Skip to content

Instantly share code, notes, and snippets.

@sparkyparrot
sparkyparrot / listkmods.py
Created December 9, 2020 11:01 — forked from patois/listkmods.py
ida/vmware kernel debugging helper
from idaapi import *
# with code taken from
# - http://hexblog.com/idapro/vmware_modules.py
# - HexRays forum
# - https://gist.github.com/nmulasmajic/f90661489f858237bcd68fbde5516abd#file-find_nt_imagebase_x64-py
class LoadedModulesList(Choose2):
def __init__(self, title, modlistEA=BADADDR, flags=0, width=None, height=None, embedded=False, modal=False):
@sparkyparrot
sparkyparrot / deobfuscate.py
Last active January 21, 2019 22:47 — forked from quangnh89/deobfuscate.py
A malware analysis case-study: Deobfuscate Windows malicious obfuscated code
# Slide : https://docs.google.com/presentation/d/1jLUDucNtvGotHw0LOvDonMYwCkXYcb-cnsOWLNt-Ag0
import sys
import pefile
from capstone import *
from capstone.x86 import *
from keystone import *
from datetime import datetime
MAX_DISASM_COUNT = 1000 * 1000
FILE_NAME = r"dump-g4pic.dll"