Skip to content

Instantly share code, notes, and snippets.

View stong's full-sized avatar

Stephen Tong stong

View GitHub Profile
@stong
stong / .gitattributes
Created March 19, 2024 17:50
Pandoc docx git diff gitconfig
# Documents
*.doc binary
*.docx binary diff=pandoc
*.xls binary
*.xlsx binary
*.xlt binary
*.xltm binary
*.pdf binary
*.ppt binary
@stong
stong / twitter.txt
Last active April 29, 2024 15:53
Twitter ublock rules
twitter.com##div[aria-label="Trending"]
twitter.com##aside[aria-label="Who to follow"]
twitter.com##a[aria-label="Search and explore"]
twitter.com##svg[aria-label="Verified account"]
twitter.com##a[aria-label="Communities"]
twitter.com##a[aria-label="Verified Orgs"]
twitter.com##a[aria-label="Top Articles"]
twitter.com##a[aria-label^="Notifications"]
! 2023-09-05 https://twitter.com
@stong
stong / CleanBoot.java
Last active January 27, 2024 11:35
Real World CTF 2023: Dark Portal Writeup
package org.mapleir;
import org.mapleir.app.client.SimpleApplicationContext;
import org.mapleir.app.service.ApplicationClassSource;
import org.mapleir.app.service.InstalledRuntimeClassSource;
import org.mapleir.asm.ClassHelper;
import org.mapleir.asm.ClassNode;
import org.mapleir.asm.MethodNode;
import org.mapleir.context.AnalysisContext;
import org.mapleir.context.BasicAnalysisContext;
@stong
stong / cast_example.txt
Last active August 22, 2022 23:53
EVM universal constructor
cast rpc eth_sendTransaction '{"data": "'$(cat constructor_bytecode.txt)$(cat bytecode.txt)'"}'
@stong
stong / tee.py
Last active April 29, 2022 04:48
Duplicate pwntools process output to stdout with tee(2) syscall
import sys
import os
from pwn import *
def tee_process(p):
import threading
import ctypes
libc = ctypes.CDLL(None)
splice = libc.splice
tee = libc.tee
@stong
stong / CVE-2021-3156-PoC.md
Last active January 30, 2021 03:29
CVE-2021-3156 PoC

This PoC has been moved to an actual repo here.

@stong
stong / cheese.cpp
Last active December 10, 2020 14:37
pbctf 2020: Jiang Ying's Disasssembler author's writeup
// TLDR:
// Whitebox 128-bit rsa with e=17. Input is multiplied by a constant before the RSA
#include <Windows.h>
#include <stdio.h>
#include <stdint.h>
extern "C" void __fastcall rsa_encrypt (uint8_t* in, uint8_t* out);
// 1. Func is ~90kb, and control flow is simple. Should be decompilable just extremely SLOW.
@stong
stong / Service KMS
Created December 2, 2020 01:27 — forked from wangkai2014/Service KMS
Volume License Activation Key Service - KMS
## Find Available Target Editions
DISM.exe /Online /Get-TargetEditions
## Convert Server Standard 2019 Evaluation to Server Standard 2019
DISM /online /Set-Edition:ServerStandard /ProductKey:N69G4-B89J2-4G8F4-WWYCC-J464C /AcceptEula
## How To Activate
slmgr /ipk XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
slmgr /skms [server]:[port]
slmgr /ato
@stong
stong / annotate-relocs.py
Created March 8, 2020 22:05
Highlight instructions containing relocations in Binary Ninja
def annotate_relocs():
def find_relocation(bv, start, end):
# assume that relocations can't straddle functions
funcs = bv.get_functions_containing(start)
if not funcs: return
for func in funcs:
bb = func.get_basic_block_at(start)
if not bb: continue
bb._buildStartCache()
for i, insn_start in enumerate(bb._instStarts):
@stong
stong / st3-patcher.py
Last active May 26, 2020 04:22
Automated script for cracking Sublime Text and Sublime Merge
# Disclaimer and license
# This code is provided without any warranty whatsoever, express or implied. I don't take responsibility for what you choose to do with it.
# Only use this code in accordance with United States and local law. It is provided for educational purposes only.
# Don't use the code unless you already own a legitimate product license for Sublime Text or Sublime Merge.
# By using or studying the code you agree to abide by these terms and conditions.
# Do not contact me if the script is broken because I am not offering support for it.
# You may freely redistribute this code as long as this license is also attached.
# this script should be run in the binaryninja console
def yeet():