Questions tagged [automation]
The use of executable programs or scripts to achieve well-defined sequences of operations without human interaction.
22
questions
12
votes
2
answers
3k
views
Detecting recursive functions in IDA
How can I detect/mark recursive functions in IDA?
Trivial method would be to check every function's call list and if it calls itself then it's recursive. I'ld like to put a comment or some kind of ...
- 2,038
7
votes
1
answer
9k
views
How to automatically rename some IDA functions from a given list?
I have a text file which contains a list of function name and address pairs, structured like this :
194C:841B LoadMessage
194C:8429 ShowDialog
...
Is there a way (eg: script, automation, ...) to ...
- 371
5
votes
1
answer
176
views
How to investigate function calls across a batch of targets?
Say I have a collection of N executables, where N is large enough to make repetitive manual analysis tedious. I want to process all of these files and extract information about certain function calls, ...
- 109
5
votes
1
answer
194
views
Review a collection of executable binaries to determine similarity
I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
- 173
3
votes
2
answers
1k
views
How to identify code ran when clicking on an object in a game
I've played with using software like cheat engine to modify memory, null out code and even inject some code of my own. However finding the right spot to modify is always a difficulty. I'd like to be ...
- 233
3
votes
2
answers
2k
views
(MacOS) disable codesign check / run codesign on multiple files
so I have two questions, I'll try to keep it short (also, im a noob):
I run logic pro x and other software to make music, and some third party plugins make program crash if they get a:
Exception ...
- 41
3
votes
0
answers
129
views
Automating a custom QGraphicsObject control in an external QT based process
I have injected a DLL into an external application that is based on the QT framework. I, then, use the method QApplication::allWidgets() and iterate through the list of widgets to find a QGraphicsView ...
- 53
2
votes
2
answers
7k
views
Automating bypassing anti-debug checks
I'm working on bypassing the anti-debug checks of an unpacker in x64dbg. My end goal is to bypass all of the checks so that I can run the (unmodified) process with a debugger attached without any ...
- 180
2
votes
1
answer
366
views
J1939 message payload checksum
I am attempting to reverse engineer some proprietary J1939 CAN traffic so that I can remotely control some actions on a vehicle. I have collected a number of traces covering the events I want to ...
- 51
2
votes
2
answers
2k
views
Using an existing IDB from IDA command line interface
Is there any way to use an existing IDB from the IDA command line interface ?
I went through the list of command line switches here but there isn't any related switches.
As I am currently scripting ...
- 123
2
votes
2
answers
818
views
Force IDA starter 6.5 to disassemble encrypted in autonomous mode
I'm using IDA Starter 6.5 on linux. (Debian Wheezy 32bit)
I would like to perform batch analysis on a bunch of iOS apps with an IDAPython script.
To do so, I use command as such, to call text ...
- 31
2
votes
0
answers
84
views
Opinions and suggestions regarding malware sandboxes [closed]
I'm relatively new in the field of automatic malware analysis and I'd like to ask about hands-on opinions about sandboxes in the following aspects:
extensibility of the product - adding your own ...
- 3,002
1
vote
1
answer
87
views
Automated instruction analysis of dynamic memory
Introduction to problem: I have a binary executable with an unknown network packet protocol. I want to reverse engineer this packet protocol. My current way of doing it is to send some data and step ...
- 291
1
vote
1
answer
425
views
How to create empty IDB file with IDApython?
Is it possible to create empty idb file using idapython?
My intention is to use it afterwards to populate with several binary code blobs and run some analysis on the resulting idb file and all this ...
- 3,002
1
vote
1
answer
210
views
IDApython - Turning a modified operand into a string reference
I am working on an IDAPython script that is supposed to fix the disassembly of a firmware, by resolving it's symbol table.
The core of the script is working fine, but I have some issue when it comes ...
- 709
1
vote
0
answers
70
views
Retrieve all parameters of specific function: How to automate
I'm trying to reverse engineer.NET binary with dnspy. I have a decryption routine that is used to display useful strings. It takes one integer value as a parameter and uses it in the decryption ...
- 163
1
vote
1
answer
493
views
Making plugins for Ollydbg 2
I have been looking around for ways to make plugins in Ollydbg 2 and I haven't seen a good amount of information;I keep finding guides for Immunity Dbg or how to make plugins work.
I don't mind ...
- 773
0
votes
2
answers
570
views
Automating a crackme solving process
Let's say we have a simple crackme, which asks for a password. After verifying it, eax will contain 1 if it is correct, and 0 otherwise. Is there a way (I am interested both in Linux and Windows) for ...
- 877
0
votes
1
answer
4k
views
IDAPython load PDB-file of analysed binary
in a python-script which I'm writing I need the possibility to load via IDA-Python the PDB-File of the analysed binary (PE-File).
I know how to load a PDB-File via GUi but I need this scripted.
Has ...
- 1
0
votes
1
answer
196
views
x64dbgpy: application unresponsive when trying to automate inside breakpoint callback
When a breakpoint callback is triggered trying to automate the debugger inside the callback causes the application to become unresponsive. x64dbg continues functioning but the application itself doesn'...
- 103
0
votes
1
answer
314
views
Automatically detecting and carving images from .doc, .docx and spreadsheets
I'm looking for a tool that can extract detect and extract any image format from word documents in both .doc and .docx formats for an automatic document classification use case. It is nice to just ...
- 173
0
votes
0
answers
272
views
Is there a way to see 'imports' in a .NET binary?
Programs such as Detect It Easy or IDA can show functions and libraries (DLLs) imported by a binary in the case of C/C++ binaries. I have a collection of .NET malware that I'm analyzing and would like ...
- 233