Skip to content

Instantly share code, notes, and snippets.

View muffins's full-sized avatar

Nick Anderson muffins

150 followers · 58 following
View GitHub Profile
@mike-myers-tob
mike-myers-tob / Working GDB on macOS 11.md
Last active June 13, 2024 15:27
Steps to get GDB actually working in April 2021 on macOS (Intel x86-64 only)

Debug with GDB on macOS 11

The big reason to do this is that LLDB has no ability to "follow-fork-mode child", in other words, a multi-process target that doesn't have a single-process mode (or, a bug that only manifests when in multi-process mode) is going to be difficult or impossible to debug, especially if you have to run the target over and over in order to make the bug manifest. If you have a repeatable bug, no big deal, break on the fork from the parent process and attach to the child in a second lldb instance. Otherwise, read on.

Install GDB

Don't make the mistake of thinking you can just brew install gdb. Currently this is version 10.2 and it's mostly broken, with at least two annoying bugs as of April 29th 2021, but the big one is https://sourceware.org/bugzilla/show_bug.cgi?id=24069

$ xcode-select install  # install the XCode command-line tools
@directionless
directionless / README.md
Last active May 19, 2022 07:47
osquery manual release notes
@icecr4ck
icecr4ck / idapython_cheatsheet.md
Last active September 4, 2024 16:25
Cheatsheet for IDAPython
@stecman
stecman / dump-pyc-with-gdb.md
Last active July 1, 2024 16:56
Dumping all bytecode from a packaged Python application

This is a technique for extracting all imported modules from a packaged Python application as .pyc files, then decompiling them. The target program needs to be run from scratch, but no debugging symbols are necessary (assuming an unmodified build of Python is being used).

This was originally performed on 64-bit Linux with a Python 3.6 target. The Python scripts have since been updated to handle pyc files for Python 2.7 - 3.9.

Theory

In Python we can leverage the fact that any module import involving a .py* file will eventually arrive as ready-to-execute Python code object at this function:

PyObject* PyEval_EvalCode(PyObject *co, PyObject *globals, PyObject *locals);
@wxsBSD
wxsBSD / gist:2936585412fd57f039fd7ecd7b24cd1b
Created May 21, 2018 01:16
/*
* fmtid + 24 == number of property identifiers and offsets
* fmtid + 28 == start of property identifier and offsets (4 bytes each)
*/
rule test {
strings:
//$fmtid = { 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae }
$fmtid = { e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 }
$redacted_author = "REDACTED AUTHOR"
condition:
@kukfa
kukfa / hexjump.py
Created August 14, 2017 07:44
IDA plugin to easily follow DWORD addresses within hex dump
import idaapi
import idc
class HexJumpHandler(idaapi.action_handler_t):
def activate(self, ctx):
selection = idaapi.read_selection()
valid_selection = selection[0]
if (valid_selection):
addr = idc.DbgDword(selection[1])
@jessesquires
jessesquires / gitsl.sh
Last active August 9, 2024 13:43
git "smartlog" / "pretty log"
# blog post
#
# https://www.jessesquires.com/blog/customizing-git-log/
git log --graph --pretty=format:'commit: %C(bold red)%h%Creset %C(red)<%H>%Creset %C(bold magenta)%d %Creset%ndate: %C(bold yellow)%cd %Creset%C(yellow)%cr%Creset%nauthor: %C(bold blue)%an%Creset %C(blue)<%ae>%Creset%n%C(cyan)%s%n%Creset'
@techbliss
techbliss / gist:d6c0002325da01470d3321cc8c218b81
Created November 26, 2016 18:43
Solarized dark background
[Colors]
AbstractTableViewBackgroundColor=#002B36
AbstractTableViewHeaderTextColor=#657B83
AbstractTableViewSelectionColor=#073642
AbstractTableViewSeparatorColor=#808080
AbstractTableViewTextColor=#657B83
DisassemblyAddressBackgroundColor=#002B36
DisassemblyAddressColor=#657B83
DisassemblyAutoCommentBackgroundColor=#XXXXXX
DisassemblyAutoCommentColor=#85833A
@HarmJ0y
HarmJ0y / RC4.ps1
Last active August 30, 2022 15:03
PowerShell RC4 Implementation
function ConvertTo-Rc4ByteStream {
<#
.SYNOPSIS
Converts an input byte array to a RC4 cipher stream using the specified key.
Author: @harmj0y
License: BSD 3-Clause
Required Dependencies: None
Optional Dependencies: None
@mattifestation
mattifestation / autodump_powershell_process.ps1
Last active September 16, 2019 04:58
Automatically capture a full PowerShell memory dump upon any PowerShell host process termination
$EventFilterArgs = @{
EventNamespace = 'root/cimv2'
Name = 'PowerShellProcessStarted'
Query = 'SELECT FileName, ProcessID FROM Win32_ModuleLoadTrace WHERE FileName LIKE "%System.Management.Automation%.dll"'
QueryLanguage = 'WQL'
}
$Filter = New-CimInstance -Namespace root/subscription -ClassName __EventFilter -Property $EventFilterArgs
$CommandLineConsumerArgs = @{