nkl0x55

LLM Wiki

A pattern for building personal knowledge bases using LLMs.

This is an idea file, it is designed to be copy pasted to your own LLM Agent (e.g. OpenAI Codex, Claude Code, OpenCode / Pi, or etc.). Its goal is to communicate the high level idea, but your agent will build out the specifics in collaboration with you.

The core idea

Most people's experience with LLMs and documents looks like RAG: you upload a collection of files, the LLM retrieves relevant chunks at query time, and generates an answer. This works, but the LLM is rediscovering knowledge from scratch on every question. There's no accumulation. Ask a subtle question that requires synthesizing five documents, and the LLM has to find and piece together the relevant fragments every time. Nothing is built up. NotebookLM, ChatGPT file uploads, and most RAG systems work this way.

Search Engine Shortcuts

Use Manage Search Engines in your browser to add these search engines. You can then use the 'keyword' in the URL bar to do a quick lookup. Find more details about managing your search engines in Chrome here.

e.g. Type

v dad8ebcbb5fa6721ccad45b81874e22c

Index

Dead Trees - Physical books with a lot of good info.
Intel - Intelligence gathering tools.
Labs - Sources for good labs.
Theory - Great on-line sources of information.
Tools - A list of useful tools.
Websites/Social Media - A list of people to follow on Twitter and other places.

This Gist has been transfered into a Github Repo. You'll find the most recent version here.

YARA Performance Guidelines

When creating your rules for YARA keep in mind the following guidelines in order to get the best performance from them. This guide is based on ideas and recommendations by Victor M. Alvarez and WXS.

Revision 1.4, October 2020, applies to all YARA versions higher than 3.7

	Windows version:
	reg query x64 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion

	Users who have authed to the system:
	ls C:\Users\

	System env variables:
	reg query x64 HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment

	Saved outbound RDP connections:

	#!/bin/bash
	#____ ____ __
	#\ \ / /____ _____/ \|_ ___________
	# \ Y // __ \_/ ___\ __\/ _ \_ __ \
	# \ /\ ___/\ \___\| \| ( <_> ) \| \/
	# \___/ \___ >\___ >__\| \____/\|__\|
	# \/ \/
	#--Author : Vector/NullArray
	#----Twitter: @Real__Vector
	#--------Licensed under GNU GPL 3

	# https://github.com/mattifestation/CatalogTools
	Import-Module CatalogTools

	# install.wim was mounted to C:\Mount with Mount-WindowsImage
	$SystemCatalogEntries = ls -Path C:\Mount -Include '*.cat' -Recurse \| % {
	$CatalogInfo = Get-CatalogFile -Path $_.FullName
	$FilePath = 'C:' + $CatalogInfo.FilePath.Path.Substring(8)

	$CatalogInfo.CatalogMembers \| ? { $_.HashInfo.Algorithm -and $_.HashInfo.FileHash } \| % {
	$Hint = $null

	# Procmon Rule Parser v0.02
	# Brian Baskin - @bbaskin
	# Reads default rules from an exported Procmon Configuration (.PMC) or Procmon Filter (.PMF) file
	# Example output:
	"""
	12:09:59-bbaskin@~/Development/Noriben$ python parse_procmon_filters.py -f ProcmonConfiguration.pmc
	[Exclude] Process Name is Procmon64.exe
	[Exclude] Operation is QueryStandardInformationFile
	[Exclude] Operation is RegOpenKey
	[Exclude] Operation is NotifyChangeDirectory

	# Inspiration from https://twitter.com/mrhvid/status/929717169130176512 @mrhvid @Lee_Holmes

	function ResolveIp($IpAddress) {
	try {
	(Resolve-DnsName $IpAddress -QuickTimeout -ErrorAction SilentlyContinue).NameHost
	} catch {
	$null
	}
	}