How to find out address in binary file (like IDA) with python code only?

Question

I have binary for example https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap that I open with IDA , and search some data that I want to find without open IDA ,only with python code

1) How to find what is the address of this series of bytes :48 8B 45 A8 48 8D 1C 02 48 8B 45 C8 ? , the result need to be 0x6B0C67

2)How to find out the 12 bytes that in address 0x6B0C67 ? the result need to be 48 8B 45 A8 48 8D 1C 02 48 8B 45 C8 .

3) How to find which address call to specific string? for example i + 1 == features[i].index that locate in 0x6FC272 ? the result need to be 0x4022F6

How can I find all of this without open Ida? only with python/c code?

thanks

Answer 1

you mean you want to search for a hex pattern in an arbitrary file using your own code either in python or c ?

have you considered using regex or grep to satisfy your needs ?

there are certain things you should be aware of
1) file offsets will not be equal to virtual offsets
2) even if you manage to map the file you may have to deal with aslr
2) you need to brush up your understanding of RVA ,VA , File Offset,File Alignment Versus Section Alignment etc

here is a sample grep demo (notice the similarity in the last 5 bytes )

:\>grep  -obaP "\x48\x8b\x45\xa8\x48\x8d\x1c\x02\x48\x8b\x45\xc8" nmap
2821223:H<E"H?∟☻H<EE

:\>printf "%x\n" 2821223
2b0c67

or python demo
source

D:\>cat nmap.py
import re
fin = open("d:/nmap" , "rb")
dat = fin.read()
fin.close()
pat = re.search("\x48\x8b\x45\xa8\x48\x8d\x1c\x02\x48\x8b\x45\xc8",dat)
offset = hex(pat.start())
print (offset)

result

D:\>python nmap.py
0x2b0c67

now that you know how to find offset you can use any hex editor to print the bytes

here is an xxd demo

D:\>xxd -l 32 -g 1 -s 0x2b0c67 nmap
02b0c67: 48 8b 45 a8 48 8d 1c 02 48 8b 45 c8 48 89 c7 e8  H.E.H...H.E.H...
02b0c77: a3 d7 ff ff 48 89 c2 48 8b 45 c0 48 01 d0 48 39  ....H..H.E.H..H9

you can simply use binascii to print the bytes at an offset in python as below

D:\>type nmap.py
import re
import binascii
fin = open("d:/nmap" , "rb")
dat = fin.read()
pat = re.search("\x48\x8b\x45\xa8\x48\x8d\x1c\x02\x48\x8b\x45\xc8",dat)
offset = hex(pat.start())
print (offset)
print ( binascii.hexlify(dat[pat.start():pat.start()+16]))
fin.close()
D:\>


D:\>python nmap.py
0x2b0c67
488b45a8488d1c02488b45c84889c7e8