0vercl0k/windbg-scripts

Stars
315
Rank 132,951 (Top 3 %)
Language
JavaScript
License
MIT License
Created almost 6 years ago
Updated about 3 years ago

0vercl0k/windbg-scripts

0vercl0k

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

A bunch of JavaScript extensions for WinDbg.

windbg-scripts

windbg-scripts is a collection of JavaScript debugger extensions for WinDbg.

basics: various examples of basic usage of various APIs,
parse_eh_win64: example of extending the data-model with exception handling related information (cf Debugger data model, Javascript & x64 exception handling),
telescope: telescope like command for WinDbg,
sm: pretty-printing of Spidermonkey js::Value and JSObject objects,
codecov: extract code-coverage out of a TTD trace,
policybuffer: disassemble a Chrome policy buffer program,
gdt: dump the Global Descriptor Table.

Installing the script gallery

If you would like to have telescope and sm loaded every time your debugger starts instead of loading the extensions manually follow the below steps:

Clone this GitHub repository,
Edit the Manifest\config.xml file and update the LocalCacheRootFolder path with a value that makes sense,
Open the debugger and import the gallery by running .settings load c:\path\where\cloned\windbg-scripts\Manifest\config.xml and .settings save.

Restart the debugger and you should be able to run !telescope as well as inspecting the gallery content from the data-model.

0:000> dx -r1 Debugger.State.ExtensionGallery.ExtensionRepositories
Debugger.State.ExtensionGallery.ExtensionRepositories                
    [0x0]            : overgallery
    [0x1]            : LocalInstalled

0:000> dx -r1 Debugger.State.ExtensionGallery.ExtensionRepositories[0]
Debugger.State.ExtensionGallery.ExtensionRepositories[0]                 : overgallery
    Name             : overgallery
    ManifestVersion  : 0x1
    URL             
    Enabled          : true
    Packages        

0:000> dx -r1 Debugger.State.ExtensionGallery.ExtensionRepositories[0].Packages
Debugger.State.ExtensionGallery.ExtensionRepositories[0].Packages                
    [0x0]            : Telescope

0:000> dx -r1 Debugger.State.ExtensionGallery.ExtensionRepositories[0].Packages[0]
Debugger.State.ExtensionGallery.ExtensionRepositories[0].Packages[0]                 : Telescope
    Name             : Telescope
    Version          : 1.0.0.1
    Description      : Telescope data dereference
    Size             : 0
    IsDownloaded     : true
    Components

rp

rp++ is a fast C++ ROP gadget finder for PE/ELF/Mach-O x86/x64/ARM/ARM64 binaries.

wtf

wtf is a distributed, code-coverage guided, customizable, cross-platform snapshot-based fuzzer designed for attacking user and / or kernel-mode targets running on Microsoft Windows and Linux user-mode (experimental!).

CVE-2021-31166

Proof of concept for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely.

CVE-2019-11708

Full exploit chain (CVE-2019-11708 & CVE-2019-9810) against Firefox on Windows 64-bit.

stuffz

Basically a script thrift shop

CVE-2022-21971

PoC for CVE-2022-21971 "Windows Runtime Remote Code Execution Vulnerability"

Rich Text Format

clairvoyance

Visualize the virtual address space of a Windows process on a Hilbert curve.

z3-playground

A repository to store Z3-python scripts you can use as examples, reminders, whatever.

CVE-2021-24086

Proof of concept for CVE-2021-24086, a NULL dereference in tcpip.sys triggered remotely.

CVE-2019-9810

Exploit for CVE-2019-9810 Firefox on Windows 64-bit.

CVE-2021-28476

PoC for CVE-2021-28476 a guest-to-host "Hyper-V Remote Code Execution Vulnerability" in vmswitch.sys.

udmp-parser

A Cross-Platform C++ parser library for Windows user minidumps with Python 3 bindings.

kdmp-parser

A Windows kernel dump C++ parser library with Python 3 bindings.

blazefox

Blazefox exploits for Windows 10 RS5 64-bit.

symbolizer

A fast execution trace symbolizer for Windows.

zenith

Zenith exploits a memory corruption vulnerability in the NetUSB driver to get remote-code execution on the TP-Link Archer C7 V5 router for Pwn2Own Austin 2021.

sic

Enumerate user mode shared memory mappings on Windows.

ollydbg2-python

Scripting OllyDBG2 using Python is now possible!

snapshot

WinDbg extension written in Rust to dump the CPU / memory state of a running VM

rp-bf.rs

rp-bf: A library to bruteforce ROP gadgets by emulating a Windows user-mode crash-dump

fuzzing-ida75

Repository of the findings found by wtf when fuzzing IDA75.

paracosme

Paracosme is a zero-click remote memory corruption exploit that compromises ICONICS Genesis64 which was demonstrated successfully on stage during the Pwn2Own Miami 2022 competition.

symbolizer-rs

A fast execution trace symbolizer for Windows that runs on all major platforms and doesn't depend on any Microsoft libraries.

CVE-2022-28281

PoC for CVE-2022-28281 a Mozilla Firefox Out of bounds write.

lockmem

This utility allows you to lock every available memory regions of an arbitrary process into its working set.

pywinhv

Python bindings for the Microsoft Hypervisor Platform APIs.

CVE-2022-21974

PoC for CVE-2022-21974 "Roaming Security Rights Management Services Remote Code Execution Vulnerability"

Rich Text Format

pwn2own2023-miami

Writeups, PoCs of the bugs I found while preparing for the Pwn2Own Miami 2023 contest targeting UaGateway from the OPC UA Server category.

CVE-2021-32537

PoC for CVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel.

j0llyDmpr

j0llydmper is a windows service that allows you to dump furtively and automaticaly some contents of USB disks just plugged in your computer. In order to dump potentialy interesting files, you can use a rule on the file name or/and on the file size.

udmp-parser-rs

A Rust crate for parsing Windows user minidumps.

inject

Yet another Windows DLL injector.

kdmp-parser-rs

A KISS Rust crate to parse Windows kernel crash-dumps created by Windows & its debugger.

KEPaboo

Neutralize KEPServerEX anti-debugging techniques

longue-vue

Longue vue is an exploit chain that can compromise over the internet NETGEAR DGND3700v2 devices.

TV-Show-Downloader

Maybe you're a guy a bit like me -- who watch a lot of series -- so I guess you already know that downloading the latest episodes of all your favorites TV Shows is absolutely PAINFUL. I mean it, really. Thus, TVShow Downloader is a set of basic scripts (crontab + python script + bash script) designed to simplify my whole existence on this earth: I haven't to think about downloading my serie anymore \o/.

teesee-calc

Visualize and compare total compensation (TC) packages over time.

dbgeng-rs

Rust binding for the dbgeng COM interfaces.

articles

Mirror of the different PDF articles I wrote

0vercl0k

gflags-rs

Utility that lets you interact with Microsoft Windows Global Flags and particularly PageHeap, made to learn Rust

addr-symbolizer-rs

A KISS Rust crate to symbolize function addresses using Windows PDB files

rp2s

result

Simple, tiny and readable implementation of a Rust like std::result type for C++.