w4kfu

# Changes added _After_ Pin 2.12 / 54730
# ===========================================
# ...
#   Nmake is no longer supported on windows. Either use make or the example vcproj file in the
#   MyPinTool directory.
# ...


PIN_PATH        = <PATH_2_PIN>

w4kfu

import struct
from capstone import *

# PACKETS FROM https://www.reddit.com/r/REGames/comments/3tlmi2/reverseengineering_realm_onlines_game_protocol/
packet_00 = [
    0x78, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0xDC, 0xED, 0xA3, 0x5F,
    0x85, 0x48, 0x8F, 0xA9, 0x83, 0x13, 0xFA, 0xE4, 0x21, 0x48, 0x9D, 0xE4,
    0x3E, 0x46, 0xB2, 0xDC, 0xF6, 0xC1, 0x26, 0x20, 0x34, 0x7E, 0x8C, 0x5B,
    0xEB, 0xBD, 0xA3, 0x59, 0x30, 0x5E, 0xF3, 0x59, 0x30, 0xBD, 0xD6, 0x77,
    0xD5, 0xB4, 0xC8, 0xAD, 0x30, 0xBD, 0xA3, 0x5E, 0x31, 0xBD, 0xA3, 0x59,

w4kfu

# Lempel-Ziv-Stac (LZS) decompression
# Implementation found in sciw.exe

class LZSBitReader:
    def __init__(self, bytes):
        self.bytes = bytes
        self.gen = self.generator(bytes)

    def generator(self, bts):
        for b in bts:

w4kfu

#include <windows.h>
#include <stdio.h>
#include <tbs.h>
#pragma comment(lib, "Tbs.lib")
#pragma comment(lib, "Ws2_32.lib")

#define TPM_DIGEST_SIZE             20

#define TPM_TAG_RQU_COMMAND         ((UINT16)0x00C1)
#define TPM_TAG_RSP_COMMAND         ((UINT16)0x00C4)

w4kfu

from Crypto.Hash import MD5
from Crypto.Cipher import DES

d_password = "PBE.class"
d_salt = "\xC7\x73\x21\x8C\x7E\xC8\xEE\x99"

def unpad_pkcs7(text, blocklength=16):
    full_len = len(text)
    pad_val = ord(text[-1])
    pos = full_len - pad_val

w4kfu

/*

-------- dllinjshim.cpp --------

> cl /Fe:dllinjshim.exe dllinjshim.cpp
> dllinjshim.exe
> sdbinst moo.sdb

/!\ On Windows 10 there is a new function `SdbIsKnownShimDll` called 
in `SdbGetDllPath` which will check the DLL name against the following list:

w4kfu

from z3 import *

init(PATH_TO_Z3)

# >rao_bash.py
# 4sM1s:1f3_Fl4gzZ
# 4sM1s 1f3_Fl4gzZ
# 4sM1s 1f3(Fl4gzZ
# 4sM1s:1f3(Fl4gzZ
# 4sM1s@1f3_Fl4gzZ

w4kfu

def is_ida69():
    major, minor = map(int, idaapi.get_kernel_version().split("."))
    return (major == 6 and minor >= 9)

def clear_output_window():
    # IDA 6.9 drop PySide in favor of PyQt5
    if is_ida69():
        from PyQt5 import QtGui, QtCore, QtWidgets
        form = idaapi.find_tform("Output window")
        w = idaapi.PluginForm.FormToPyQtWidget(form)

w4kfu

import subprocess
import sys

ACE_TYPE = {
    "A"  : "ACCESS_ALLOWED_ACE_TYPE",
    "D"  : "ACCESS_DENIED_ACE_TYPE",
    "OA" : "ACCESS_ALLOWED_OBJECT_ACE_TYPE",
    "OD" : "ACCESS_DENIED_OBJECT_ACE_TYPE",
    "AU" : "SYSTEM_AUDIT_ACE_TYPE",
    "AL" : "SYSTEM_ALARM_ACE_TYPE",

w4kfu

@echo off
cls

set IDA_PATH="UDPATE THE PATH TO IDA TEXT INTERFACE .exe"

set arg1=%1

set idc_file=%tmp%\moo.idc
echo #include ^<idc.idc^>>%idc_file%
echo static main()>>%idc_file%