Questions tagged [automation]
The use of executable programs or scripts to achieve well-defined sequences of operations without human interaction.
18
questions
0
votes
0answers
31 views
Is there a way to see 'imports' in a .NET binary?
Programs such as Detect It Easy or IDA can show functions and libraries (DLLs) imported by a binary in the case of C/C++ binaries. I have a collection of .NET malware that I'm analyzing and would like ...
0
votes
1answer
49 views
x64dbgpy: application unresponsive when trying to automate inside breakpoint callback
When a breakpoint callback is triggered trying to automate the debugger inside the callback causes the application to become unresponsive. x64dbg continues functioning but the application itself doesn'...
0
votes
1answer
61 views
Automatically detecting and carving images from .doc, .docx and spreadsheets
I'm looking for a tool that can extract detect and extract any image format from word documents in both .doc and .docx formats for an automatic document classification use case. It is nice to just ...
0
votes
0answers
36 views
Replacing a function call with it's result in a script
I'm working with a heavily obfuscated Autoit malware script and one of the major problems is that almost all variables and lines of code are obfuscated by a custom function.
The problem is that this ...
3
votes
1answer
153 views
(MacOS) disable codesign check / run codesign on multiple files
so I have two questions, I'll try to keep it short (also, im a noob):
I run logic pro x and other software to make music, and some third party plugins make program crash if they get a:
Exception ...
0
votes
2answers
218 views
Automating a crackme solving process
Let's say we have a simple crackme, which asks for a password. After verifying it, eax will contain 1 if it is correct, and 0 otherwise. Is there a way (I am interested both in Linux and Windows) for ...
1
vote
2answers
1k views
Automating bypassing anti-debug checks
I'm working on bypassing the anti-debug checks of an unpacker in x64dbg. My end goal is to bypass all of the checks so that I can run the (unmodified) process with a debugger attached without any ...
0
votes
1answer
279 views
How to create empty IDB file with IDApython?
Is it possible to create empty idb file using idapython?
My intention is to use it afterwards to populate with several binary code blobs and run some analysis on the resulting idb file and all this ...
6
votes
1answer
5k views
How to automatically rename some IDA functions from a given list?
I have a text file which contains a list of function name and address pairs, structured like this :
194C:841B LoadMessage
194C:8429 ShowDialog
...
Is there a way (eg: script, automation, ...) to ...
3
votes
2answers
465 views
How to identify code ran when clicking on an object in a game
I've played with using software like cheat engine to modify memory, null out code and even inject some code of my own. However finding the right spot to modify is always a difficulty. I'd like to be ...
3
votes
0answers
105 views
Automating a custom QGraphicsObject control in an external QT based process
I have injected a DLL into an external application that is based on the QT framework. I, then, use the method QApplication::allWidgets() and iterate through the list of widgets to find a QGraphicsView ...
1
vote
1answer
344 views
Making plugins for Ollydbg 2
I have been looking around for ways to make plugins in Ollydbg 2 and I haven't seen a good amount of information;I keep finding guides for Immunity Dbg or how to make plugins work.
I don't mind ...
0
votes
1answer
3k views
IDAPython load PDB-file of analysed binary
in a python-script which I'm writing I need the possibility to load via IDA-Python the PDB-File of the analysed binary (PE-File).
I know how to load a PDB-File via GUi but I need this scripted.
Has ...
1
vote
2answers
2k views
Using an existing IDB from IDA command line interface
Is there any way to use an existing IDB from the IDA command line interface ?
I went through the list of command line switches here but there isn't any related switches.
As I am currently scripting ...
2
votes
2answers
753 views
Force IDA starter 6.5 to disassemble encrypted in autonomous mode
I'm using IDA Starter 6.5 on linux. (Debian Wheezy 32bit)
I would like to perform batch analysis on a bunch of iOS apps with an IDAPython script.
To do so, I use command as such, to call text ...
12
votes
2answers
2k views
Detecting recursive functions in IDA
How can I detect/mark recursive functions in IDA?
Trivial method would be to check every function's call list and if it calls itself then it's recursive. I'ld like to put a comment or some kind of ...
2
votes
0answers
81 views
Opinions and suggestions regarding malware sandboxes [closed]
I'm relatively new in the field of automatic malware analysis and I'd like to ask about hands-on opinions about sandboxes in the following aspects:
extensibility of the product - adding your own ...
4
votes
1answer
148 views
How to investigate function calls across a batch of targets?
Say I have a collection of N executables, where N is large enough to make repetitive manual analysis tedious. I want to process all of these files and extract information about certain function calls, ...
