g-les

GET /s11?language=ENU&viewerType=Reader&viewerVersion=23.00820533&platform=WIN&activeDocs=1&errs=&av=NONE&osVersion=10.0.19041.1288&pdfFile=C:%5CUsers%5CBruno%5CDesktop%5Cattachment.pdf&rnd=0.6363903904530459&od=319988 HTTP/1.1
Accept: */*
User-Agent: Mozilla/3.0 (compatible; Adobe Synchronizer 23.8.20533)
Host: 169.40.2.68:45191
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 23 Mar 2026 12:07:36 GMT

g-les

bv.navigate(bv.view, bv.get_next_data_var_start_after(here))

g-les

rule donut_shellcode_fixed
{
meta:
description = "Tested against shellcodes x86/x64 generated by Donut v0.9.3"
author = "Telsy CTI team"
date = "18/11/2021"
condition:
uint8(0) == 0xe8 and // shellcode starts with a call
uint32(1) == uint32(5) and
// xor generator key and xor initial key cannot be null it is 32 bytes

g-les

Keybase proof

I hereby claim:

• I am g-les on github.
• I am glesnewich (https://keybase.io/glesnewich) on keybase.
• I have a public key ASC1pkCbjKDRmT41uYt-kT0-3i4YkwNvWM5PUPNx__axaQo

To claim this, I am signing this object:

g-les

/*
Goals for #100DaysofYARA:

better understanding of bitwise operators
use math module beyond general entropy of a section / resource
position specific things beyond what PE module tells us
do some funky stuff with hashing


*/