qRegisterResourceData@@YA_NHPBE00@Z")
for x in XrefsTo(f, idaapi.XREF_ALL):
if x.type==fl_CN:
callea = x.frm
push1 = DecodePreviousInstruction(callea)
if push1.itype != idaapi.NN_push:
print "no push at %08X!"% push1.ea
@skochinsky
skochinsky / scan_jmp.idc
Last active October 30, 2020 13:46
/*scan for far jumps or calls and print their location and destinations
jmp: 1= search for jumps(0= calls)
low16: only consider destinations with offset < 16
*/
static scan_jmp_call(jmp, low16)
{
// start at the minimal address
auto a = 0;
auto x, seg, offs, dest;
for (a = 0; x != BADADDR; a = x + 5 )// skip 5 bytes (size of far jmp/call opcode)