Skip to content

Instantly share code, notes, and snippets.

Avatar

Satoshi Tanda tandasat

View GitHub Profile
@tandasat
tandasat / ch3_answers.c
Created Nov 21, 2014
(Suspended) Answers of exercises in Practical Reverse Engineering Chapter 3
View ch3_answers.c
Susupended because of other project.
///////////////////////////////////////////////////////////////////////////////
//
// p123
//
I used Windows 8 kernel version 16628.
//////////////////////////////// 1-6
@tandasat
tandasat / elevator.c
Created Apr 27, 2016 — forked from sh1n0b1/elevator.c
Windows Open Type ‘atmfd.dll’ Privilege Escalation MS15-078
View elevator.c
#include <stdio.h>
#include <string.h>
#include "lib.h"
#include <Wininet.h>
//#include "starter.h"
//include OTF
#include "font.h" // foofont is fetched from loader config struct
//#include "cert.h"
@tandasat
tandasat / ch1_answers.c
Created Nov 19, 2014
Answers of exercises in Practical Reverse Engineering Chapter 1
View ch1_answers.c
///////////////////////////////////////////////////////////////////////////////
//
// p11
//
//////////////////////////////// 1
; ASM
edi = s->0x8_charp
edx = edi
eax = 0
View Invoke-Mimikidz
This file has been truncated, but you can view the full file.
function Invoke-Mimikidz
{
<#
.SYNOPSIS
This script leverages Mimikatz 2.0 and Invoke-ReflectivePEInjection to reflectively load Mimikatz completely in memory. This allows you to do things such as
dump credentials without ever writing the mimikatz binary to disk.
The script has a ComputerName parameter which allows it to be executed against multiple computers.
This script should be able to dump credentials from any version of Windows through Windows 8.1 that has PowerShell v2 or higher installed.
View Invoke-BypassingMimikatz.ps1
#
function Invoke-Mimikatz
{
<#
.SYNOPSIS
This script leverages Mimikatz 2.0 and Invoke-ReflectivePEInjection to reflectively load Mimikatz completely in memory. This allows you to do things such as
dump credentials without ever writing the mimikatz binary to disk.
The script has a ComputerName parameter which allows it to be executed against multiple computers.
View bochsrc2.4.6.bxrc
# configuration file generated by Bochs
plugin_ctrl: unmapped=1, biosdev=1, speaker=1, extfpuirq=1, gameport=1, pci_ide=1, acpi=1, ioapic=1
config_interface: win32config
display_library: win32, options="gui_debug"
memory: host=1024, guest=1024
romimage: file="C:\Program Files (x86)\Bochs-2.4.6\BIOS-bochs-latest"
vgaromimage: file="C:\Program Files (x86)\Bochs-2.4.6\VGABIOS-lgpl-latest"
boot: cdrom, disk
floppy_bootsig_check: disabled=0
# no floppya
View run.bat
set TARGET_BXRC=bochsrc2.4.6
set BXSHARE=C:\Program Files (x86)\Bochs-2.4.6
set IDABASE=C:\Program Files (x86)\IDA
"%IDABASE%\idaq.exe" -c -A -OIDAPython:mbr.py %TARGET_BXRC%.bxrc
"%IDABASE%\idaq.exe" -rbochs %TARGET_BXRC%.idb
View GuestAgent.c
/*!
@file GuestAgent.c
@brief GuestAgent code.
@author Satoshi Tanda
@copyright Copyright (c) 2020 - , Satoshi Tanda. All rights reserved.
*/
#include "GuestAgent.h"
@tandasat
tandasat / list_first_instruction.py
Created Jun 26, 2021
IDA script to show the first instruction of the all functions
View list_first_instruction.py
from idautils import *
from idaapi import *
from idc import *
for funcea in Functions():
functionName = get_func_name(funcea)
for (startea, endea) in Chunks(funcea):
print(f"{startea:08x} {GetDisasm(startea)} : {functionName}")
@tandasat
tandasat / CheckGuestVmcsFieldsForVmEntry.c
Last active Jul 24, 2021
Simulation of checks performed as per 26.3 CHECKING AND LOADING GUEST STATE
View CheckGuestVmcsFieldsForVmEntry.c
/**
* @file CheckGuestVmcsFieldsForVmEntry.c
* @author Satoshi Tanda (tanda.sat@gmail.com)
* @brief Checks validity of the guest VMCS fields for VM-entry as per
* 26.3 CHECKING AND LOADING GUEST STATE
* @version 0.1
* @date 2021-02-20
*
* @details This file implements part of checks performed by a processor during
* VM-entry as CheckGuestVmcsFieldsForVmEntry(). This can be called on VM-exit