Skip to content

Instantly share code, notes, and snippets.

View wumb0's full-sized avatar

wumb0 wumb0

164 followers · 12 following
View GitHub Profile
@wumb0
wumb0 / CodeCoverage.cpp
Last active November 6, 2022 21:29
slightly modified lighthouse coverage PIN tool, updated build script to work with PIN 3.21
#include <iostream>
#include <set>
#include <string>
#include <vector>
#include <utility>
#include <iterator>
#include <algorithm>
#include <cstdio>
#include <cstdarg>
#include <cstdlib>
@wumb0
wumb0 / drcov-3-to-2.py
Last active October 25, 2023 06:50
convert a drcov version 3 file to drcov version 2 for lighthouse
"""
drcov version 3 isn't supported by lighthouse :(
convert drcov version 3 with module table version 5 to drcov version 2
with module table version 2 so lighthouse will eat it!
"""
import sys
import re
@wumb0
wumb0 / frida-drcov.py
Last active February 8, 2022 18:14
more optimized frida drcov script for lighthouse that monitors windows targets for new threads and modules
#!/usr/bin/env python
from __future__ import print_function
import argparse
import json
import os
import sys
import threading
import functools
@wumb0
wumb0 / asmul8r.py
Created November 29, 2020 18:33
command line assembly emulator that allows you to quickly see the results of instructions
# requires keystone-engine, capstone, prompt_toolkit, and pygments
import keystone as ks
import unicorn as uc
import math
import sys
from pygments.lexers.asm import NasmLexer
from pygments.styles import get_style_by_name
from prompt_toolkit.shortcuts import prompt
@wumb0
wumb0 / PatchExtract.ps1
Last active March 22, 2024 16:49
a gist copy of patch extract by Greg Lanaris
<#
____ ______ ______ ____ __ __
/\ _`\ /\ _ \ /\__ _\/\ _`\ /\ \/\ \
\ \ \L\ \\ \ \L\ \\/_/\ \/\ \ \/\_\\ \ \_\ \
\ \ ,__/ \ \ __ \ \ \ \ \ \ \/_/_\ \ _ \
\ \ \/ \ \ \/\ \ \ \ \ \ \ \L\ \\ \ \ \ \
\ \_\ \ \_\ \_\ \ \_\ \ \____/ \ \_\ \_\
\/_/ \/_/\/_/ \/_/ \/___/ \/_/\/_/
@wumb0
wumb0 / delta_patch.py
Last active February 20, 2024 23:13
a script for applying MS patch deltas
from ctypes import (windll, wintypes, c_uint64, cast, POINTER, Union, c_ubyte,
LittleEndianStructure, byref, c_size_t)
import zlib
# types and flags
DELTA_FLAG_TYPE = c_uint64
DELTA_FLAG_NONE = 0x00000000
DELTA_APPLY_FLAG_ALLOW_PA19 = 0x00000001
@wumb0
wumb0 / BannedFunctions.py
Created November 18, 2019 15:33
# This script is a simple script to locate functions within a program
# that are on the Microsoft "banned functions list" inside of banned.h
#@author Jaime Geiger
#@category Vulnerability Research
#@keybinding Ctrl-Shift-Alt-B
#@menupath Tools.Plugins.Banned Functions
banned = ["strcpy","strcpyA","strcpyW","wcscpy","_tcscpy","_mbscpy","StrCpy","StrCpyA","StrCpyW","lstrcpy","lstrcpyA","lstrcpyW","_tccpy","_mbccpy","_ftcscpy","strcat","strcatA","strcatW","wcscat","_tcscat","_mbscat","StrCat","StrCatA","StrCatW","lstrcat","lstrcatA","lstrcatW","StrCatBuff","StrCatBuffA","StrCatBuffW","StrCatChainW","_tccat","_mbccat","_ftcscat","wvsprintf","wvsprintfA","wvsprintfW","vsprintf","_vstprintf","vswprintf","strncpy","wcsncpy","_tcsncpy","_mbsncpy","_mbsnbcpy","StrCpyN","StrCpyNA","StrCpyNW","StrNCpy","strcpynA","StrNCpyA","StrNCpyW","lstrcpyn","lstrcpynA","lstrcpynW","strncat","wcsncat","_tcsncat","_mbsncat","_mbsnbcat","StrCatN","StrCatNA","StrCatNW","StrNCat","StrNCatA","StrNCatW","lstrncat","lstrcatnA","lstrcatnW"
@wumb0
wumb0 / indexer.py
Last active February 27, 2018 05:51
helps index stuff for exams... if they don't give you an index, or the one they provide is bad. tweak as you see fit.
from sqlalchemy import create_engine, Column, Integer, String, func
from sqlalchemy.orm import sessionmaker
from sqlalchemy.ext.declarative import declarative_base
from reportlab.lib.pagesizes import letter
from reportlab.lib.units import cm
from reportlab.pdfgen import canvas
from reportlab.pdfbase.pdfmetrics import stringWidth
import sys
try:
@wumb0
wumb0 / MonitorMalware.ps1
Last active May 16, 2020 00:05
WMI consumer and filter that trigger on a windows defender malware alert with details
$argss = @{Name="MonitorMalwareFilt";QueryLanguage="WQL";Query="select * from __instancecreationevent within 5 where targetinstance isa 'Malware'";EventNamespace="root\Microsoft\SecurityClient"}
$filt = Set-WmiInstance -Namespace root/subscription -Class __EventFilter -Arguments $argss
$argss = @{Name="MonitorMalwareCons";CommandLineTemplate="msg * Malware: %TargetInstance.ThreatName% from %TargetInstance.User% at %TargetInstance.Path% (Severity: %TargetInstance.SeverityID%)"}
$cons = Set-WmiInstance -Namespace root/subscription -Class CommandLineEventConsumer -Arguments $argss
$argss = @{Filter=$filt;Consumer=$cons}
Set-WmiInstance -Namespace root/subscription -Class __FilterToConsumerBinding -Arguments $argss
@wumb0
wumb0 / Set-WmiNamespaceSecurity.ps1
Last active October 17, 2017 02:57 — forked from exchange12rocks/Set-WmiNamespaceSecurity.ps1
# Copyright (c) Microsoft Corporation. All rights reserved.
# For personal use only. Provided AS IS and WITH ALL FAULTS.
# Set-WmiNamespaceSecurity.ps1
# Example: Set-WmiNamespaceSecurity root/cimv2 add steve Enable,RemoteAccess
# https://blogs.msdn.microsoft.com/wmi/2009/07/27/scripting-wmi-namespace-security-part-3-of-3/
function Set-WmiNamespaceSecurity {
Param (