Willi Ballenthin williballenthin

## carvepe.py
#!/usr/bin/env python2
'''
Carve PE files from binary data.
Write them into the current directy named after their hash.

Example::

    $ python carvepe.py unallocated.bin
      INFO:__main__:found pe at 0x0, length: 0xd8000
      INFO:__main__:writing pe file to 273ed32b617fd79ed1b88ebd4521a441.bin

## realign_pe_sections.py
#!/usr/bin/env python2
'''
some documentation
author: Willi Ballenthin
email: willi.ballenthin@gmail.com
website: https://gist.github.com/williballenthin/d43cbc98fa127211c9099f46d2e73d2c
'''
import sys
import logging
from collections import namedtuple

## auto_shellcode_hashes.py
import os
import sys
import logging

import pefile
import ucutils
import unicorn
import capstone
import argparse

## gist:56d52e110f8652a303bdc6ab55c3d1b1
eval (ssh-agent -c)
    set -Ux SSH_AUTH_SOCK $SSH_AUTH_SOCK
    set -Ux SSH_AGENT_PID $SSH_AGENT_PID

## stackstrings.yara
rule stack_strings
{
    meta:
        author = "William Ballenthin"
        email = "william.ballenthin@fireeye.com"
        license = "Apache 2.0"
        copyright = "FireEye, Inc"
        description = "Match x86 that appears to be stack string creation."

    strings:

## Microsoft-Windows-Sysmon-schema.txt
# generate via: wevtutil gp Microsoft-Windows-Sysmon /getevents /getmessage

name: Microsoft-Windows-Sysmon
guid: 5770385f-c22a-43e0-bf4c-06f5698ffbd9
helpLink:
resourceFileName: C:\Windows\Sysmon.exe
messageFileName: C:\Windows\Sysmon.exe
message:
channels:
  channel:

## get-windows-api.ipynb

      
              2 files
            
          
              4 forks
            
          
              1 comment
            
          
              6 stars
            
          
                williballenthin
                / get-windows-api.ipynb
            
            
              Last active
              March 18, 2023 10:46
            
              
                Extract the exported symbols from a typical Windows installation
              
          
      Sorry, something went wrong. Reload?
      Sorry, we cannot display this file.
      Sorry, this file is invalid so it cannot be displayed.
      
          Viewer requires iframe.
      
    
## flare-on-6__extract_buffer.py
from idaapi import *

GEN_REG = 0x1
MEM_REF = 0x2
BASE_INDEX = 0x3
BASE_INDEX_DISP = 0x4
IMMED = 0x5

def doone(ea):
    xrefs = []

## DotnetStartupHook.yar
import "dotnet"

rule DotnetStartupHook {
  meta:
    description = "might be a .NET startup hook module"
    author = "William Ballenthin <william.ballenthin@mandiant.com>"
  strings:
     $a1 = "StartupHook"
     $a2 = "Initialize"
  condition:

## macOS_keychain.py
#!/usr/bin/env python3
'''
bling.py - extract keys from macOS keychains.

installation:
  pip install pytz hexdump vivisect-vstruct-wb tabulate argparse pycryptodome

usage:
  python bling.py /path/to/keychain-db <password> ./path/to/output/directory
	#!/usr/bin/env python2
	'''
	Carve PE files from binary data.
	Write them into the current directy named after their hash.

	Example::

	$ python carvepe.py unallocated.bin
	INFO:__main__:found pe at 0x0, length: 0xd8000
	INFO:__main__:writing pe file to 273ed32b617fd79ed1b88ebd4521a441.bin
	#!/usr/bin/env python2
	'''
	some documentation
	author: Willi Ballenthin
	email: willi.ballenthin@gmail.com
	website: https://gist.github.com/williballenthin/d43cbc98fa127211c9099f46d2e73d2c
	'''
	import sys
	import logging
	from collections import namedtuple
	import os
	import sys
	import logging

	import pefile
	import ucutils
	import unicorn
	import capstone
	import argparse
	eval (ssh-agent -c)
	set -Ux SSH_AUTH_SOCK $SSH_AUTH_SOCK
	set -Ux SSH_AGENT_PID $SSH_AGENT_PID
	rule stack_strings
	{
	meta:
	author = "William Ballenthin"
	email = "william.ballenthin@fireeye.com"
	license = "Apache 2.0"
	copyright = "FireEye, Inc"
	description = "Match x86 that appears to be stack string creation."

	strings:
	# generate via: wevtutil gp Microsoft-Windows-Sysmon /getevents /getmessage

	name: Microsoft-Windows-Sysmon
	guid: 5770385f-c22a-43e0-bf4c-06f5698ffbd9
	helpLink:
	resourceFileName: C:\Windows\Sysmon.exe
	messageFileName: C:\Windows\Sysmon.exe
	message:
	channels:
	channel:
	from idaapi import *

	GEN_REG = 0x1
	MEM_REF = 0x2
	BASE_INDEX = 0x3
	BASE_INDEX_DISP = 0x4
	IMMED = 0x5

	def doone(ea):
	xrefs = []
	import "dotnet"

	rule DotnetStartupHook {
	meta:
	description = "might be a .NET startup hook module"
	author = "William Ballenthin <william.ballenthin@mandiant.com>"
	strings:
	$a1 = "StartupHook"
	$a2 = "Initialize"
	condition:
	#!/usr/bin/env python3
	'''
	bling.py - extract keys from macOS keychains.

	installation:
	pip install pytz hexdump vivisect-vstruct-wb tabulate argparse pycryptodome

	usage:
	python bling.py /path/to/keychain-db <password> ./path/to/output/directory