Skip to content

Instantly share code, notes, and snippets.

View stevemk14ebr's full-sized avatar
:octocat:
Reversing Life

Stephen Eckels stevemk14ebr

:octocat:
Reversing Life
591 followers · 35 following
View GitHub Profile
@stevemk14ebr
stevemk14ebr / gist:30c1f388a2ed74e56eec6c544e649bb2
Created February 1, 2024 00:30
monaco dnd
https://github.com/microsoft/monaco-editor/discussions/3755
@stevemk14ebr
stevemk14ebr / go_lib_typedefs.json
Last active October 13, 2023 19:15
Golang Standard Library Typedefs
This file has been truncated, but you can view the full file.
{
"archive_tar_headerError_Error": {
"result": "string",
"result_name": null,
"parameters": []
},
"archive_tar_sparseEntry_endOffset": {
"result": "int64",
"result_name": null,
"parameters": []
@stevemk14ebr
stevemk14ebr / Whoah.rs
Last active May 4, 2023 16:48
Rust Pattern Matching Benchmark
use regex::bytes;
use microbench::{self, Options};
fn get_pattern_size(signature: &[u8]) -> usize {
// c = 2 * b + (b - 1) . 2 chars per byte + b - 1 spaces between
(signature.len() + 1) / 3
}
fn get_bits(x: u8) -> u8 {
// ascii numbers to byte
@stevemk14ebr
stevemk14ebr / Simple Efficient FindPattern
Last active May 4, 2023 16:48
FindPattern.go
package main
func getPatternSize(signature []byte) int {
// c = 2 * b + (b - 1) . 2 chars per byte + b - 1 spaces between
return (len(signature) + 1) / 3
}
func getBits(x byte) byte {
// ascii numbers to byte
if x >= '0' && x <= '9' {
@stevemk14ebr
stevemk14ebr / vtable_dynamic_idx.hpp
Last active February 5, 2023 05:12
Get vtable index by parsing jump stub
// we're simply parsing the assembly of the jump stubs created by the compiler. The assembly encodes the displacement needed to jmp
// to the virtual function relative to the vtable start. If we parse this displacement out then divide by the pointer width, we
// can recover the index of a virtual function in a vtable.
template<typename T>
std::optional<uint16_t> getVtableIdx(T func)
{
// this is not safe to do by the standard.
// however, most compilers respect it and gen expected code
union {
T pfn;
@stevemk14ebr
stevemk14ebr / pcap.txt
Created November 30, 2022 16:26
pcap
POST /upload HTTP/1.1
Host: 34.207.187.90
Accept-Encoding: identity
Content-Length: 18260
QxRZUEcSAxhtbBdfXxsUFhUEAQcXCBgHGwISZBQWbBdWXkoLBRUZExIIAQQZBAUIFwAOGQQABBtlaxsVEUBLV1UVDxNrYhoCAAcGEhUYFBhAQEIWVF9VGkBJSkxTWlEcQ0BLQlJYVxIVGBQYWVpSFktPREFWXV0XRU5GR1VUXBYaGEZDXEoWFWgfEGIaAgAGARIVGBQYQEBCFlpfWRpDRVVLU1ZAV1lWGhoXFxxFSkoZVVxdH0lNWkRQUkVdUVkXGB5UWF1bWFtaSlwFWFgVHh1VV1EaQVJCXl1CCl9cRUtWV1sVEW0VGG0VAQQDDRoaFxccRUpKGVtcUVVBXVUYQUFRWlNTRRheWVddRBpTQBIVGBQYQEBCFlRfVVBLVVoXQkVUUFtcShtaXF1VSxVQRBURbRUYbRUBBAMOGhoXFxxFSkoZVVxdH11aQ0QYV1FcVVlZFx8QGxdDREccUlBWGVNXRkMUXFdSWFxeGRUbRFBAQ1BXWBcYHlFdXERSRkANSkFFQ1BeVAMYGxpbXFZWSl0XGB5eVkhfU1NaXFwYGxpGSkNNXVtTGFJTTVFAVkFaX1cYGxpGSkNVV1EaWl1cQBgUahkTaxsMAQMEERwZGhlCRkEfVVFUUk1WUxZfQFFGVxIVGBQYQEBCFlRfVVBLVVoXUUFTQFQZGmsbFWgSDQ8CARcfEBsXQ0RHHFxQWlNPUFAfXk5QRFEeVkxLUxUZExIWTUVFGl9ZW11OUlYcV09eRVMYVUVKXRYYR0ZeFk1FUkccAQkIBhhSRVZKGBtRFR5fGVpfUGpEQlBMU0QVEW0VGG0VAQQGABoaFxccRUpKGVtcUVVBXVUYUkVWShVDU1xAW0oKG0FaX0VUXRtaWl1ZTVdEFRkTEhZNRUUaX1lbXU5SVhxXT15FGkBXWUpTRQUYRV9VTVtSGF5fV
@stevemk14ebr
stevemk14ebr / patchview.html
Created July 28, 2022 01:57
Explain git .patch https://github.com/megatops/PatchViewer/blob/master/PatchViewer.html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta content="text/html; charset=UTF-8" http-equiv="content-type" />
<title>Patch Viewer</title>
<style type="text/css">
@stevemk14ebr
stevemk14ebr / typdef_args_to_typeids
Last active June 10, 2022 20:35
C++ typedef args to typeid list
#include <iostream>
#include <typeinfo>
#include <typeindex>
#include <span>
typedef int (*tExample) (int a, bool b, char* c, long long d);
template<typename T>
struct arg_types {};
@stevemk14ebr
stevemk14ebr / VirtualAlloc2
Created May 5, 2021 14:30
VirtualAlloc2 Bounded Allocation
// Alloc2Test.cpp : This file contains the 'main' function. Program execution begins and ends there.
//
#include <iostream>
#include <Windows.h>
#include <string>
#include <assert.h>
static inline char* AlignUpwards(const char* stack, size_t align) {
@stevemk14ebr
stevemk14ebr / stpgetargtype_dump.json
Created April 11, 2021 18:15
DTrace's StpGetArgType accesses a metadata table that stores complete arg type information for every syscall.
[
[
"NtLockProductActivationKeys",
[
"UInt32 *",
"UInt32 *"
]
],
[
"NtLockProductActivationKeys",