Skip to content

Instantly share code, notes, and snippets.

from dff.api.types.libtypes import Parameter, Argument, typeId, Variant, VMap, VList
from dff.api.module.module import Module
from dff.api.module.script import Script
from dff.api.events.libevents import EventHandler
from dff.api.filters.libfilters import Filter
from dff.api.vfs.libvfs import ABSOLUTE_ATTR_NAME
class DemoExport(Script, EventHandler):
def __init__(self):
@udgover
udgover / tcpip_vtypes.py
Created October 4, 2019 12:00
Adds correct EPROCESS offset in TCP_ENDPOINT struct for Win10 17134
class Win10Tcpip(obj.ProfileModification):
before = ['Win8Tcpip']
conditions = {'os': lambda x: x == 'windows',
'memory_model': lambda x: x == '32bit',
'major': lambda x : x == 6,
'minor': lambda x : x >= 4}
def modification(self, profile):
profile.merge_overlay({
'_ADDRINFO' : [ None, {
'Local' : [ 0x0, ['pointer', ['_LOCAL_ADDRESS']]],
@udgover
udgover / encrypted_archive.py
Created June 2, 2020 11:44
Examples to deal with PyEasyArchive encrypted archives reading and writing
import libarchive.public
import libarchive.constants
import libarchive.adapters.archive_read
import hashlib
import os
import shutil
# from https://stackoverflow.com/a/1094933
def sizeof_fmt(num, suffix='B'):
### Keybase proof
I hereby claim:
* I am udgover on github.
* I am udgover (https://keybase.io/udgover) on keybase.
* I have a public key ASAKRK3L9kp37lPEU6GPOaDhetnLfSJz3Yb_kU5Ek-065Qo
To claim this, I am signing this object: