Questions tagged [automation]
The use of executable programs or scripts to achieve well-defined sequences of operations without human interaction.
25
questions
0
votes
0
answers
29
views
Automatically rename known functions from libraries in IDA
I have a binary file written in c and c++ which uses some libraries. The C/C++ source code of these libraries is publicly accessible online (github). Is there a way in IDA to somehow import this ...
0
votes
0
answers
18
views
Gerrit send js `fetch` to post a reply to a patch
With a gerrit server at http://<server>/, I want to use javascript to POST a reply to a given patch, and that reply should be from my user account. If I manually send a reply using the gerrit UI ...
- 101
1
vote
1
answer
131
views
How to decrypt or decode unknown file formats?
I have got a new challange. I hvae some log files that mostly contain android device modem and ap logs.
The file extension varies depending on the chipset. There is specific tool provided by the ...
CommunityBot
- 1
2
votes
1
answer
1k
views
J1939 message payload checksum
I am attempting to reverse engineer some proprietary J1939 CAN traffic so that I can remotely control some actions on a vehicle. I have collected a number of traces covering the events I want to ...
- 1
5
votes
1
answer
196
views
Review a collection of executable binaries to determine similarity
I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
CommunityBot
- 1
1
vote
0
answers
100
views
Retrieve all parameters of specific function: How to automate
I'm trying to reverse engineer.NET binary with dnspy. I have a decryption routine that is used to display useful strings. It takes one integer value as a parameter and uses it in the decryption ...
- 163
1
vote
1
answer
88
views
Automated instruction analysis of dynamic memory
Introduction to problem: I have a binary executable with an unknown network packet protocol. I want to reverse engineer this packet protocol. My current way of doing it is to send some data and step ...
- 9,198
1
vote
1
answer
284
views
IDApython - Turning a modified operand into a string reference
I am working on an IDAPython script that is supposed to fix the disassembly of a firmware, by resolving it's symbol table.
The core of the script is working fine, but I have some issue when it comes ...
- 709
3
votes
2
answers
3k
views
(MacOS) disable codesign check / run codesign on multiple files
so I have two questions, I'll try to keep it short (also, im a noob):
I run logic pro x and other software to make music, and some third party plugins make program crash if they get a:
Exception ...
0
votes
0
answers
341
views
Is there a way to see 'imports' in a .NET binary?
Programs such as Detect It Easy or IDA can show functions and libraries (DLLs) imported by a binary in the case of C/C++ binaries. I have a collection of .NET malware that I'm analyzing and would like ...
- 233
0
votes
1
answer
229
views
x64dbgpy: application unresponsive when trying to automate inside breakpoint callback
When a breakpoint callback is triggered trying to automate the debugger inside the callback causes the application to become unresponsive. x64dbg continues functioning but the application itself doesn'...
- 1,707
0
votes
1
answer
339
views
Automatically detecting and carving images from .doc, .docx and spreadsheets
I'm looking for a tool that can extract detect and extract any image format from word documents in both .doc and .docx formats for an automatic document classification use case. It is nice to just ...
- 216
0
votes
2
answers
625
views
Automating a crackme solving process
Let's say we have a simple crackme, which asks for a password. After verifying it, eax will contain 1 if it is correct, and 0 otherwise. Is there a way (I am interested both in Linux and Windows) for ...
- 96
2
votes
2
answers
8k
views
Automating bypassing anti-debug checks
I'm working on bypassing the anti-debug checks of an unpacker in x64dbg. My end goal is to bypass all of the checks so that I can run the (unmodified) process with a debugger attached without any ...
- 109
3
votes
2
answers
1k
views
How to identify code ran when clicking on an object in a game
I've played with using software like cheat engine to modify memory, null out code and even inject some code of my own. However finding the right spot to modify is always a difficulty. I'd like to be ...
CommunityBot
- 1
1
vote
1
answer
456
views
How to create empty IDB file with IDApython?
Is it possible to create empty idb file using idapython?
My intention is to use it afterwards to populate with several binary code blobs and run some analysis on the resulting idb file and all this ...
- 1,577
7
votes
1
answer
9k
views
How to automatically rename some IDA functions from a given list?
I have a text file which contains a list of function name and address pairs, structured like this :
194C:841B LoadMessage
194C:8429 ShowDialog
...
Is there a way (eg: script, automation, ...) to ...
- 8,528
3
votes
0
answers
129
views
Automating a custom QGraphicsObject control in an external QT based process
I have injected a DLL into an external application that is based on the QT framework. I, then, use the method QApplication::allWidgets() and iterate through the list of widgets to find a QGraphicsView ...
- 19.2k
12
votes
2
answers
3k
views
Detecting recursive functions in IDA
How can I detect/mark recursive functions in IDA?
Trivial method would be to check every function's call list and if it calls itself then it's recursive. I'ld like to put a comment or some kind of ...
CommunityBot
- 1
1
vote
1
answer
519
views
Making plugins for Ollydbg 2
I have been looking around for ways to make plugins in Ollydbg 2 and I haven't seen a good amount of information;I keep finding guides for Immunity Dbg or how to make plugins work.
I don't mind ...
CommunityBot
- 1
0
votes
1
answer
4k
views
IDAPython load PDB-file of analysed binary
in a python-script which I'm writing I need the possibility to load via IDA-Python the PDB-File of the analysed binary (PE-File).
I know how to load a PDB-File via GUi but I need this scripted.
Has ...
- 19.2k
2
votes
2
answers
3k
views
Using an existing IDB from IDA command line interface
Is there any way to use an existing IDB from the IDA command line interface ?
I went through the list of command line switches here but there isn't any related switches.
As I am currently scripting ...
- 20.7k
2
votes
2
answers
826
views
Force IDA starter 6.5 to disassemble encrypted in autonomous mode
I'm using IDA Starter 6.5 on linux. (Debian Wheezy 32bit)
I would like to perform batch analysis on a bunch of iOS apps with an IDAPython script.
To do so, I use command as such, to call text ...
- 31
2
votes
0
answers
84
views
Opinions and suggestions regarding malware sandboxes [closed]
I'm relatively new in the field of automatic malware analysis and I'd like to ask about hands-on opinions about sandboxes in the following aspects:
extensibility of the product - adding your own ...
- 3,062
5
votes
1
answer
180
views
How to investigate function calls across a batch of targets?
Say I have a collection of N executables, where N is large enough to make repetitive manual analysis tedious. I want to process all of these files and extract information about certain function calls, ...
- 4,066