-1

I'm debugging an .exe file in IDA.

At a specific point during debugging, I want the Python code to automatically take the data in *(eax+8) and encrypt it with that module and print the result to file in my disk.

The Python package I want to use is pycrypto (more specifically the AES module from it).

for example:

from Crypto.Cipher import AES
from Crypto import Random

key = b'Sixteen byte key'
iv = Random.new().read(AES.block_size)
cipher = AES.new(key, AES.MODE_CFB, iv)
msg = iv + cipher.encrypt(b'here I want to put the data in eax+8')

and write the msg to c:\.txt

How can I do it?

  • From your question (before my edit and still now) it's unclear what exactly is at (eax+8). From the context I'd assume it's some array of bytes of arbitrary length, but from your use of *(eax+8) I'm more inclined to think it's a fixed size datum. So which is it? – 0xC0000022L Jul 26 '18 at 10:58
1

Use breakpoints with conditions and add your Python script as the condition. Do whatever you want in the Python code and then either return True or False if you want the debugger to stop or not.

  • Do I need to install IdaPython to write pyhon in condition? and how do I take to pyhon the value the in *(eax+8) ?? – Jonert6544 Jul 25 '18 at 16:44
  • You can use either IDC or IDAPython. To read the value from *(eax+8) you can use: Dword(cpu.EAX + 8), IIRC. – joxeankoret Jul 25 '18 at 16:50
  • When making the condition make sure to hit the ... button to the right that brings out the big script editor and in the dropdown near the bottom change the language from IDC to python. I'm not sure if that'll actually wok though cause I've only written bp conditions in IDC – Avery3R Jul 25 '18 at 19:12

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.