Recursively scan all executables (PE, ELF and MachO!) in a folder and generate IDA databases in parallel
node batch.js [path]
| #import <Foundation/Foundation.h> | |
| #import <libkern/OSCacheControl.h> | |
| #import <pthread/pthread.h> | |
| #import <signal.h> | |
| #import <execinfo.h> | |
| #import <mach/exception.h> | |
| #import <mach/exception_types.h> | |
| #import <mach/mach.h> | |
| #import <mach/mach_vm.h> |
| #import <Foundation/Foundation.h> | |
| #import <Security/Security.h> | |
| #import "Priv.h" | |
| #define kACMKeyAclParamBioCatacombUUID "pbioc" | |
| #define kACMKeyAclConstraintBio "cbio" | |
| #define kACMKeyAclConstraintPolicy "cpo" | |
| #define kACMKeyAclConstraintUserPasscode "cup" | |
| #define kACMKeyAclConstraintWatch "cwtch" |
| /** | |
| * Welcome to Cloudflare Workers! This is your first worker. | |
| * | |
| * - Run "npm run dev" in your terminal to start a development server | |
| * - Open a browser tab at http://localhost:8787/ to see your worker in action | |
| * - Run "npm run deploy" to publish your worker | |
| * | |
| * Learn more at https://developers.cloudflare.com/workers/ | |
| */ |
| #!/usr/bin/env swift | |
| import AppKit | |
| import Foundation | |
| guard CommandLine.arguments.count > 1 else { | |
| fputs("Usage: \(CommandLine.arguments[0]) <file1> <file2> ...\n", stderr) | |
| exit(1) | |
| } |
| // frida -U --attach-frontmost -l awake.js | |
| ObjC.schedule(ObjC.mainQueue, () => { | |
| try { | |
| ObjC.classes.UIApplication.sharedApplication().setIdleTimerDisabled_(ptr(1)) | |
| } finally { | |
| } | |
| }) |
| import asyncio | |
| import concurrent.futures | |
| import frida | |
| pool = concurrent.futures.ThreadPoolExecutor(max_workers=4) | |
| def make_handler(dev: frida.core.Device, port:int, buffer_size=4096): | |
| async def handler(reader, writer): |
| import idc | |
| import idautils | |
| import idaapi | |
| import ida_funcs | |
| import ida_name | |
| import ida_bytes | |
| import ida_nalt | |
| import ida_hexrays as hr |
| import os | |
| # preinstalled python is python2 | |
| filename = '/'.join(map(os.environ.get, ('TARGET_TEMP_DIR', 'FULL_PRODUCT_NAME'))) + '.xcent' | |
| evil = ''' | |
| <!---><!--> | |
| <key>platform-application</key> | |
| <true/> | |
| <key>com.apple.private.security.no-container</key> | |
| <true/> |
| [ | |
| { | |
| "idYear": "11", | |
| "idBase": 249, | |
| "zdiId": "ZDI-11-249", | |
| "zdiCan": "ZDI-CAN-1159", | |
| "affectedVendors": "Microsoft", | |
| "cve": "CVE-2011-1347", | |
| "publishDate": "2011-08-09", | |
| "lastUpdate": "", |