Skip to content

Instantly share code, notes, and snippets.

View stevemk14ebr's full-sized avatar
:octocat:
Reversing Life

Stephen Eckels stevemk14ebr

:octocat:
Reversing Life
564 followers · 35 following
View GitHub Profile
@stevemk14ebr
stevemk14ebr / CommonFunctionPads.json
Last active March 29, 2024 10:46
// From Sok Data: https://arxiv.org/ftp/arxiv/papers/2007/2007.14266.pdf
// This is an occurance count. For 53 binaries in various compiler modes how many functions where padded with sequence XXX
{
"cl_m32_O1": {
"cc": 553,
"cccc": 306,
"cccccc": 529,
"cccccccc": 165,
"6666666666660f1f840000000000": 6,
"90": 468,
@stevemk14ebr
stevemk14ebr / guids
Created September 15, 2020 18:35
COM CLSID, IID's, other guids
This file has been truncated, but you can view the full file.
NAME:AACMFTEncoder VALUE:93af0c51-2275-45d2-a35b-f2ba21caed00
NAME:ACPI_PLD_CONTAINER_BUFFER_GUID VALUE:c02fa109-6a82-4188-9f66-b190ba62db49
NAME:ACPI_PLD_INTERFACE_CLASS_BUFFER_GUID VALUE:1facec76-96a8-4d9e-846e-3a6d687c32fc
NAME:ACPI_PLD_INTERFACE_INSTANCE_ANSI_BUFFER_GUID VALUE:1facea4b-da66-484c-ba5b-5127e05f95b2
NAME:ACPI_PLD_INTERFACE_INSTANCE_GUID_BUFFER_GUID VALUE:1face9db-2530-4248-8ee3-51053aef47c2
NAME:ACPI_PLD_INTERFACE_INSTANCE_UNICODE_BUFFER_GUID VALUE:1face3f6-1a60-4686-9833-ec8402d43b04
NAME:ACPI_PLD_JOINT_BUFFER_GUID VALUE:f01cfc40-3c75-4523-9e44-215cb154bda6
NAME:ACPI_PLD_SPATIAL_BUFFER_GUID VALUE:59af1a1f-aba4-4bb8-81ef-55938e9bc53a
NAME:ADDON_DISABLE_EVENT VALUE:09010002-0204-0002-0000-000000000080
NAME:ADDON_ENABLE_EVENT VALUE:09010001-0104-0001-0000-000000000080
@stevemk14ebr
stevemk14ebr / gist:30c1f388a2ed74e56eec6c544e649bb2
Created February 1, 2024 00:30
monaco dnd
https://github.com/microsoft/monaco-editor/discussions/3755
@stevemk14ebr
stevemk14ebr / go_lib_typedefs.json
Last active October 13, 2023 19:15
Golang Standard Library Typedefs
This file has been truncated, but you can view the full file.
{
"archive_tar_headerError_Error": {
"result": "string",
"result_name": null,
"parameters": []
},
"archive_tar_sparseEntry_endOffset": {
"result": "int64",
"result_name": null,
"parameters": []
@stevemk14ebr
stevemk14ebr / Simple Efficient FindPattern
Last active May 4, 2023 16:48
FindPattern.go
package main
func getPatternSize(signature []byte) int {
// c = 2 * b + (b - 1) . 2 chars per byte + b - 1 spaces between
return (len(signature) + 1) / 3
}
func getBits(x byte) byte {
// ascii numbers to byte
if x >= '0' && x <= '9' {
@stevemk14ebr
stevemk14ebr / Whoah.rs
Last active May 4, 2023 16:48
Rust Pattern Matching Benchmark
use regex::bytes;
use microbench::{self, Options};
fn get_pattern_size(signature: &[u8]) -> usize {
// c = 2 * b + (b - 1) . 2 chars per byte + b - 1 spaces between
(signature.len() + 1) / 3
}
fn get_bits(x: u8) -> u8 {
// ascii numbers to byte
@stevemk14ebr
stevemk14ebr / vtable_dynamic_idx.hpp
Last active February 5, 2023 05:12
Get vtable index by parsing jump stub
// we're simply parsing the assembly of the jump stubs created by the compiler. The assembly encodes the displacement needed to jmp
// to the virtual function relative to the vtable start. If we parse this displacement out then divide by the pointer width, we
// can recover the index of a virtual function in a vtable.
template<typename T>
std::optional<uint16_t> getVtableIdx(T func)
{
// this is not safe to do by the standard.
// however, most compilers respect it and gen expected code
union {
T pfn;
@stevemk14ebr
stevemk14ebr / pcap.txt
Created November 30, 2022 16:26
pcap
POST /upload HTTP/1.1
Host: 34.207.187.90
Accept-Encoding: identity
Content-Length: 18260
QxRZUEcSAxhtbBdfXxsUFhUEAQcXCBgHGwISZBQWbBdWXkoLBRUZExIIAQQZBAUIFwAOGQQABBtlaxsVEUBLV1UVDxNrYhoCAAcGEhUYFBhAQEIWVF9VGkBJSkxTWlEcQ0BLQlJYVxIVGBQYWVpSFktPREFWXV0XRU5GR1VUXBYaGEZDXEoWFWgfEGIaAgAGARIVGBQYQEBCFlpfWRpDRVVLU1ZAV1lWGhoXFxxFSkoZVVxdH0lNWkRQUkVdUVkXGB5UWF1bWFtaSlwFWFgVHh1VV1EaQVJCXl1CCl9cRUtWV1sVEW0VGG0VAQQDDRoaFxccRUpKGVtcUVVBXVUYQUFRWlNTRRheWVddRBpTQBIVGBQYQEBCFlRfVVBLVVoXQkVUUFtcShtaXF1VSxVQRBURbRUYbRUBBAMOGhoXFxxFSkoZVVxdH11aQ0QYV1FcVVlZFx8QGxdDREccUlBWGVNXRkMUXFdSWFxeGRUbRFBAQ1BXWBcYHlFdXERSRkANSkFFQ1BeVAMYGxpbXFZWSl0XGB5eVkhfU1NaXFwYGxpGSkNNXVtTGFJTTVFAVkFaX1cYGxpGSkNVV1EaWl1cQBgUahkTaxsMAQMEERwZGhlCRkEfVVFUUk1WUxZfQFFGVxIVGBQYQEBCFlRfVVBLVVoXUUFTQFQZGmsbFWgSDQ8CARcfEBsXQ0RHHFxQWlNPUFAfXk5QRFEeVkxLUxUZExIWTUVFGl9ZW11OUlYcV09eRVMYVUVKXRYYR0ZeFk1FUkccAQkIBhhSRVZKGBtRFR5fGVpfUGpEQlBMU0QVEW0VGG0VAQQGABoaFxccRUpKGVtcUVVBXVUYUkVWShVDU1xAW0oKG0FaX0VUXRtaWl1ZTVdEFRkTEhZNRUUaX1lbXU5SVhxXT15FGkBXWUpTRQUYRV9VTVtSGF5fV
@stevemk14ebr
stevemk14ebr / patchview.html
Created July 28, 2022 01:57
Explain git .patch https://github.com/megatops/PatchViewer/blob/master/PatchViewer.html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta content="text/html; charset=UTF-8" http-equiv="content-type" />
<title>Patch Viewer</title>
<style type="text/css">
@stevemk14ebr
stevemk14ebr / delete_all.js
Last active July 4, 2022 01:54
Delete all movies in radarr
// goto radarr->settings->general then paste this.
const key = document.getElementsByClassName('x-api-key')[0].value;
if (!key) {
alert('Navigate to /settings/general and run again');
}
let ids = [];
let _movies = [];
let index = 0;