w4kfu

import struct
import wave
import argparse

amplitude_lookuptable = [
0x0000, 0x0001, 0x0002, 0x0003, 0x0004, 0x0005, 0x0006, 0x0007,
0x0008, 0x0009, 0x000A, 0x000B, 0x000C, 0x000D, 0x000E, 0x0010,
0x0011, 0x0013, 0x0015, 0x0017, 0x0019, 0x001C, 0x001F, 0x0022,
0x0025, 0x0029, 0x002D, 0x0032, 0x0037, 0x003C, 0x0042, 0x0049,
0x0050, 0x0058, 0x0061, 0x006B, 0x0076, 0x0082, 0x008F, 0x009D,

w4kfu

from z3 import *

def display_model(m):
    block = {}
    for x in m:
        if str(x)[0] == "p":
            block[int(str(x)[1:])] = int(str(m[x]))
    password = "".join(map(chr, block.values()))
    print password

w4kfu

import ctypes

def convert_bytes_to_structure(st, byte):
    ctypes.memmove(ctypes.addressof(st), byte, ctypes.sizeof(st))

def s2n(s):
    if not len(s):
        return 0
    return int(s.encode("hex"), 16)

w4kfu

import argparse
import ctypes
import os

HANDLE                              = ctypes.c_void_p
HMODULE                             = HANDLE
DWORD                               = ctypes.c_uint
DWORD64                             = ctypes.c_uint64
PVOID                               = ctypes.c_void_p
BOOL                                = ctypes.c_bool

w4kfu

import idc
import idautils
import idaapi

import struct

# > copy idapythonrc.py %APPDATA%\Hex-Rays\IDA Pro\idapythonrc.py

def myreload():
    """

w4kfu

@echo off
cls

set IDA_PATH="UDPATE THE PATH TO IDA TEXT INTERFACE .exe"

set arg1=%1

set idc_file=%tmp%\moo.idc
echo #include ^<idc.idc^>>%idc_file%
echo static main()>>%idc_file%

w4kfu

import subprocess
import sys

ACE_TYPE = {
    "A"  : "ACCESS_ALLOWED_ACE_TYPE",
    "D"  : "ACCESS_DENIED_ACE_TYPE",
    "OA" : "ACCESS_ALLOWED_OBJECT_ACE_TYPE",
    "OD" : "ACCESS_DENIED_OBJECT_ACE_TYPE",
    "AU" : "SYSTEM_AUDIT_ACE_TYPE",
    "AL" : "SYSTEM_ALARM_ACE_TYPE",

w4kfu

def is_ida69():
    major, minor = map(int, idaapi.get_kernel_version().split("."))
    return (major == 6 and minor >= 9)

def clear_output_window():
    # IDA 6.9 drop PySide in favor of PyQt5
    if is_ida69():
        from PyQt5 import QtGui, QtCore, QtWidgets
        form = idaapi.find_tform("Output window")
        w = idaapi.PluginForm.FormToPyQtWidget(form)

w4kfu

from z3 import *

init(PATH_TO_Z3)

# >rao_bash.py
# 4sM1s:1f3_Fl4gzZ
# 4sM1s 1f3_Fl4gzZ
# 4sM1s 1f3(Fl4gzZ
# 4sM1s:1f3(Fl4gzZ
# 4sM1s@1f3_Fl4gzZ

w4kfu

/*

-------- dllinjshim.cpp --------

> cl /Fe:dllinjshim.exe dllinjshim.cpp
> dllinjshim.exe
> sdbinst moo.sdb

/!\ On Windows 10 there is a new function `SdbIsKnownShimDll` called 
in `SdbGetDllPath` which will check the DLL name against the following list: