helloobaby

137 followers · 20 following

View GitHub Profile

Recently created

Least recently created

Recently updated

Least recently updated

helloobaby / main.cpp

Created January 3, 2023 04:30

	//sender

	#include <ntifs.h>


	#define CALLBACKNAME L"\\Callback\\driverStart"

	VOID UnloadDriver(PDRIVER_OBJECT driver);

	VOID MyThread(PVOID context);

helloobaby / main.c

Created December 22, 2022 13:36

	#include<ntifs.h>
	#include<ntddk.h>
	#include<wdm.h>

	#include "symcrypt.h"

	template<typename... types>
	void print(types... args)
	{
	DbgPrintEx(DPFLTR_DEFAULT_ID, DPFLTR_ERROR_LEVEL, args...);

helloobaby / main.cpp

Created November 30, 2022 12:08

minifilter InstanceSetup

	#include"minifilter.h"

	namespace minifilter {

	// minifilter加载的时候会给每个卷都挂载上
	NTSTATUS InstanceSetup(_In_ PCFLT_RELATED_OBJECTS FltObjects,
	_In_ FLT_INSTANCE_SETUP_FLAGS Flags,
	_In_ DEVICE_TYPE VolumeDeviceType,
	_In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType) {
	PAGED_CODE();

helloobaby / 1.c

Created November 22, 2022 05:30

zydis v4

	ZydisDisassembledInstruction insn;
	ZydisDisassembleIntel(ZYDIS_MACHINE_MODE_LONG_COMPAT_32, (ZyanU64)ip, ip,
	15, &insn);
	ZyanU64 ResultAddress;
	if (insn.info.mnemonic == ZYDIS_MNEMONIC_CALL) {
	ZydisCalcAbsoluteAddress(&insn.info, insn.operands, (ZyanU64)ip,
	&ResultAddress);

	TraceFile << hex << "ip : ResultAddress " << ip << "\t" << ResultAddress
	<< endl;

helloobaby / main.cpp

Created November 8, 2022 11:05

python 模拟执行部分代码

	import unicorn
	import pefile
	import capstone

	# 要分析的样本路径
	sample_file_path = 'C:\\Users\\asdf\\Desktop\\a9542676ee9a25c64a9fec1466664511f6059b51d8192025f95855b02ffe9620\\' \
	'a9542676ee9a25c64a9fec1466664511f6059b51d8192025f95855b02ffe9620.malware'

	# 初始化unicorn
	uc = unicorn.Uc(unicorn.UC_ARCH_X86, unicorn.UC_MODE_32)

helloobaby / main.cpp

Created November 7, 2022 06:46

	/*
	sub_4220B0
	字符串动态解密 demo

	*/


	#include <iostream>
	#include <windows.h>
	#include <memory>

helloobaby / main.cpp

Created November 1, 2022 02:24

测量 win api和c++标准库的字符集转换性能 (API性能好一倍多)

	#include <benchmark/benchmark.h>
	#include <iostream>
	#include <codecvt>
	#include <windows.h>
	#pragma comment(lib,"Shlwapi.lib")

	wchar_t Curl_convert_UTF8_to_wchar(const char str_utf8) {
	wchar_t *str_w = NULL;

	if (str_utf8) {

helloobaby / main.rs

Created October 28, 2022 10:46

rust 模板函数

	use warp::Filter;
	fn template_fn<F:std::ops::Add<Output=F> + From<i32> >(mut num: F) -> F{
	num = num + 2.into();
	num
	}

	fn main() {
	println!("{}",template_fn(2));
	}

helloobaby / main.cpp

Last active October 20, 2022 12:12

c++ chrono库的使用

	#define _CRT_SECURE_NO_WARNINGS
	#include <iostream>
	#include <chrono>

	#include <windows.h>

	using namespace std;

	int main(int ac, char* av[]) {

helloobaby / main.cpp

Created October 19, 2022 12:24

boost token库用于字符串分词

	//https://stackoverflow.com/questions/7941725/boosttokenizer-comma-separated-c

	#include <iostream>
	#include <exception>
	#include <vector>
	#include <algorithm>
	#include <cassert>

	#include <boost/tokenizer.hpp>

NewerOlder