Secret Club

https://secret.club/
Admin
Secret Club is a Discord community focused on software security research, covering topics like...
Tokens:237,410
Snippets:1,785
Trust Score:9.3
Update:4 months ago
Show doc for...
Tokens:
Raw
### Master Script for VM Creation, Driver Deployment, and Debugger Attachment (start-debugger.bat)

Source: https://secret.club/2020/04/10/kernel_debugging_in_seconds.html

This script automates the entire kernel debugging setup process, including starting the VM, deploying the driver, attaching WinDbg, and optionally halting the VM.

```batch
start vagrant up & vagrant powershell --command "schtasks /run /tn vagrantonboot"
"C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\windbg.exe" -k net:port=49152,key=1.1.1.1
vagrant halt -f


```

--------------------------------

### Setup VM and Initial Checks

Source: https://secret.club/2022/05/11/fuzzing-solana.html

Sets up the eBPF virtual machine for interpreted and JIT execution, including initial verification of the program.

```rust
fuzz_target!(|data: FuzzData| {
    let mut prog = make_program(&data.prog, Arch::X64);
    ... snip ...
    let config = data.template.into();
    if check(prog.into_bytes(), &config).is_err() {
        // verify please
        return;
    }
    let mut interp_mem = data.mem.clone();
    let mut jit_mem = data.mem;
    let registry = SyscallRegistry::default();
    let mut bpf_functions = BTreeMap::new();
    register_bpf_function(&config, &mut bpf_functions, &registry, 0, "entrypoint").unwrap();
    let mut executable = Executable::<UserError, TestInstructionMeter>::from_text_bytes(
        prog.into_bytes(),
        None,
        config,
        SyscallRegistry::default(),
        bpf_functions,
    )
    .unwrap();
    if Executable::jit_compile(&mut executable).is_ok() {
        let interp_mem_region = MemoryRegion::new_writable(&mut interp_mem, ebpf::MM_INPUT_START);
        let mut interp_vm =
            EbpfVm::<UserError, TestInstructionMeter>::new(&executable, &mut [], vec![interp_mem])
                .unwrap();
        let jit_mem_region = MemoryRegion::new_writable(&mut jit_mem, ebpf::MM_INPUT_START);
        let mut jit_vm =
            EbpfVm::<UserError, TestInstructionMeter>::new(&executable, &mut [], vec![jit_mem_region])
                .unwrap();

        // See step 3
    }
});

```

--------------------------------

### Example output with incorrect 'Identity' value

Source: https://secret.club/2024/10/21/unnecessarily-exhaustice-rca.html

This example shows the output from a QEMU-emulated ARM64 execution, demonstrating a case where 'identity' is incorrectly reported as 1 for a vector of 20 elements.

```text
$ qemu-aarch64 ./build/stage2/bin/clang --target=arm64-apple-macos -O2 -fsanitize=fuzzer-no-link -fsanitize=address repro.cc -S -o -
[FFFFFFFF] [FFFFFFFF] [FFFFFFFF] [FFFFFFFF] [FFFFFFFF] [FFFFFFFF] [FFFFFFFF] [FFFFFFFF] [00000000] [00000001] [00000002] [00000003] [00000004] [FFFFFFFF] [FFFFFFFF] [FFFFFFFF] [FFFFFFFF] [FFFFFFFF] [FFFFFFFF] [FFFFFFFF] -> identity: 1, nelts: 20

[...]

```

--------------------------------

### IET Divergence Profiling - Initial Setup

Source: https://secret.club/2020/04/13/how-anti-cheats-detect-system-emulation.html

This assembly code snippet demonstrates the initial setup for an IET divergence test. It captures the performance counter before and after executing the 'cpuid' instruction to measure its execution time.

```assembly
cli
xor     r8d, r8d
mov     ecx, IA32_APERF_MSR
rdmsr
shl     rdx, 20h
or      rax, rdx
mov     r9, rax
lea     rsi, [rsp+20h]
xor     eax, eax
cpuid
mov     [rsi], eax
mov     [rsi+4], ebx
mov     [rsi+8], ecx
mov     [rsi+0Ch], edx
mov     ecx, IA32_APERF_MSR
rdmsr
shl     rdx, 20h
or      rax, rdx
mov     rdx, [rsp+30h]
sub     rax, r9
mov     [rdx+r8*8], rax

; 
; TODO:
; 	Capture comparable instruction IET.
; 	Store result.
; 	Loop. Break at end. 
; 	Enable interrupts.
; 	End profile.
; 

```

--------------------------------

### Setup Fuzz Target and VM

Source: https://secret.club/2022/05/11/fuzzing-solana.html

Initializes the fuzz target and the eBPF virtual machine with program and memory configurations. Includes program verification and syscall registration.

```rust
fuzz_target!(|data: DumbFuzzData| {
    let prog = data.prog;
    let config = data.template.into();
    if check(&prog, &config).is_err() {
        // verify please
        return;
    }
    let mut mem = data.mem;
    let registry = SyscallRegistry::default();
    let mut bpf_functions = BTreeMap::new();
    register_bpf_function(&config, &mut bpf_functions, &registry, 0, "entrypoint").unwrap();
    let executable = Executable::<UserError, TestInstructionMeter>::from_text_bytes(
        &prog,
        None,
        config,
        SyscallRegistry::default(),
        bpf_functions,
    )
    .unwrap();
    let mem_region = MemoryRegion::new_writable(&mut mem, ebpf::MM_INPUT_START);
    let mut vm =
        EbpfVm::<UserError, TestInstructionMeter>::new(&executable, &mut [], vec![mem_region]).unwrap();

    // TODO in step 3
});

```

--------------------------------

### Batch Script for Driver Deployment (onboot.bat)

Source: https://secret.club/2020/04/10/kernel_debugging_in_seconds.html

This batch script automates the deployment of a kernel driver by copying it to the system directory, creating a service, and starting the service.

```batch
sc stop MyDriver
sc delete MyDriver
sc create MyDriver binPath= "C:\Windows\System32\drivers\MyDriver.sys" type= kernel
copy C:\vagrant\MyDriver.sys C:\Windows\System32\drivers
sc start MyDriver


```

--------------------------------

### Emulate BattlEye START Packet

Source: https://secret.club/2020/07/06/bottleye.html

Emulate the BattlEye START packet by replying with the received packet's header. This is used after the INIT packet to establish communication.

```cpp
case battleye::packet_id::START:
{
    battleye::delegate::o_send_packet(received_packet, sizeof(battleye::be_packet_header));
    break;
}

```

--------------------------------

### Brightened Function Setup and Call

Source: https://secret.club/2026/05/21/striga.html

Illustrates how the 'brightened' function sets up the 'State' and calls the 'lifted' function.

```c
// Symbolic variable for memory
uint8_t RAM[0];

void lifted(State* state, void* memory) { ... }

uint64_t brightened(uint64_t x, uint64_t y) {
  State state;
  state.rdi = x;
  state.rsi = y;
  lifted(&state, RAM);
  return state.rax;
}

```

--------------------------------

### Assembly Control Flow Example

Source: https://secret.club/2026/05/21/striga.html

A sample assembly code snippet demonstrating simple control flow with if/else and loop constructs.

```assembly
test_cfg:
    cmp rax, 0
    je .else_block
.if_true:
    add rax, 1
    jmp .merge
.else_block:
    add rax, 2
.merge:
    sub rax, 1
    jne .merge
.exit:
    ret

```

--------------------------------

### C Function Setting Up Stack and State

Source: https://secret.club/2026/05/21/striga.html

A C function demonstrating stack setup by allocating a local buffer and pointing 'rsp' to the end of it, then calling a lifted function.

```c
uint64_t brightened(uint64_t x, uint64_t y) {
  uint8_t stack[4096];
  State state;
  state.rdi = x;
  state.rsi = y;
  state.rsp = (uint64_t)&stack[sizeof(stack) - 8];
  lifted(&state, RAM);
  return state.rax;
}

```

--------------------------------

### LLVM IR for MessageBox Example

Source: https://secret.club/2023/12/24/riscy-business.html

The LLVM Intermediate Representation generated from the example C code. It includes target datalayout, triple, function definitions, and metadata.

```llvm
source_filename = "hello.c"
target datalayout = "e-m:w-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-pc-windows-msvc19.38.33133"

@message = dso_local global [19 x i8] c"Hello from RISC-V!\00", align 16
@title = dso_local global [7 x i8] c"riscvm\00", align 1

; Function Attrs: noinline nounwind optnone uwtable
define dso_local i32 @main() #0 {
  %1 = call i32 @MessageBoxA(ptr noundef null, ptr noundef @message, ptr noundef @title, i32 noundef 0)
  ret i32 0
}

declare dllimport i32 @MessageBoxA(ptr noundef, ptr noundef, ptr noundef, i32 noundef) #1

attributes #0 = { noinline nounwind optnone uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #1 = { "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }

!llvm.linker.options = !{!0, !0}
!llvm.module.flags = !{!1, !2, !3}
!llvm.ident = !{!4}

!0 = !{!"/DEFAULTLIB:uuid.lib"}
!1 = !{i32 1, !"wchar_size", i32 2}
!2 = !{i32 8, !"PIC Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 16.0.5"}


```

--------------------------------

### Motivating Example: Assembly Loop

Source: https://secret.club/2021/09/08/vmprotect-llvm-lifting-2.html

This assembly code demonstrates a simple loop structure that increments a counter until it reaches a specified limit.

```assembly
start:
  mov rax, 2000
  mov rbx, 0
loop:
  inc rbx
  cmp rbx, rax
  jne loop

```

--------------------------------

### Setup for Instruction Replay with MTF

Source: https://secret.club/2025/06/02/hypervisors-for-memory-introspection-and-reverse-engineering.html

This snippet sets up the replay process by calculating the number of displaced instructions, setting the Monitor Trap Flag (MTF) counter, and disabling guest interrupts to prepare for single-stepping.

```rust
let instruction_count = HookManager::calculate_instruction_count(...);
vm.mtf_counter = Some(instruction_count);
set_monitor_trap_flag(true);
update_guest_interrupt_flag(vm, false)?;

```

--------------------------------

### RISC-V Pointers in Data Section

Source: https://secret.club/2023/12/24/riscy-business.html

Example demonstrating how pointers are placed in the .data section, which triggers R_RISCV_64 relocations.

```c
void* functions[] = {
    &function1,
    &function2,
};

```

--------------------------------

### Install Inline Hook with VMCALL

Source: https://secret.club/2025/06/02/hypervisors-for-memory-introspection-and-reverse-engineering.html

Calculates the offset of a guest function in a host shadow page and installs an inline hook using VMCALL. This method is used to redirect execution to a hypervisor-controlled shadow page.

```rust
let shadow_function_pa = PAddr::from(Self::calculate_function_offset_in_host_shadow_page(shadow_page_pa, guest_function_pa));

InlineHook::new(shadow_function_pa.as_u64() as *mut u8, inline_hook_type).detour64();

```

--------------------------------

### Batch Script for Kernel Debugging Setup (kdbg.bat)

Source: https://secret.club/2020/04/10/kernel_debugging_in_seconds.html

This batch script configures kernel debugging settings within the Windows guest VM, including enabling debugging, setting network parameters, and scheduling an on-boot script.

```batch
bcdedit /debug on
bcdedit /dbgsettings net hostip:192.168.56.1 port:49152 key:1.1.1.1
copy C:\vagrant\guest\onboot.bat C:\onboot.bat
schtasks /create /sc onstart /tr "C:\onboot.bat" /tn vagrantonboot /ru SYSTEM /f
shutdown /r /t 0


```

--------------------------------

### Initialize Primary and Secondary EPTs

Source: https://secret.club/2025/06/02/hypervisors-for-memory-introspection-and-reverse-engineering.html

Initializes two separate EPT contexts, primary and secondary, with full READ_WRITE_EXECUTE permissions for mirroring guest memory. This is part of the system virtualization setup in the Matrix hypervisor.

```rust
primary_ept.identity_2mb(AccessType::READ_WRITE_EXECUTE)?;
secondary_ept.identity_2mb(AccessType::READ_WRITE_EXECUTE)?;

```

--------------------------------

### Constants Harvesting Example

Source: https://secret.club/2022/08/08/eqsat-oracle-synthesis.html

This snippet demonstrates a complex expression for constants harvesting, likely used in Boolean function synthesis.

```plaintext
x46)*0x4b)+(((((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))+(((-((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))*0x2))+(-0x1))&(-0x2)))*0x3)+0x4d)*(-0x19)))+0x76)*0x63))+0x2e)&(-0x6c)))*0x67)+0xd)*0x2d)+(((((((((((((((((((((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))+(((-((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))*0x2))+(-0x1))&(-0x2)))*0x3)+0x4d)*0x56)+0x24)&0x46)*0x4b)+(((((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))+(((-((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))*0x2))+(-0x1))&(-0x2)))*0x3)+0x4d)*(-0x19)))+0x76)*0x3a)+(-0x51))&(-0xc))+(((((((((((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))+(((-((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))*0x2))+(-0x1))&(-0x2)))*0x3)+0x4d)*0x56)+0x24)&0x46)*0x4b)+(((((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))+(((-((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))*0x2))+(-0x1))&(-0x2)))*0x3)+0x4d)*(-0x19)))+0x76)*0x63))+0x2e)&(-0x6c))-((((((((((((((((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))+(((-((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))*0x2))+(-0x1))&(-0x2)))*0x3)+0x4d)*0x56)+0x24)&0x46)*0x4b)+(((((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))+(((-((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))*0x2))+(-0x1))&(-0x2)))*0x3)+0x4d)*(-0x19)))+0x76)*0x3a)+(-0x51))&(-0xc))+(((((((((((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))+(((-((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))*0x2))+(-0x1))&(-0x2)))*0x3)+0x4d)*0x56)+0x24)&0x46)*0x4b)+(((((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))+(((-((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))*0x2))+(-0x1))&(-0x2)))*0x3)+0x4d)*(-0x19)))+0x76)*0x63))+0x2e)&(-0x1)))+((((((((((((((((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))+(((-((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))*0x2))+(-0x1))&(-0x2)))*0x3)+0x4d)*0x56)+0x24)&0x46)*0x4b)+(((((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))+(((-((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))*0x2))+(-0x1))&(-0x2)))*0x3)+0x4d)*(-0x19)))+0x76)*0x3a)+(-0x51))&(-0xc))+(((((((((((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))+(((-((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))*0x2))+(-0x1))&(-0x2)))*0x3)+0x4d)*0x56)+0x24)&0x46)*0x4b)+(((((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))+(((-((((((x*(-0x1b))+(-0x9))*(-0x13))+(-0x2a))+(((((x*(-0x1b))+(-0x9))*0x26)+0x55)&(-0x2)))*0x2))+(-0x1))&(-0x2)))*0x3)+0x4d)*(-0x19)))+0x76)*0x63))+0x2e)&(-0x6c)))*0x67)+0xd)*(-0x52))|0x22)*(-0x1b)))+(-0x3e))-(-0x9))*(-0x13))&(-0x1))
```

--------------------------------

### Package and Add Vagrant Box

Source: https://secret.club/2020/04/10/kernel_debugging_in_seconds.html

Packages a base virtual machine into a reusable Vagrant box and adds it to your local Vagrant environment. Adjust VM and box names to match your setup.

```bash
vagrant package --base Win10LTSCBase --output windows.box
vagrant box add invokestatic/win10ltsc windows.box

```

--------------------------------

### Solana RBPF Fuzzer Setup

Source: https://secret.club/2022/05/11/fuzzing-solana.html

Sets up the RBPF fuzzer for Solana programs. It includes necessary features, imports, and defines the main fuzz target function that takes `FuzzData` as input.

```Rust
#![feature(bench_black_box)]
#![no_main]

use std::collections::BTreeMap;
use std::hint::black_box;

use libfuzzer_sys::fuzz_target;

use grammar_aware::*;
use solana_rbpf::{
    elf::register_bpf_function,
    insn_builder::Arch,
    memory_region::MemoryRegion,
    verifier::check,
    vm::{EbpfVm, SyscallRegistry, TestInstructionMeter},
};

use crate::common::ConfigTemplate;

mod common;
mod grammar_aware;

#[derive(arbitrary::Arbitrary, Debug)]
struct FuzzData {
    template: ConfigTemplate,
    prog: FuzzProgram,
    mem: Vec<u8>,
    arch: Arch,
}

fuzz_target!(|data: FuzzData| {
    let prog = make_program(&data.prog, data.arch);
    let config = data.template.into();
    if check(prog.into_bytes(), &config).is_err() {
        // verify please
        return;
    }
    let mut mem = data.mem;
    let registry = SyscallRegistry::default();
    let mut bpf_functions = BTreeMap::new();
    register_bpf_function(&config, &mut bpf_functions, &registry, 0, "entrypoint").unwrap();
    let executable = Executable::<UserError, TestInstructionMeter>::from_text_bytes(
        prog.into_bytes(),
        None,
        config,
        SyscallRegistry::default(),
        bpf_functions,
    )
    .unwrap();
    let mem_region = MemoryRegion::new_writable(&mem, ebpf::MM_INPUT_START);
    let mut vm =
        EbpfVm::<UserError, TestInstructionMeter>::new(&executable, &mut [], vec![mem_region]).unwrap();

    drop(black_box(vm.execute_program_interpreted(

```

--------------------------------

### Complete Fuzzer Implementation

Source: https://secret.club/2022/05/11/fuzzing-solana.html

Combines all steps into a single, runnable fuzz target. Includes necessary imports, the fuzz data structure, and the complete VM setup and execution logic.

```rust
#![feature(bench_black_box)]
#![no_main]

use std::collections::BTreeMap;
use std::hint::black_box;

use libfuzzer_sys::fuzz_target;

use solana_rbpf::
    ebpf,
    elf::{register_bpf_function, Executable},
    memory_region::MemoryRegion,
    user_error::UserError,
    verifier::check,
    vm::{EbpfVm, SyscallRegistry, TestInstructionMeter},
};

use crate::common::ConfigTemplate;

mod common;

#[derive(arbitrary::Arbitrary, Debug)]
struct DumbFuzzData {
    template: ConfigTemplate,
    prog: Vec<u8>,
    mem: Vec<u8>,
}

fuzz_target!(|data: DumbFuzzData| {
    let prog = data.prog;
    let config = data.template.into();
    if check(&prog, &config).is_err() {
        // verify please
        return;
    }
    let mut mem = data.mem;
    let registry = SyscallRegistry::default();
    let mut bpf_functions = BTreeMap::new();
    register_bpf_function(&config, &mut bpf_functions, &registry, 0, "entrypoint").unwrap();
    let executable = Executable::<UserError, TestInstructionMeter>::from_text_bytes(
        &prog,
        None,
        config,
        SyscallRegistry::default(),
        bpf_functions,
    )
    .unwrap();
    let mem_region = MemoryRegion::new_writable(&mut mem, ebpf::MM_INPUT_START);
    let mut vm =
        EbpfVm::<UserError, TestInstructionMeter>::new(&executable, &mut [], vec![mem_region]).unwrap();

    drop(black_box(vm.execute_program_interpreted(
        &mut TestInstructionMeter { remaining: 1024 },
    )));
});

```

--------------------------------

### Python Script for Synthesis

Source: https://secret.club/2022/08/08/eqsat-oracle-synthesis.html

This command initiates the synthesis process using a Python script. It indicates the start of the e-graph reset and reports the number of eclasses found.

```bash
python3 synth.py
eclasses #: 84
```

--------------------------------

### Synthesized Expression with Cost 17

Source: https://secret.club/2022/08/08/eqsat-oracle-synthesis.html

This snippet shows a synthesized expression with the lowest cost of 17 among the examples, using simplified logical and arithmetic operations.

```plaintext
Synthesized (cost = 17): (((0x2*(y^x))+((x|y)*0x4))+(0x3*(x*y)))
```

--------------------------------

### CS:GO Protobuf Message Definition for Voice Initialization

Source: https://secret.club/2021/05/13/source-engine-rce-join.html

This is an example of a Protobuf message definition used by CS:GO developers for initializing voice message transfers. It specifies parameters like voice quality, codec, and version.

```protobuf
message CSVCMsg_VoiceInit {
	optional int32 quality = 1;
	optional string codec = 2;
	optional int32 version = 3 [default = 0];
}

```

--------------------------------

### Synthesized Expression (Cost 219)

Source: https://secret.club/2022/08/08/eqsat-oracle-synthesis.html

This snippet presents a synthesized expression with a cost of 219, derived from 252 e-classes. It shows a different optimization path compared to the previous example.

```plaintext
eclasses #: 252
Synthesized (cost = 219): (((((((((((((((((((((x+x)&0x46)*0x4b)*0x3a)+((0x2*(~(-x)))+0xde))+0xbc)+0xaf)&0xf4)+((((x+x)&0x46)+(((((0x7f+x)*0x3)+0x4d)*0xe7)*0x63))+0xa2))+0x2e)&0x94)*0x67)*0xae)+(-((((((((((x+x)&0x46)*0x4b)*0x3a)+((0x2*(~(-x)))+0xde))+0xbc)+0xaf)&0xf4)+((((x+x)&0x46)+(((((0x7f+x)*0x3)+0x4d)*0xe7)*0x63))+0xa2))+0x2e)))*0x67)+0xd)*0x2d)+(((((((((((((((((((x+x)&0x46)*0x4b)*0x3a)+((0x2*(~(-x)))+0xde))+0xbc)+0xaf)&0xf4)+((((x+x)&0x46)+(((((0x7f+x)*0x3)+0x4d)*0xe7)*0x63))+0xa2))+0x2e)&0x94)*0x67)*0xae)+(-((((((((((x+x)&0x46)*0x4b)*0x3a)+((0x2*(~(-x)))+0xde))+0xbc)+0xaf)&0xf4)+((((x+x)&0x46)+(((((0x7f+x)*0x3)+0x4d)*0xe7)*0x63))+0xa2))+0x2e)))*0x67)+0xd)*0xae)|0x22)*0xe5))+0xc2)-0xf7)*0xed)
```

--------------------------------

### Synthesized Polynomial MBA Expression (Cost 93)

Source: https://secret.club/2022/08/08/eqsat-oracle-synthesis.html

A synthesized polynomial MBA expression with a cost of 93. This expression demonstrates a different combination of operations compared to other examples.

```plaintext
(((F*(((x-y)^(x*y))&(~(((x*y)+y)*x))))+((((x-y)^(x*y))&(~(((x*y)+y)*x)))*((N+(((x-y)^(x*y))|(((x*y)+y)*x)))-((x-y)^(x*y)))))+((((x-y)^(x*y))|(((x*y)+y)*x))*(((x-y)^(x*y))&(((x*y)+y)*x))))
```

--------------------------------

### Synthesizing an Expression with Rewriting Rules

Source: https://secret.club/2022/08/08/eqsat-oracle-synthesis.html

This example demonstrates the transformation of an expression using commutativity, associativity, and not normalization rules. It shows an input expression that cannot be synthesized by a two-variable oracle and its synthesized form after applying the rules.

```text
python3 synth.py
eclasses #: 11
Input (cost = 16): (~(((x+y)+(~(((x+y)+x)+y)))+(-z)))
====================================================================================================
eclasses #: 16
Synthesized (cost = 5): ((x+y)+z)
====================================================================================================

```

--------------------------------

### Synthesized Expression with Cost 27 (Variant 1)

Source: https://secret.club/2022/08/08/eqsat-oracle-synthesis.html

This snippet presents a synthesized expression with a cost of 27, featuring a different arrangement of logical and arithmetic operations compared to the previous example. It is shown after an e-graph reset.

```plaintext
Synthesized (cost = 27): ((((((x|y)*0x9c15f8a000000004)+(0x2*(x*y)))+(x*y))+((x|y)*0x63ea076000000000))+(0x2*(y^x)))
```

--------------------------------

### JSON Parsing and Conditional Bug Trigger

Source: https://secret.club/2024/06/30/ring-around-the-regex-1.html

Illustrates how a byte-level fuzzer might struggle with structured data like JSON. The fuzzer explores program space but often mangles the input, preventing deeper code execution. This example shows a scenario where a bug might be missed due to the fuzzer getting stuck at the JSON parsing stage.

```javascript
obj = JSON.loads(input); // lots of coverage in JSON to explore!

if (obj.a == 'a') {
  // bug!
}
```

--------------------------------

### Example C Code for MessageBox

Source: https://secret.club/2023/12/24/riscy-business.html

A simple C program that displays a message box. This code is used as an example for LLVM IR retargeting.

```c
#include <Windows.h>

int main()
{
    MessageBoxA(0, "Hello from RISC-V!", "riscvm", 0);
}


```

--------------------------------

### Install Low-Level Mouse Hook

Source: https://secret.club/2021/04/03/runescape-heuristics.html

Installs a low-level hook on the mouse to intercept all mouse events system-wide. This is used by Runescape for heuristic analysis.

```cpp
const auto module_handle = GetModuleHandleA(0);
hhk = SetWindowsHookExA(WH_MOUSE_LL, rs::mouse_hook_handler, module_handle, 0);

```

--------------------------------

### Packfile Preparation and Path Addition

Source: https://secret.club/2020/05/05/source-spaghetti.html

This C++ snippet shows the preparation of a packfile and its addition to search paths, handling different addition orders (tail or head). It sets up search path objects, associates them with packfiles, and updates file time information.

```cpp
        if ( pf->Prepare( packfile->filelen, packfile->fileofs ) )
        {
            int nIndex;
            if ( addType == PATH_ADD_TO_TAIL )
            {
                nIndex = m_SearchPaths.AddToTail();	
            }
            else
            {
                nIndex = m_SearchPaths.AddToHead();	
            }

            CSearchPath *sp = &m_SearchPaths[ nIndex ];

            sp->SetPackFile( pf );
            sp->m_storeId = g_iNextSearchPathID++;
            sp->SetPath( g_PathIDTable.AddString( newPath ) );
            sp->m_pPathIDInfo = FindOrAddPathIDInfo( g_PathIDTable.AddString( pPathID ), -1 );

            if ( IsDvdDevPathString( newPath ) )
            {
                sp->m_bIsDvdDevPath = true;
            }

            pf->SetPath( sp->GetPath() );
            pf->m_lPackFileTime = GetFileTime( newPath );

            Trace_FClose( pf->m_hPackFileHandleFS );
            pf->m_hPackFileHandleFS = NULL;

            //pf->m_PackFileID = m_FileTracker2.NotePackFileOpened( pPath, pPathID, packfile->filelen );
            m_ZipFiles.AddToTail( pf );
        }
        else
        {
            delete pf;
        }
    }
}
```

--------------------------------

### Example LUI Instruction Handler

Source: https://secret.club/2023/12/24/riscy-business.html

An example handler function for the RISC-V 'lui' instruction. It calculates the immediate value, writes it to the destination register, and increments the program counter.

```c++
ALWAYS_INLINE static bool handler_rv64_lui(riscvm_ptr self, Instruction inst)
{
    int64_t imm = bit_signer(inst.utype.imm, 20) << 12;
    reg_write(inst.utype.rd, imm);

    self->pc += 4;
    dispatch(); // return true;
}

```

--------------------------------

### Compilation and Execution Commands

Source: https://secret.club/2024/10/21/unnecessarily-exhaustice-rca.html

Commands to compile the C++ reproducer using clang and run the resulting executable under qemu-aarch64.

```bash
./build/stage1/bin/clang --target=aarch64-linux-gnu -O2 test.cpp -fuse-ld=lld -o test.out
./build/stage1/bin/clang --target=aarch64-linux-gnu -O2 test.cpp -fuse-ld=lld -emit-llvm -S -o test.ll
qemu-aarch64 test.out
```

--------------------------------

### CRT0 _start Function

Source: https://secret.club/2023/12/24/riscy-business.html

The _start function initializes relocations, imports, and init arrays before calling the main function. It must be the first function in the file.

```c
static void exit(int exit_code);
static void riscvm_relocs();
void        riscvm_imports() __attribute__((weak));
static void riscvm_init_arrays();
extern int __attribute((noinline)) main();

// NOTE: This function has to be first in the file
void _start()
{
    riscvm_relocs();
    riscvm_imports();
    riscvm_init_arrays();
    exit(main());
    asm volatile("ebreak");
}

void riscvm_imports()
{
    // Left empty on purpose
}
```

--------------------------------

### Example of 'Identity' check logic

Source: https://secret.club/2024/10/21/unnecessarily-exhaustice-rca.html

This describes the condition for the 'Identity' boolean: it is true if all vector elements are less than zero or equal to their index. An example of a true case is [0, 1, -1, 3].

```text
As a reminder, the `Identity` boolean is set to `true` if all elements of the vector are either less than zero or equal to their indices in the vector itself. For example, `[0, 1, -1, 3]` would return `true` and `[0, 0, 0, 0]` would return `false`.
```

--------------------------------

### Basic BattlEye Client Init Implementation

Source: https://secret.club/2020/07/06/bottleye.html

Provides a minimal implementation of the `Init` function for a custom BattlEye client. It caches the game's `send_packet` function and sets up the necessary callbacks in the `client_data` structure.

```cpp
// BEClient_x64!Init
__declspec(dllexport)
battleye::instance_status Init(std::uint64_t integration_version,
                               battleye::becl_game_data* game_data,
                               battleye::becl_be_data* client_data)
{
    // CACHE RELEVANT FUNCTIONS
    battleye::delegate::o_send_packet    = game_data->send_packet;

    // SETUP CLIENT STRUCTURE
    client_data->exit                   = battleye::delegate::exit;
    client_data->run                    = battleye::delegate::run;
    client_data->command                = battleye::delegate::command;
    client_data->received_packet        = battleye::delegate::received_packet;
    client_data->on_receive_auth_ticket = battleye::delegate::on_receive_auth_ticket;
    client_data->add_peer               = battleye::delegate::add_peer;
    client_data->remove_peer            = battleye::delegate::remove_peer;

    return battleye::instance_status::SUCCESSFULLY_INITIALIZED;
}
```

--------------------------------

### Synthesis with Incremental Learning

Source: https://secret.club/2022/08/08/eqsat-oracle-synthesis.html

Demonstrates the output of the synthesis process when incremental learning is enabled. Observe the reduction in e-classes and cost over iterations.

```bash
python3 synth.py
eclasses #: 18
Input (cost = 29): (((((((x&y)*0x3)-(x|y))-(~(x|y)))-(((~x)&y)*0x2))-(~y))-(x|(~y)))
====================================================================================================
eclasses #: 23
Synthesized (cost = 29): (((((((x&y)*0x3)-(x|y))-(~(x|y)))-(((~x)&y)*0x2))-(~y))-(x|(~y)))
====================================================================================================
eclasses #: 27
Synthesized (cost = 29): (((((((x&y)*0x3)-(x|y))-(~(x|y)))-(((~x)&y)*0x2))-(~y))-(x|(~y)))
====================================================================================================
eclasses #: 48
Synthesized (cost = 20): (((-((~x)+(x^y)))+(((x&y)*0x3)+0x1))-(x|(~y)))
====================================================================================================
eclasses #: 108
Synthesized (cost = 18): (((-(((~x)&y)-0x1))+(((x&y)*0x3)+0x1))-(~y))
====================================================================================================
eclasses #: 294
Synthesized (cost = 13): ((((x&y)+0x2)+((x&y)*0x3))+0x1)
====================================================================================================
eclasses #: 947
Synthesized (cost = 11): (((x&y)+0x3)+((x&y)*0x3))
====================================================================================================
eclasses #: 5786
Synthesized (cost = 7): ((0x4*(x&y))+0x3)
====================================================================================================

```

--------------------------------

### Manage Kernel EPT Hook Installation and Removal

Source: https://secret.club/2025/06/02/hypervisors-for-memory-introspection-and-reverse-engineering.html

This function manages the EPT hook for a kernel function. It resolves the function's virtual address using export tables or the SSDT and then either installs or uninstalls the hook based on the 'enable' flag.

```rust
pub fn manage_kernel_ept_hook(
    &mut self,
    vm: &mut Vm,
    function_hash: u32,
    syscall_number: u16,
    ept_hook_type: EptHookType,
    enable: bool,
) -> Result<(), HypervisorError> {
    let action = if enable { "Enabling" } else { "Disabling" };
    debug!("{} EPT hook for function: {:#x}", action, function_hash);

    trace!("Ntoskrnl base VA: {:#x}", self.ntoskrnl_base_va);
    trace!("Ntoskrnl base PA: {:#x}", self.ntoskrnl_base_pa);
    trace!("Ntoskrnl size: {:#x}", self.ntoskrnl_size);

    let function_va = unsafe {
        if let Some(va) = get_export_by_hash(self.ntoskrnl_base_pa as _, self.ntoskrnl_base_va as _, function_hash) {
            va
        } else {
            let ssdt_function_address =
                SsdtHook::find_ssdt_function_address(syscall_number as _, false, self.ntoskrnl_base_pa as _, self.ntoskrnl_size as _);
            match ssdt_function_address {
                Ok(ssdt_hook) => ssdt_hook.guest_function_va as *mut u8,
                Err(_) => return Err(HypervisorError::FailedToGetExport),
            }
        }
    };

    if enable {
        self.ept_hook_function(vm, function_va as _, function_hash, ept_hook_type)?;
    } else {
        self.ept_unhook_function(vm, function_va as _, ept_hook_type)?;
    }

    Ok(())
}

```
Tokens:
Raw