Skip to content

Instantly share code, notes, and snippets.

View stevemk14ebr's full-sized avatar
:octocat:
Reversing Life

Stephen Eckels stevemk14ebr

:octocat:
Reversing Life
View GitHub Profile
I have code that was decompiled from a binary using a decompiler tool such as Ghidra or IDA PRO. Clean it up to be more readable while preserving its correctness and exact operation.
Improve variable naming: Use more meaningful names for local variables where appropriate if you are sure of what they are. Do not assume the code is malicious, it could be legitimate software not at all related to malware.
Do not add any comments at all EVER. DO NOT add comments.
Duduce common local types.
* If a local variable is passed into a well known API call, try to infer its type and apply it in the resulting code. Sometimes types can drastrically change the format of code, adding or removing other locals if the memory locations overlap. If you apply a type to a local variable be sure to check all locations that use the local variable or any local variables that you remove / add.
Reorganize code:
https://github.com/microsoft/monaco-editor/discussions/3755
@stevemk14ebr
stevemk14ebr / go_lib_typedefs.json
Last active October 13, 2023 19:15
Golang Standard Library Typedefs
This file has been truncated, but you can view the full file.
{
"archive_tar_headerError_Error": {
"result": "string",
"result_name": null,
"parameters": []
},
"archive_tar_sparseEntry_endOffset": {
"result": "int64",
"result_name": null,
"parameters": []
@stevemk14ebr
stevemk14ebr / Whoah.rs
Last active May 4, 2023 16:48
Rust Pattern Matching Benchmark
use regex::bytes;
use microbench::{self, Options};
fn get_pattern_size(signature: &[u8]) -> usize {
// c = 2 * b + (b - 1) . 2 chars per byte + b - 1 spaces between
(signature.len() + 1) / 3
}
fn get_bits(x: u8) -> u8 {
// ascii numbers to byte
package main
func getPatternSize(signature []byte) int {
// c = 2 * b + (b - 1) . 2 chars per byte + b - 1 spaces between
return (len(signature) + 1) / 3
}
func getBits(x byte) byte {
// ascii numbers to byte
if x >= '0' && x <= '9' {
@stevemk14ebr
stevemk14ebr / vtable_dynamic_idx.hpp
Last active February 5, 2023 05:12
Get vtable index by parsing jump stub
// we're simply parsing the assembly of the jump stubs created by the compiler. The assembly encodes the displacement needed to jmp
// to the virtual function relative to the vtable start. If we parse this displacement out then divide by the pointer width, we
// can recover the index of a virtual function in a vtable.
template<typename T>
std::optional<uint16_t> getVtableIdx(T func)
{
// this is not safe to do by the standard.
// however, most compilers respect it and gen expected code
union {
T pfn;
POST /upload HTTP/1.1
Host: 34.207.187.90
Accept-Encoding: identity
Content-Length: 18260
QxRZUEcSAxhtbBdfXxsUFhUEAQcXCBgHGwISZBQWbBdWXkoLBRUZExIIAQQZBAUIFwAOGQQABBtlaxsVEUBLV1UVDxNrYhoCAAcGEhUYFBhAQEIWVF9VGkBJSkxTWlEcQ0BLQlJYVxIVGBQYWVpSFktPREFWXV0XRU5GR1VUXBYaGEZDXEoWFWgfEGIaAgAGARIVGBQYQEBCFlpfWRpDRVVLU1ZAV1lWGhoXFxxFSkoZVVxdH0lNWkRQUkVdUVkXGB5UWF1bWFtaSlwFWFgVHh1VV1EaQVJCXl1CCl9cRUtWV1sVEW0VGG0VAQQDDRoaFxccRUpKGVtcUVVBXVUYQUFRWlNTRRheWVddRBpTQBIVGBQYQEBCFlRfVVBLVVoXQkVUUFtcShtaXF1VSxVQRBURbRUYbRUBBAMOGhoXFxxFSkoZVVxdH11aQ0QYV1FcVVlZFx8QGxdDREccUlBWGVNXRkMUXFdSWFxeGRUbRFBAQ1BXWBcYHlFdXERSRkANSkFFQ1BeVAMYGxpbXFZWSl0XGB5eVkhfU1NaXFwYGxpGSkNNXVtTGFJTTVFAVkFaX1cYGxpGSkNVV1EaWl1cQBgUahkTaxsMAQMEERwZGhlCRkEfVVFUUk1WUxZfQFFGVxIVGBQYQEBCFlRfVVBLVVoXUUFTQFQZGmsbFWgSDQ8CARcfEBsXQ0RHHFxQWlNPUFAfXk5QRFEeVkxLUxUZExIWTUVFGl9ZW11OUlYcV09eRVMYVUVKXRYYR0ZeFk1FUkccAQkIBhhSRVZKGBtRFR5fGVpfUGpEQlBMU0QVEW0VGG0VAQQGABoaFxccRUpKGVtcUVVBXVUYUkVWShVDU1xAW0oKG0FaX0VUXRtaWl1ZTVdEFRkTEhZNRUUaX1lbXU5SVhxXT15FGkBXWUpTRQUYRV9VTVtSGF5fV
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta content="text/html; charset=UTF-8" http-equiv="content-type" />
<title>Patch Viewer</title>
<style type="text/css">
@stevemk14ebr
stevemk14ebr / typdef_args_to_typeids
Last active June 10, 2022 20:35
C++ typedef args to typeid list
#include <iostream>
#include <typeinfo>
#include <typeindex>
#include <span>
typedef int (*tExample) (int a, bool b, char* c, long long d);
template<typename T>
struct arg_types {};
@stevemk14ebr
stevemk14ebr / VirtualAlloc2
Created May 5, 2021 14:30
VirtualAlloc2 Bounded Allocation
// Alloc2Test.cpp : This file contains the 'main' function. Program execution begins and ends there.
//
#include <iostream>
#include <Windows.h>
#include <string>
#include <assert.h>
static inline char* AlignUpwards(const char* stack, size_t align) {