Skip to content

Instantly share code, notes, and snippets.

Avatar
:shipit:
hacking intensifies

Tim Strazzere strazzere

:shipit:
hacking intensifies
View GitHub Profile
@strazzere
strazzere / Makefile
Created Jul 14, 2017
Decryption for most Kony
View Makefile
all:
gcc decrypt.c -I/usr/local/opt/boringssl/include -L/usr/local/opt/boringssl/lib -lcrypto -o kony_decrypt
View LocationRequest.java
// Decompiled by Jad v1.5.8g. Copyright 2001 Pavel Kouznetsov.
// Jad home page: http://www.kpdus.com/jad.html
// Decompiler options: packimports(3)
package com.google.android.gms.location;
import android.os.*;
import com.google.android.gms.common.internal.ReflectedParcelable;
import com.google.android.gms.common.internal.safeparcel.AbstractSafeParcelable;
import com.google.android.gms.common.internal.zzz;
@strazzere
strazzere / output.bash
Created Sep 12, 2017
Baksmali to Smali
View output.bash
rigby:contents diff$ ls -l
total 12600
-rw-r--r-- 1 diff staff 13268 Dec 31 1979 AndroidManifest.xml
drwxr-xr-x 6 diff staff 204 Sep 12 14:03 META-INF
-rw-r--r-- 1 diff staff 623 Dec 31 1979 androidannotations-api.properties
drwxr-xr-x 4 diff staff 136 Sep 12 14:03 assets
-rw-r--r-- 1 diff staff 939 Dec 31 1979 build-data.properties
-rw-r--r-- 1 diff staff 5646628 Dec 31 1979 classes.dex
drwxr-xr-x 3 diff staff 102 Sep 12 14:03 jsr305_annotations
drwxr-xr-x 5 diff staff 170 Sep 12 14:03 lib
@strazzere
strazzere / blah.c
Created Sep 6, 2017
Example of calling android method from native code
View blah.c
void Log(std::string s){
JNIEnv *env;
g_JavaVM->GetEnv((void**)&env, JNI_VERSION_1_6);
jstring jstr1 = env->NewStringUTF(s.c_str());
jclass clazz = env->FindClass("diff/strazzere/secret/method");
// Later part is dalvik notation for parameters and return value, string param and void return value here
jmethodID mid = env->GetStaticMethodID(clazz, "methodname", "(Ljava/lang/String;)V");
@strazzere
strazzere / detect.go
Created Jul 7, 2017
Quick test for Otto VM detection techniques
View detect.go
package main
import (
"fmt"
"github.com/robertkrimen/otto"
)
func main() {
vm := otto.New()
@strazzere
strazzere / example.go
Created Jun 27, 2017
safer unsafe otto run
View example.go
package main
import (
"errors"
"fmt"
"os"
"time"
"github.com/robertkrimen/otto"
)
@strazzere
strazzere / yara_fn.py
Created Aug 18, 2016 — forked from williballenthin/yara_fn.py
generate a yara rule that matches the basic blocks of the current function in IDA Pro
View yara_fn.py
'''
IDAPython script that generates a YARA rule to match against the
basic blocks of the current function. It masks out relocation bytes
and ignores jump instructions (given that we're already trying to
match compiler-specific bytes, this is of arguable benefit).
If python-yara is installed, the IDAPython script also validates that
the generated rule matches at least one segment in the current file.
author: Willi Ballenthin <william.ballenthin@fireeye.com>
@strazzere
strazzere / gist:195b439480eab1de3c43f73781d5502a
Created Jul 23, 2016
osx + irssi + chinese utf-8 characters
View gist:195b439480eab1de3c43f73781d5502a
screen -U -S irc
/set term_charset utf-8
/set recode_autodetect_utf8 ON
/set recode_fallback ISO-8859-15
/set recode_out_default_charset ISO-8859-15
/set recode_transliterate ON
/set recode ON
View gist:f76df7e24dd554268f0ba284fda7587c
[54%]diff@rocksteady:[repo] $ git clone --verbose https://git01.codeplex.com/veracrypt
Cloning into 'veracrypt'...
POST git-upload-pack (gzip 1440 to 623 bytes)
remote: Counting objects: 8996, done.
remote: Compressing objects: 100% (6843/6843), done.
remote: Total 8996 (delta 7179), reused 2812 (delta 2010)
Receiving objects: 100% (8996/8996), 43.16 MiB | 1.46 MiB/s, done.
error: RPC failed; curl 56 SSLRead() return error -9806
Resolving deltas: 100% (7179/7179), done.
@strazzere
strazzere / CheckSourceFileName.1sc
Created Oct 24, 2013
Run after using DEXTemplate.bt -- too slow to include in every template run, but can be used after running it if wanted
View CheckSourceFileName.1sc
//////////////////////////////////////////////////
// Post template completion checks and functions
//////////////////////////////////////////////////
int CheckSourceFileName(int source_file_index) {
local string temp_str = StringIdRead(source_file_index);
if(sizeof(temp_str) <= 6) {
return -1;
}
temp_str = SubStr(temp_str, sizeof(temp_str) - 7, -1);