the cyber dung

Fakenet-NG Errno 98 in REMnux v2021.15.2

2022-05-19T04:56:00.008-04:00

Running FakeNet-NG from a freshly deployed Remnux may give out an Errno 98 message.

For this writing, the issue was encountered in a REMnux v2021.15.2. Hopefully, this would also be helpful with other version of REMnux.

This issue is usually encountered because another program is binded to the DNS port (53).

To fix this, we only need a few steps.

FakeNet-NG requires a valid network route.

Check VM network settings
And an IP address
Problems with having an IP address may be resolved by renewing the dhcp with this command
```
renew-dhcp
```
(Optional) Check Internet connection

Since the systemd-resolve is bound with the DNS port, we'll have to disable it first.
```
sudo systemctl stop systemd-resolved
sudo systemctl disable systemd-resolved
```
Then we have two options to get DNS resolution

(Option 1)

Edit /etc/NetworkManager/NetworkManager.conf

sudo nano /etc/NetworkManager/NetworkManager.conf

Then add the following line under [main]
```
dns=default
```

(Option 2)

Edit /etc/resolv.confc/systemd/resolved.conf
```
sudo nano /etc/systemd/resolved.conf
```
Then make sure that the following line is commented out
```
#DNSStubListener=yes
```
Then add the following line
```
DNSStubListener=no
```

Delete resolv.conf
```
sudo rm /etc/resolv.conf
```

Link the resolv.conf produced by systemd to /etc/resolv.conf

sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

Restart NetworkManager to reflect the changes
```
sudo systemctl restart NetworkManager
```
Run Fakenet-NG
```
sudo fakenet
```

At this point, running fakenet will be successful. However, as of this writing, Fakenet-NG in Linux defaults to a MultiHost network mode. For some reason, in this mode, visiting a website from the browser will not show up the expected Fakenet-NG default HTML page. Fakenet-NG logs will only show requests to IP addresses.

What we want is to see request headers along with the domain.

All we need to do is change the network mode to SingleHost.

Just press CTRL+C to stop Fakenet-NG.

The path of Fakenet-NG's configuration is shown after running Fakenet-NG. The first entry at the start of the log.

sudo nano /usr/local/lib/python2.7/dist-packages/fakenet/configs/default.ini

Edit the the configuration and change the NetworkMode to SingleHost.

Run Fakenet-NG again then visit any website. It should now display Fakenet-NG's default page.

If this helped you, please subscribe to my YT channel as I plan to start uploading some tutorials there. Channel is 8-bit n00b.

dd-wrt AP setup on tplink (wired connected routers)

2021-07-15T05:49:00.004-04:00

instructions: https://wiki.dd-wrt.com/wiki/index.php/Wireless_access_point

router firmware: https://mirror.math.princeton.edu/pub/ddwrt/

Setting up IDA Pro to remote debug a Linux executable with GDB server

2021-06-23T07:17:00.005-04:00

To setup, make sure that debugging VM and target Linux VM can see each other.

Just follow instructions at https://hex-rays.com/products/ida/support/idadoc/1343.shtml

Some pitfalls:

IDA cannot establish a connection

* check settings carefully

* check VM settings

* check IP config

- To set static IP in Linux. e.g. sudo ifconfig ens33 10.10.10.10 netmask 255.255.255.0

* Try running with admin or su privileges

* firewall may be blocking the ports. To allow port connectivity:

$ sudo ufw allow from any to any port 23946,23947 proto tcp

Compiling java for compatibility and JAR for other platforms

2021-06-16T12:24:00.000-04:00

Build it with JAR and make it backward compatible.

Better way to explain this is to instead show a hello world example of this.

Folder and file structure:

manifest.txt
src
src/hello.java
src/libraries
src/libraries/a.java
src/libraries/b.java
build
build/classes

Using --release 8 means build it for version 8. Latest version supports backward compatibility.

javac --release 8 -sourcepath src -d build/classes src/*.java
javac --release 8 -sourcepath src -d build/classes src/libraries/*.java
jar cfmv build/jar/hello.jar manifest.txt -C build/classes .
java -jar build/jar/hello.jar

manifest.txt

Main-Class: hello

src/hello.java

import libraries.*;

public class hello {
    public static void main(String[] args){
        System.out.println("Hello World main");
        System.out.println(a.message());
        b.message("hello from b");
    }
}

src/libraries/a.java

package libraries;

public class a {
    public static String message(){
        String s = "";
        s = "Hello from a";
        return s;
    }
}

src/libraries/b.java

package libraries;

public class b {
    public static void message(String args){
        System.out.println(args);
    }
}

Ubuntu support for fingerprint scanner 138a:0090 138a:0097 and 06cb:009a

2021-03-15T06:16:00.003-04:00

As of this writing, the default installation of Ubuntu doesn't have a software that can support most fingerprint scanner hardware. Mine is ID 06cb:009a Synaptics, Inc. Just follow the steps to install python-validity from this github page: https://github.com/uunicorn/python-validity Currenty supports the following IDs: 138a:0090 138a:0097 06cb:009a

Converting img to vdi

2021-02-05T00:06:00.000-05:00

Image needs to be aligned. In Linux,

       
             dd if=original.img of=padded.img bs=100M conv=sync

then convert with

       
             VBoxManage convertdd padded.img converted.vdi

       
             VBoxManage convertfromraw --format VDI padded.img converted.vdi

Notes: Analyzing Delphi

2020-12-21T00:18:00.002-05:00

Function	Description
InitExe	Read resource drm in .rsrc, call StartExe to InitRoutineTable to read all functions (FunctionTable), and execute Routine.
CreateForm	Create the Form, initialize the main function of Delphi, the second parameter edx points to the pointer of the TCustomForm virtual function table, construct the main form of the program _cls_Forms_TCustomForm
Run	Generally, AddExitProc adds the form destructor to the exit function execution flow. The following is the HandleMessage message loop.
Halt0	When dwReasin is 0, call ExitProcess to end

Copy-Pasted from: https://www.programmersought.com/article/36625698711/

Tools: IDR (https://github.com/crypto2011/IDR)

How to run a service exe

2020-12-04T06:38:00.006-05:00

       
sc create servicename binpath= C:\servicefile.exe

sc start servicename

if debugging, just add the either these bytes where you want to debug:

EB FE                   jmp [self]
CC                      int 3
31 c0 83 f8 74 fb       xor eax, eax | cmp eax, 0 | jz [addrcmp]

enable features for old end-of-life office

2020-10-13T01:52:00.000-04:00

run

C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE

How to pre-download symbols (PDB) before even debugging

2020-09-01T07:28:00.001-04:00

In case you wanted to debug a program with Microsoft Windows modules from the system32 folder, try downloading the symbols using symchk. Use the following command line as an example to get all library files from C:\Windows\System32 and store the PDBs in C:\symbols folder.

       
symchk /r C:\Windows\System32\ /s srv*C:\symbols*http://msdl.microsoft.com/download/symbols

And the folder should look like this after:

Themida packed DLL unpacking (generic to other DLL packed files)

2020-08-07T11:08:00.001-04:00

Do LoadLibrary, don't let it terminate, then use processdumper.

A. C source. Compile respectively if x86 or x64 DLL.


// loadlib.c
#include 
#include 

int main()
{
    MessageBox(0, "loading and going to a loop.", 0, 0);
    if (0 == LoadLibraryA("C:\\programdata\\desktop.dat"))
    {
        LoadLibraryA("C:\\programdata\\desktop.dat");
    }
    while (1)
    {}
    return 0;
}

B. pd -pid parameter mem dumps and auto imprec


  pd32 -pid 
  pd64 -pid

[Python] Read and Write to a binary file

2020-07-07T06:37:00.002-04:00

       
             data = open('path/to/file', 'rb').read()
             open('path/to/file', 'wb').write(data)

Sudden change of keyboard language

2020-07-03T08:38:00.002-04:00

Seldom happens but it happens, the keyboard language suddenly changes. # becomes a pound sign or \ becomes =.

Most likely this was because of pressing Alt-Shift. The shortcut key for keyboard language change. Press the key combo again and see what happens.

blogger post code snip

2020-05-25T03:47:00.001-04:00

python virtualenvironment (venv)

2020-05-20T05:39:00.000-04:00

py3

python3 -m venv 
source /bin/activate

py2

python2 -m venv 
source /bin/activate

Recover deleted files from git hard reset

2020-04-08T04:28:00.003-04:00

git reflog

git reset --hard <commit-id-retrieved-using-reflog>

Debugging DLL, add these after decompile

2020-03-18T11:14:00.002-04:00

class program
{
   public static  void Main()
   { 
    // TODO:: add method call here
    Console.WriteLine("I am from program.cs");
   }
}

64-bit _TEB and _PEB example

2020-02-27T09:36:00.000-05:00

ntdll!_TEB
   +0x000 NtTib            : _NT_TIB
   +0x038 EnvironmentPointer : Ptr64 Void
   +0x040 ClientId         : _CLIENT_ID
   +0x050 ActiveRpcHandle  : Ptr64 Void
   +0x058 ThreadLocalStoragePointer : Ptr64 Void
   +0x060 ProcessEnvironmentBlock : Ptr64 _PEB
   +0x068 LastErrorValue   : Uint4B
   +0x06c CountOfOwnedCriticalSections : Uint4B
   +0x070 CsrClientThread  : Ptr64 Void
   +0x078 Win32ThreadInfo  : Ptr64 Void
   +0x080 User32Reserved   : [26] Uint4B
   +0x0e8 UserReserved     : [5] Uint4B
   +0x100 WOW32Reserved    : Ptr64 Void
   +0x108 CurrentLocale    : Uint4B
   +0x10c FpSoftwareStatusRegister : Uint4B
   +0x110 ReservedForDebuggerInstrumentation : [16] Ptr64 Void
   +0x190 SystemReserved1  : [38] Ptr64 Void
   +0x2c0 ExceptionCode    : Int4B
   +0x2c4 Padding0         : [4] UChar
   +0x2c8 ActivationContextStackPointer : Ptr64 _ACTIVATION_CONTEXT_STACK
   +0x2d0 InstrumentationCallbackSp : Uint8B
   +0x2d8 InstrumentationCallbackPreviousPc : Uint8B
   +0x2e0 InstrumentationCallbackPreviousSp : Uint8B
   +0x2e8 TxFsContext      : Uint4B
   +0x2ec InstrumentationCallbackDisabled : UChar
   +0x2ed Padding1         : [3] UChar
   +0x2f0 GdiTebBatch      : _GDI_TEB_BATCH
   +0x7d8 RealClientId     : _CLIENT_ID
   +0x7e8 GdiCachedProcessHandle : Ptr64 Void
   +0x7f0 GdiClientPID     : Uint4B
   +0x7f4 GdiClientTID     : Uint4B
   +0x7f8 GdiThreadLocalInfo : Ptr64 Void
   +0x800 Win32ClientInfo  : [62] Uint8B
   +0x9f0 glDispatchTable  : [233] Ptr64 Void
   +0x1138 glReserved1      : [29] Uint8B
   +0x1220 glReserved2      : Ptr64 Void
   +0x1228 glSectionInfo    : Ptr64 Void
   +0x1230 glSection        : Ptr64 Void
   +0x1238 glTable          : Ptr64 Void
   +0x1240 glCurrentRC      : Ptr64 Void
   +0x1248 glContext        : Ptr64 Void
   +0x1250 LastStatusValue  : Uint4B
   +0x1254 Padding2         : [4] UChar
   +0x1258 StaticUnicodeString : _UNICODE_STRING
   +0x1268 StaticUnicodeBuffer : [261] Wchar
   +0x1472 Padding3         : [6] UChar
   +0x1478 DeallocationStack : Ptr64 Void
   +0x1480 TlsSlots         : [64] Ptr64 Void
   +0x1680 TlsLinks         : _LIST_ENTRY
   +0x1690 Vdm              : Ptr64 Void
   +0x1698 ReservedForNtRpc : Ptr64 Void
   +0x16a0 DbgSsReserved    : [2] Ptr64 Void
   +0x16b0 HardErrorMode    : Uint4B
   +0x16b4 Padding4         : [4] UChar
   +0x16b8 Instrumentation  : [11] Ptr64 Void
   +0x1710 ActivityId       : _GUID
   +0x1720 SubProcessTag    : Ptr64 Void
   +0x1728 PerflibData      : Ptr64 Void
   +0x1730 EtwTraceData     : Ptr64 Void
   +0x1738 WinSockData      : Ptr64 Void
   +0x1740 GdiBatchCount    : Uint4B
   +0x1744 CurrentIdealProcessor : _PROCESSOR_NUMBER
   +0x1744 IdealProcessorValue : Uint4B
   +0x1744 ReservedPad0     : UChar
   +0x1745 ReservedPad1     : UChar
   +0x1746 ReservedPad2     : UChar
   +0x1747 IdealProcessor   : UChar
   +0x1748 GuaranteedStackBytes : Uint4B
   +0x174c Padding5         : [4] UChar
   +0x1750 ReservedForPerf  : Ptr64 Void
   +0x1758 ReservedForOle   : Ptr64 Void
   +0x1760 WaitingOnLoaderLock : Uint4B
   +0x1764 Padding6         : [4] UChar
   +0x1768 SavedPriorityState : Ptr64 Void
   +0x1770 ReservedForCodeCoverage : Uint8B
   +0x1778 ThreadPoolData   : Ptr64 Void
   +0x1780 TlsExpansionSlots : Ptr64 Ptr64 Void
   +0x1788 DeallocationBStore : Ptr64 Void
   +0x1790 BStoreLimit      : Ptr64 Void
   +0x1798 MuiGeneration    : Uint4B
   +0x179c IsImpersonating  : Uint4B
   +0x17a0 NlsCache         : Ptr64 Void
   +0x17a8 pShimData        : Ptr64 Void
   +0x17b0 HeapVirtualAffinity : Uint2B
   +0x17b2 LowFragHeapDataSlot : Uint2B
   +0x17b4 Padding7         : [4] UChar
   +0x17b8 CurrentTransactionHandle : Ptr64 Void
   +0x17c0 ActiveFrame      : Ptr64 _TEB_ACTIVE_FRAME
   +0x17c8 FlsData          : Ptr64 Void
   +0x17d0 PreferredLanguages : Ptr64 Void
   +0x17d8 UserPrefLanguages : Ptr64 Void
   +0x17e0 MergedPrefLanguages : Ptr64 Void
   +0x17e8 MuiImpersonation : Uint4B
   +0x17ec CrossTebFlags    : Uint2B
   +0x17ec SpareCrossTebBits : Pos 0, 16 Bits
   +0x17ee SameTebFlags     : Uint2B
   +0x17ee SafeThunkCall    : Pos 0, 1 Bit
   +0x17ee InDebugPrint     : Pos 1, 1 Bit
   +0x17ee HasFiberData     : Pos 2, 1 Bit
   +0x17ee SkipThreadAttach : Pos 3, 1 Bit
   +0x17ee WerInShipAssertCode : Pos 4, 1 Bit
   +0x17ee RanProcessInit   : Pos 5, 1 Bit
   +0x17ee ClonedThread     : Pos 6, 1 Bit
   +0x17ee SuppressDebugMsg : Pos 7, 1 Bit
   +0x17ee DisableUserStackWalk : Pos 8, 1 Bit
   +0x17ee RtlExceptionAttached : Pos 9, 1 Bit
   +0x17ee InitialThread    : Pos 10, 1 Bit
   +0x17ee SessionAware     : Pos 11, 1 Bit
   +0x17ee LoadOwner        : Pos 12, 1 Bit
   +0x17ee LoaderWorker     : Pos 13, 1 Bit
   +0x17ee SpareSameTebBits : Pos 14, 2 Bits
   +0x17f0 TxnScopeEnterCallback : Ptr64 Void
   +0x17f8 TxnScopeExitCallback : Ptr64 Void
   +0x1800 TxnScopeContext  : Ptr64 Void
   +0x1808 LockCount        : Uint4B
   +0x180c WowTebOffset     : Int4B
   +0x1810 ResourceRetValue : Ptr64 Void
   +0x1818 ReservedForWdf   : Ptr64 Void
   +0x1820 ReservedForCrt   : Uint8B
   +0x1828 EffectiveContainerId : _GUID

ntdll!_PEB
   +0x000 InheritedAddressSpace : UChar
   +0x001 ReadImageFileExecOptions : UChar
   +0x002 BeingDebugged    : UChar
   +0x003 BitField         : UChar
   +0x003 ImageUsesLargePages : Pos 0, 1 Bit
   +0x003 IsProtectedProcess : Pos 1, 1 Bit
   +0x003 IsImageDynamicallyRelocated : Pos 2, 1 Bit
   +0x003 SkipPatchingUser32Forwarders : Pos 3, 1 Bit
   +0x003 IsPackagedProcess : Pos 4, 1 Bit
   +0x003 IsAppContainer   : Pos 5, 1 Bit
   +0x003 IsProtectedProcessLight : Pos 6, 1 Bit
   +0x003 SpareBits        : Pos 7, 1 Bit
   +0x004 Padding0         : [4] UChar
   +0x008 Mutant           : Ptr64 Void
   +0x010 ImageBaseAddress : Ptr64 Void
   +0x018 Ldr              : Ptr64 _PEB_LDR_DATA
   +0x020 ProcessParameters : Ptr64 _RTL_USER_PROCESS_PARAMETERS
   +0x028 SubSystemData    : Ptr64 Void
   +0x030 ProcessHeap      : Ptr64 Void
   +0x038 FastPebLock      : Ptr64 _RTL_CRITICAL_SECTION
   +0x040 AtlThunkSListPtr : Ptr64 Void
   +0x048 IFEOKey          : Ptr64 Void
   +0x050 CrossProcessFlags : Uint4B
   +0x050 ProcessInJob     : Pos 0, 1 Bit
   +0x050 ProcessInitializing : Pos 1, 1 Bit
   +0x050 ProcessUsingVEH  : Pos 2, 1 Bit
   +0x050 ProcessUsingVCH  : Pos 3, 1 Bit
   +0x050 ProcessUsingFTH  : Pos 4, 1 Bit
   +0x050 ReservedBits0    : Pos 5, 27 Bits
   +0x054 Padding1         : [4] UChar
   +0x058 KernelCallbackTable : Ptr64 Void
   +0x058 UserSharedInfoPtr : Ptr64 Void
   +0x060 SystemReserved   : [1] Uint4B
   +0x064 AtlThunkSListPtr32 : Uint4B
   +0x068 ApiSetMap        : Ptr64 Void
   +0x070 TlsExpansionCounter : Uint4B
   +0x074 Padding2         : [4] UChar
   +0x078 TlsBitmap        : Ptr64 Void
   +0x080 TlsBitmapBits    : [2] Uint4B
   +0x088 ReadOnlySharedMemoryBase : Ptr64 Void
   +0x090 SparePvoid0      : Ptr64 Void
   +0x098 ReadOnlyStaticServerData : Ptr64 Ptr64 Void
   +0x0a0 AnsiCodePageData : Ptr64 Void
   +0x0a8 OemCodePageData  : Ptr64 Void
   +0x0b0 UnicodeCaseTableData : Ptr64 Void
   +0x0b8 NumberOfProcessors : Uint4B
   +0x0bc NtGlobalFlag     : Uint4B
   +0x0c0 CriticalSectionTimeout : _LARGE_INTEGER
   +0x0c8 HeapSegmentReserve : Uint8B
   +0x0d0 HeapSegmentCommit : Uint8B
   +0x0d8 HeapDeCommitTotalFreeThreshold : Uint8B
   +0x0e0 HeapDeCommitFreeBlockThreshold : Uint8B
   +0x0e8 NumberOfHeaps    : Uint4B
   +0x0ec MaximumNumberOfHeaps : Uint4B
   +0x0f0 ProcessHeaps     : Ptr64 Ptr64 Void
   +0x0f8 GdiSharedHandleTable : Ptr64 Void
   +0x100 ProcessStarterHelper : Ptr64 Void
   +0x108 GdiDCAttributeList : Uint4B
   +0x10c Padding3         : [4] UChar
   +0x110 LoaderLock       : Ptr64 _RTL_CRITICAL_SECTION
   +0x118 OSMajorVersion   : Uint4B
   +0x11c OSMinorVersion   : Uint4B
   +0x120 OSBuildNumber    : Uint2B
   +0x122 OSCSDVersion     : Uint2B
   +0x124 OSPlatformId     : Uint4B
   +0x128 ImageSubsystem   : Uint4B
   +0x12c ImageSubsystemMajorVersion : Uint4B
   +0x130 ImageSubsystemMinorVersion : Uint4B
   +0x134 Padding4         : [4] UChar
   +0x138 ActiveProcessAffinityMask : Uint8B
   +0x140 GdiHandleBuffer  : [60] Uint4B
   +0x230 PostProcessInitRoutine : Ptr64     void 
   +0x238 TlsExpansionBitmap : Ptr64 Void
   +0x240 TlsExpansionBitmapBits : [32] Uint4B
   +0x2c0 SessionId        : Uint4B
   +0x2c4 Padding5         : [4] UChar
   +0x2c8 AppCompatFlags   : _ULARGE_INTEGER
   +0x2d0 AppCompatFlagsUser : _ULARGE_INTEGER
   +0x2d8 pShimData        : Ptr64 Void
   +0x2e0 AppCompatInfo    : Ptr64 Void
   +0x2e8 CSDVersion       : _UNICODE_STRING
   +0x2f8 ActivationContextData : Ptr64 _ACTIVATION_CONTEXT_DATA
   +0x300 ProcessAssemblyStorageMap : Ptr64 _ASSEMBLY_STORAGE_MAP
   +0x308 SystemDefaultActivationContextData : Ptr64 _ACTIVATION_CONTEXT_DATA
   +0x310 SystemAssemblyStorageMap : Ptr64 _ASSEMBLY_STORAGE_MAP
   +0x318 MinimumStackCommit : Uint8B
   +0x320 FlsCallback      : Ptr64 _FLS_CALLBACK_INFO
   +0x328 FlsListHead      : _LIST_ENTRY
   +0x338 FlsBitmap        : Ptr64 Void
   +0x340 FlsBitmapBits    : [4] Uint4B
   +0x350 FlsHighIndex     : Uint4B
   +0x358 WerRegistrationData : Ptr64 Void
   +0x360 WerShipAssertPtr : Ptr64 Void
   +0x368 pUnused          : Ptr64 Void
   +0x370 pImageHeaderHash : Ptr64 Void
   +0x378 TracingFlags     : Uint4B
   +0x378 HeapTracingEnabled : Pos 0, 1 Bit
   +0x378 CritSecTracingEnabled : Pos 1, 1 Bit
   +0x378 LibLoaderTracingEnabled : Pos 2, 1 Bit
   +0x378 SpareTracingBits : Pos 3, 29 Bits
   +0x37c Padding6         : [4] UChar
   +0x380 CsrServerReadOnlySharedMemoryBase : Uint8B

PEHeader structs

2019-11-06T22:47:00.001-05:00

struct PeHeader {
 uint32_t mMagic; // PE\0\0 or 0x00004550
 uint16_t mMachine;
 uint16_t mNumberOfSections;
 uint32_t mTimeDateStamp;
 uint32_t mPointerToSymbolTable;
 uint32_t mNumberOfSymbols;
 uint16_t mSizeOfOptionalHeader;
 uint16_t mCharacteristics;
};

struct Pe32OptionalHeader {
 uint16_t mMagic; // 0x010b - PE32, 0x020b - PE32+ (64 bit)
 uint8_t  mMajorLinkerVersion;
 uint8_t  mMinorLinkerVersion;
 uint32_t mSizeOfCode;
 uint32_t mSizeOfInitializedData;
 uint32_t mSizeOfUninitializedData;
 uint32_t mAddressOfEntryPoint;
 uint32_t mBaseOfCode;
 uint32_t mBaseOfData;
 uint32_t mImageBase;
 uint32_t mSectionAlignment;
 uint32_t mFileAlignment;
 uint16_t mMajorOperatingSystemVersion;
 uint16_t mMinorOperatingSystemVersion;
 uint16_t mMajorImageVersion;
 uint16_t mMinorImageVersion;
 uint16_t mMajorSubsystemVersion;
 uint16_t mMinorSubsystemVersion;
 uint32_t mWin32VersionValue;
 uint32_t mSizeOfImage;
 uint32_t mSizeOfHeaders;
 uint32_t mCheckSum;
 uint16_t mSubsystem;
 uint16_t mDllCharacteristics;
 uint32_t mSizeOfStackReserve;
 uint32_t mSizeOfStackCommit;
 uint32_t mSizeOfHeapReserve;
 uint32_t mSizeOfHeapCommit;
 uint32_t mLoaderFlags;
 uint32_t mNumberOfRvaAndSizes;
};
struct IMAGE_SECTION_HEADER { // size 40 bytes
 char[8]  mName;
 uint32_t mVirtualSize;
 uint32_t mVirtualAddress;
 uint32_t mSizeOfRawData;
 uint32_t mPointerToRawData;
 uint32_t mPointerToRealocations;
 uint32_t mPointerToLinenumbers;
 uint16_t mNumberOfRealocations;
 uint16_t mNumberOfLinenumbers;
 uint32_t mCharacteristics;
};

IDA Pro IDC - Memory Dump

2019-10-27T02:54:00.003-04:00

auto address    = 0x0E2FFE0;
auto size       = 0x0005600;
auto fname      = "memdump_"+ltoa(address, 16)+".bin";

auto f = fopen(fname, "wb");
savefile(f, 0, address, size);
fclose(f);

C pragma tips

2019-08-09T13:39:00.000-04:00

to add lib files
#pragma comment(lib, "thirdPartyLibV2.0.lib")

to suppress warnings
#pragma warning(disable:4996)

Compile C using gcc for Windows in Ubuntu

2019-08-09T12:56:00.004-04:00

1. Install mingw cross-compiler:

apt install mingw-w64

2.a. Compile for 32-bit executable:

i686-w64-mingw32-gcc -o main32.exe main.c

2.b. Compile for 64-bit executable:

x86_64-w64-mingw32-gcc -o main64.exe main.c

Binding a domain to VPN - Windows

2018-11-20T02:56:00.000-05:00

Not all sites are redirected via the VPN site. If we want a specific site pass thru the VPN connection, we'll need to bind the site's IP address to use the VPN's virtual network adapter.

Assuming we want to route bitbucket.org to pass thru the VPN, here are the steps:

Get IP address of target site. bitbucket.org returns 18.205.93.2.

Go to https://www.arin.net/whois_tou.html. Search for 18.205.93.2.

Which gives us the following result.

Go to https://www.ipaddressguide.com/cidr and enter the CIDR in the box.

This should result to this.

On to using the route tool. What we have are:
bitbucket.org's IP address = 18.205.93.2
CIDR = 18.205.93.0/25
Subnet mask = 255.255.255.128

Take not of the CIDR IP and the Subnet mask here. In this case, it was 18.205.93.0 and 255.255.255.128.

Identify the VPN virtual network. This can easily be identified from the Status column. Take note of the Name.

Open command prompt as an Administrator and enter "route print". Take note of the Interface number located at the left.

Take note of the interface number. In this case, it is 26.

We need to identify the assigned IP address from the VPN. To do that, we'll need to use ipconfig /all. The Description should match the VPN's Interface description listed above.

Take note of the IPv4 address assigned by the VPN.

Finally, we're going to use the route tool to bind the bitbucket.org domain to pass thru the VPN.
Enter the following:

route add 18.205.93.0 mask 255.255.255.128 172.168.10.10 IF 26

where:
18.205.93.0 is the CIDR IP
255.255.255.128 is the Subnet mask
172.168.10.10 is the assigned IP address from the VPN
26 is the Interface number

But the VPN gives random IP addresses...

Well, what we need to do is bind the interface itself regardless of what IP address it contains. To do that:

route add -p 18.205.93.0 mask 255.255.255.128 0.0.0.0 IF 22

We set the gateway to 0.0.0.0 and made the connection persistent with the -p parameter.

Deleting persistent entries

Just use the delete option.

route delete 18.205.93.0 172.168.10.10

Something not clear? Drop a comment below and I'll try to answer them.

One Line Command Prompt that makes a PendingFileRenameOperations entry

2018-11-14T12:02:00.002-05:00

Run this at command prompt with Administrator privileges:

echo Add-Type -TypeDefinition @'>test.ps1&echo.using System;using System.Diagnostics;using System.Runtime.InteropServices;public static class Kernel32{[DllImport("kernel32.dll",CharSet=CharSet.Unicode,SetLastError= true)] public static extern bool MoveFileEx(String lpExistingFileName,String lpNewFileName,uint dwFlags);}>>test.ps1&echo.'@>>test.ps1&echo.[Kernel32]::MoveFileEx("c:\deletethisfile.txt",0,4)>>test.ps1&echo.>>rwong.ps1&powershell -executionpolicy bypass -File test.ps1

Registry entry now has a PendingFileRenameOperations entry:

Returns false if it fails.

Enable group policy editor (gpedit.msc) in Windows

2018-11-12T23:47:00.000-05:00

FOR %F IN ("%SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-Package~*.mum") DO (
DISM /Online /NoRestart /Add-Package:"%F"
)
FOR %F IN ("%SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientExtensions-Package~*.mum") DO (
DISM /Online /NoRestart /Add-Package:"%F"