Skip to main content

Questions tagged [automation]

The use of executable programs or scripts to achieve well-defined sequences of operations without human interaction.

Filter by
Sorted by
Tagged with
0 votes
0 answers
44 views

How to decrypt or decode unknown file formats?

I have got a new challange. I hvae some log files that mostly contain android device modem and ap logs. The file extension varies depending on the chipset. There is specific tool provided by the ...
Tinku Hore's user avatar
2 votes
1 answer
1k views

J1939 message payload checksum

I am attempting to reverse engineer some proprietary J1939 CAN traffic so that I can remotely control some actions on a vehicle. I have collected a number of traces covering the events I want to ...
tranzallos's user avatar
1 vote
0 answers
100 views

Retrieve all parameters of specific function: How to automate

I'm trying to reverse engineer.NET binary with dnspy. I have a decryption routine that is used to display useful strings. It takes one integer value as a parameter and uses it in the decryption ...
Raafat's user avatar
  • 163
1 vote
1 answer
87 views

Automated instruction analysis of dynamic memory

Introduction to problem: I have a binary executable with an unknown network packet protocol. I want to reverse engineer this packet protocol. My current way of doing it is to send some data and step ...
AcarX's user avatar
  • 301
1 vote
1 answer
282 views

IDApython - Turning a modified operand into a string reference

I am working on an IDAPython script that is supposed to fix the disassembly of a firmware, by resolving it's symbol table. The core of the script is working fine, but I have some issue when it comes ...
Guillaume's user avatar
  • 709
5 votes
1 answer
196 views

Review a collection of executable binaries to determine similarity

I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
solumnant's user avatar
  • 173
0 votes
0 answers
339 views

Is there a way to see 'imports' in a .NET binary?

Programs such as Detect It Easy or IDA can show functions and libraries (DLLs) imported by a binary in the case of C/C++ binaries. I have a collection of .NET malware that I'm analyzing and would like ...
learnerX's user avatar
  • 233
0 votes
1 answer
227 views

x64dbgpy: application unresponsive when trying to automate inside breakpoint callback

When a breakpoint callback is triggered trying to automate the debugger inside the callback causes the application to become unresponsive. x64dbg continues functioning but the application itself doesn'...
user3238415's user avatar
0 votes
1 answer
337 views

Automatically detecting and carving images from .doc, .docx and spreadsheets

I'm looking for a tool that can extract detect and extract any image format from word documents in both .doc and .docx formats for an automatic document classification use case. It is nice to just ...
solumnant's user avatar
  • 173
3 votes
2 answers
3k views

(MacOS) disable codesign check / run codesign on multiple files

so I have two questions, I'll try to keep it short (also, im a noob): I run logic pro x and other software to make music, and some third party plugins make program crash if they get a: Exception ...
Gobee's user avatar
  • 41
0 votes
2 answers
621 views

Automating a crackme solving process

Let's say we have a simple crackme, which asks for a password. After verifying it, eax will contain 1 if it is correct, and 0 otherwise. Is there a way (I am interested both in Linux and Windows) for ...
robert's user avatar
  • 887
2 votes
2 answers
8k views

Automating bypassing anti-debug checks

I'm working on bypassing the anti-debug checks of an unpacker in x64dbg. My end goal is to bypass all of the checks so that I can run the (unmodified) process with a debugger attached without any ...
P. Private's user avatar
1 vote
1 answer
454 views

How to create empty IDB file with IDApython?

Is it possible to create empty idb file using idapython? My intention is to use it afterwards to populate with several binary code blobs and run some analysis on the resulting idb file and all this ...
PhoeniX's user avatar
  • 3,062
7 votes
1 answer
9k views

How to automatically rename some IDA functions from a given list?

I have a text file which contains a list of function name and address pairs, structured like this : 194C:841B LoadMessage 194C:8429 ShowDialog ... Is there a way (eg: script, automation, ...) to ...
tigrou's user avatar
  • 371
3 votes
2 answers
1k views

How to identify code ran when clicking on an object in a game

I've played with using software like cheat engine to modify memory, null out code and even inject some code of my own. However finding the right spot to modify is always a difficulty. I'd like to be ...
FraserOfSmeg's user avatar
3 votes
0 answers
129 views

Automating a custom QGraphicsObject control in an external QT based process

I have injected a DLL into an external application that is based on the QT framework. I, then, use the method QApplication::allWidgets() and iterate through the list of widgets to find a QGraphicsView ...
pokerguy's user avatar
1 vote
1 answer
518 views

Making plugins for Ollydbg 2

I have been looking around for ways to make plugins in Ollydbg 2 and I haven't seen a good amount of information;I keep finding guides for Immunity Dbg or how to make plugins work. I don't mind ...
LUser's user avatar
  • 793
0 votes
1 answer
4k views

IDAPython load PDB-file of analysed binary

in a python-script which I'm writing I need the possibility to load via IDA-Python the PDB-File of the analysed binary (PE-File). I know how to load a PDB-File via GUi but I need this scripted. Has ...
Daniel's user avatar
  • 1
2 votes
2 answers
3k views

Using an existing IDB from IDA command line interface

Is there any way to use an existing IDB from the IDA command line interface ? I went through the list of command line switches here but there isn't any related switches. As I am currently scripting ...
iridescent's user avatar
2 votes
2 answers
826 views

Force IDA starter 6.5 to disassemble encrypted in autonomous mode

I'm using IDA Starter 6.5 on linux. (Debian Wheezy 32bit) I would like to perform batch analysis on a bunch of iOS apps with an IDAPython script. To do so, I use command as such, to call text ...
pa4373's user avatar
  • 31
12 votes
2 answers
3k views

Detecting recursive functions in IDA

How can I detect/mark recursive functions in IDA? Trivial method would be to check every function's call list and if it calls itself then it's recursive. I'ld like to put a comment or some kind of ...
Dominik Antal's user avatar
2 votes
0 answers
84 views

Opinions and suggestions regarding malware sandboxes [closed]

I'm relatively new in the field of automatic malware analysis and I'd like to ask about hands-on opinions about sandboxes in the following aspects: extensibility of the product - adding your own ...
PhoeniX's user avatar
  • 3,062
5 votes
1 answer
180 views

How to investigate function calls across a batch of targets?

Say I have a collection of N executables, where N is large enough to make repetitive manual analysis tedious. I want to process all of these files and extract information about certain function calls, ...
user1307's user avatar
  • 109