Skip to content

Instantly share code, notes, and snippets.

View williballenthin's full-sized avatar

Willi Ballenthin williballenthin

969 followers · 62 following
View GitHub Profile
@williballenthin
williballenthin / yet another radare2 cheatsheet.md
Last active April 20, 2024 23:27

radare2

load without any analysis (file header at offset 0x0): r2 -n /path/to/file

  • analyze all: aa
  • show sections: iS
  • list functions: afl
  • list imports: ii
  • list entrypoints: ie
  • seek to function: s sym.main
@williballenthin
williballenthin / macOS_savedstate.py
Last active April 20, 2024 21:13
parse macOS savedState files
'''
parse SavedState artifacts extracted from OSX.
author: Willi Ballenthin (william.ballenthin@fireeye.com)
license: Apache 2.0
'''
import re
import sys
import json
import struct
@williballenthin
williballenthin / peb_parsing.md
Last active April 18, 2024 03:55

manual import resolution

example from 0f5d5d07c6533bc6d991836ce79daaa1:

_0:00F20012 33 D2                   xor     edx, edx
_0:00F20014 64 8B 52 30             mov     edx, fs:[edx+30h] // TEB->PEB
_0:00F20018 8B 52 0C                mov     edx, [edx+0Ch]    // PEB->LDR_DATA
_0:00F2001B 8B 52 14                mov     edx, [edx+14h]    // LDR_DATA->InMemoryOrderLinks (_LDR_DATA_TABLE_ENTRY)
                                                              // alt: 0xC: InLoadOrderLinks
 // alt: 0x1C: InInitializationOrderLinks
@williballenthin
williballenthin / hint_calls.py
Last active April 4, 2024 03:40
'''
IDA plugin to display the calls and strings referenced by a function as hints.
Installation: put this file in your %IDADIR%/plugins/ directory.
Author: Willi Ballenthin <william.ballenthin@fireeye.com>
Licence: Apache 2.0
'''
import idc
import idaapi
import idautils
@williballenthin
williballenthin / commands.sh
Last active April 3, 2024 00:50
Install IDA Pro under Wine in Docker
# build wine Docker image
pushd wine; docker build -t wine .; popd
# build x11 Docker image for IDA
pushd ida; docker build -t wine/ida .; popd
# demonstrate x11 forwarding works
docker run -ti --rm -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix wine/ida xclock
# interactive shell in container
@williballenthin
williballenthin / .gdbinit
Last active March 14, 2024 19:20
yet another gdb cheatsheet
set disassembly-flavor intel
set disassemble-next-line on
set history save on
set print pretty on
set pagination off
set confirm off
define xxd
dump binary memory dump.bin $arg0 $arg0+$arg1
@williballenthin
williballenthin / clicker.py
Last active March 5, 2024 14:32
respond to button clicks in IDA Pro
import re
import collections
import idaapi
import ida_kernwin
class button_hooks_t(ida_kernwin.View_Hooks):
def __init__(self, v):
'''
@williballenthin
williballenthin / deob_opaque_predicate.py
Created July 28, 2020 19:58
search for and patch out known opaque predicates within IDA Pro workspaces.
"""
search for and patch out known opaque predicates within IDA Pro workspaces.
just run the script and it will manipulate the open database.
therefore, you should probably create a backup first.
"""
import logging
from pprint import pprint
import ida_idp
@williballenthin
williballenthin / PGPy+usage.ipynb
Last active January 29, 2024 15:28
example of using PGPy for creating and verifying digital signatures
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
@williballenthin
williballenthin / functions_as_data.py
Created July 30, 2018 21:03
IDA Pro script to identify functions that are referenced as data.
'''
Identify functions that are referenced as data.
For example, something weird is going on below::
.text:10001833 BE 60 25 00 10 mov esi, offset sub_10002560 <<<<
.text:10001838 8B 45 FC mov eax, [ebp+var_4]
.text:1000183B 89 5F 04 mov [edi+4], ebx
.text:1000183E 81 C7 18 02 00 00 add edi, 218h
.text:10001844 F3 A5 rep movsd