0

I have binary for example https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap that I open with IDA , and search some data that I want to find without open IDA ,only with python code

1) How to find what is the address of this series of bytes :48 8B 45 A8 48 8D 1C 02 48 8B 45 C8 ? , the result need to be 0x6B0C67

2)How to find out the 12 bytes that in address 0x6B0C67 ? the result need to be 48 8B 45 A8 48 8D 1C 02 48 8B 45 C8 .

3) How to find which address call to specific string? for example i + 1 == features[i].index that locate in 0x6FC272 ? the result need to be 0x4022F6

How can I find all of this without open Ida? only with python/c code?

thanks

1

you mean you want to search for a hex pattern in an arbitrary file using your own code either in python or c ?

have you considered using regex or grep to satisfy your needs ?

there are certain things you should be aware of
1) file offsets will not be equal to virtual offsets
2) even if you manage to map the file you may have to deal with aslr
2) you need to brush up your understanding of RVA ,VA , File Offset,File Alignment Versus Section Alignment etc

here is a sample grep demo (notice the similarity in the last 5 bytes )

:\>grep  -obaP "\x48\x8b\x45\xa8\x48\x8d\x1c\x02\x48\x8b\x45\xc8" nmap
2821223:H<E"H?∟☻H<EE

:\>printf "%x\n" 2821223
2b0c67

or python demo
source

D:\>cat nmap.py
import re
fin = open("d:/nmap" , "rb")
dat = fin.read()
fin.close()
pat = re.search("\x48\x8b\x45\xa8\x48\x8d\x1c\x02\x48\x8b\x45\xc8",dat)
offset = hex(pat.start())
print (offset)

result

D:\>python nmap.py
0x2b0c67

now that you know how to find offset you can use any hex editor to print the bytes

here is an xxd demo

D:\>xxd -l 32 -g 1 -s 0x2b0c67 nmap
02b0c67: 48 8b 45 a8 48 8d 1c 02 48 8b 45 c8 48 89 c7 e8  H.E.H...H.E.H...
02b0c77: a3 d7 ff ff 48 89 c2 48 8b 45 c0 48 01 d0 48 39  ....H..H.E.H..H9

you can simply use binascii to print the bytes at an offset in python as below

D:\>type nmap.py
import re
import binascii
fin = open("d:/nmap" , "rb")
dat = fin.read()
pat = re.search("\x48\x8b\x45\xa8\x48\x8d\x1c\x02\x48\x8b\x45\xc8",dat)
offset = hex(pat.start())
print (offset)
print ( binascii.hexlify(dat[pat.start():pat.start()+16]))
fin.close()
D:\>


D:\>python nmap.py
0x2b0c67
488b45a8488d1c02488b45c84889c7e8
  • I know what is RVA,VA , I want get the addres , with your code I get 2b0c67 that the file offset of 48 8B 45 A8 48 8D 1C 02 48 8B 45 C8 but I looking to get 0x6B0C67 that ImageBase(0x400000) + 2b0c67 , so maybe I need to ask , how can I get with python the ImageBase address ? by thw way, do you know how to answer on question 3 ? – Uiomkokf May 5 at 13:33
  • ImageBase is hardcoded in elf header ProgramHeader->p_vaddr i didnt understand what is your third question what do you mean by call to specific string i dont know – blabb May 5 at 18:39
  • when you open this binary in IDA you can find all the string the contain in binary, and each string you can check which address call to this string... – Uiomkokf May 6 at 5:00
  • strings are not called . functions are called :( do you mean xrefs to the strings ? like int compare(char * blah , char *foo) where blah and foo are strings and these will have xrefs to them from this function compare no doing that is not trivial from your own code unless you can write your own disassembler – blabb May 6 at 5:46
  • 1) what is the easy way to get ProgramHeader->p_vadd from elf file with python ? 2) yes I mean xrefs .... thanks – Uiomkokf May 6 at 8:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.