Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [python]

General-purpose and high-level programming language. Python supports multiple programming paradigms, including object-oriented, imperative and functional programming styles.

2
votes
4answers
2k views

How to decompile with Hex Rays via a Python API?

If i have a large set of files and I'd like to run Hex-rays over them to produce output as C - can I do so in python? I see there is IDA Python And I see Hex-rays has a C++ SDK Is there a python Hex-...
0
votes
0answers
18 views

Decoding blob data from a sqlite database into readable format

I have a Sqlite database file that has blob data in it. I only know the the database has blob data and I know what the expected output should be. The blob data's expected output should be a Mac ...
3
votes
2answers
104 views

The structure of the Python's marshaled code object (or .pyc file)

Help me to decipher the Python's marshaled code object. The .pyc files are almost the same: The structure of .pyc files. I have: The code object compiled from the source. The marshaled ...
1
vote
0answers
94 views

Illegal instruction fault in stack based buffer overflow

I wrote this short C program to practice buffer overflow exploits: #include <stdio.h> #include <string.h> #include <stddef.h> #include <inttypes.h> char *decode(char *s){ ...
0
votes
0answers
25 views

How to run python script in IDA PRO after each breakpoint?

I want to write a script which after breakpoint will change some values in running program. I've tried to write script into condition field but it generates error. I'm trying to find something like '...
0
votes
1answer
40 views

Best python framework/library for constructing the call-graph from binary?

So i have written a python tool using capstone that disassembles the code section of a ELF binary using capstone. now i want to also create and show the call-graph of this binary in a dot format, I ...
1
vote
0answers
61 views

Debugging Ghidra Script

I want to write a new script for ghidra to extract variuous information from the binary and store it to an external file for future management. I need to perform the analyisis with Ghidra Headless in ...
4
votes
2answers
2k views

idapython - Determine if item is code or data

I need to determine whether an IDA's item is code or data. Sometimes, data resides in an executable's code section (virtual functions tables, switch tables and stuff). So in IDA, you can sometimes see ...
24
votes
5answers
42k views

How do you reverse engineer an EXE “compiled” with PyInstaller

Having recently watched/read a presentation given by Dave Kennedy at DEF CON 20 [PDF], I'd like to know how to decompile a Python script compiled with PyInstaller. In his presentation, he is creating ...
0
votes
2answers
73 views

capturing the sub processes's PID of a process

When a program is executed, some processes may be created by the parent process. Especially, if a program is malware, created (or forked or even injected) sub-processes will be named as a systemic ...
2
votes
1answer
49 views

IDA Python get struct type with dependencies

Over the IDA Gui it is possible to export a local type with dependencies to a header file. For example if i export a struct that has one member from type DWORD than the header file also contains "...
3
votes
2answers
1k views

Run a python command with “run” on GDB

Hi I'd like to run a python command python -c 'print "\x90"*52' when the program start in GDB, as I would do when I execute : python -c 'print "\x90"*52' | ./myProg . Does anyone knows any way to ...
2
votes
1answer
100 views

ROP chain: Buffer Overflow Return Pointer

I am trying to get a ROP exploit to work on Ubuntu 18.04 LTS 64bit. I have a 64 bit binary (Nx enabled, ASLR disabled) with vuln function as follows: public vuln vuln proc near var_100= byte ptr -...
1
vote
2answers
987 views

IDA scripting - get local variable by its name

During the debugging I can see all the function's local variables in tab Locals (Debugger -> Debugger Windows -> Locals(HEXRAYS)). For example I have a struct variable a1 0x891E1160:{pBuf=...
2
votes
1answer
191 views

IDA Dump Memory

I am learning how to use IDC Scripting,or IDAPython in IDA for Reversing binary.One day i face this problem: You are given an array of random integer(4-byte integer) lies within the memory .The ...
3
votes
3answers
1k views

Reverse engineering USB peripheral driver

I'm looking to reverse engineer a Windows driver for a printer I have here. I found out a bit about USB sniffing but I don't think Snoopy runs on Windows 7. I know the driver is on my computer ...
7
votes
2answers
1k views

Decompile Python for ELF Binaries

There are several solutions available to extract Pyc files from Windows binaries and then decompile them using uncompyle2 or uncompyle6. However, I have a Linux ELF 64-bit binary which was compiled ...
19
votes
6answers
45k views

Decompiling .pyc files

Does anybody have a suggestion for (non commercial) software to decompile "byte-code" Python (.pyc) files? Everything I've found seems to break...
22
votes
5answers
7k views

What are the tools to analyze Python (obfuscated) bytecode?

Recently on Reddit ReverseEngineering I stumbled on a self-modifying code in Python. Looking at the Github repository was quite instructive and I found picture of the Python bytecode program exposed ...
0
votes
1answer
188 views

What is the right way to pack a payload with Python3's pwntools

On the tutorial by Megabeets, "A journey into Radare 2 – Part 2: Exploitation", he shows an example of how to create a payload with Python2 # Initial payload payload = "A"*140 # padding ropchain = ...
0
votes
1answer
39 views

generating byte file with IDA batch command

how to use the command line to generate the byte file using IDA? I know how to get the .asm but not the byte file
1
vote
1answer
989 views

Resolving DLL function names using ordinals

I am trying to figure out how to get the imports of a PE using the PEfile python project (https://github.com/erocarrera/pefile) One thing special about that library is the ordlookup folder. It looks ...
4
votes
0answers
200 views

How do I perform concolic execution with Angr and collect constraints on input?

I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
2
votes
2answers
290 views

How can I reverse this recursive function?

This is the python code I wrote of a simple crackme that I have reversed but I am not able to understand what the recursive function here does. def the_process(stored, inp, size): idx = 0 ...
-1
votes
1answer
54 views

How to use Python while debugging in IDA

I'm debugging an .exe file in IDA. At a specific point during debugging, I want the Python code to automatically take the data in *(eax+8) and encrypt it with that module and print the result to file ...
0
votes
1answer
151 views

Pyemu - cannot use PEPyEmu() module, Python

I want to run code from Gray Hat Python book for upx_unpacker. I have downloaded PyEmu, but when I run script I got this error: AttributeError: PEPyEmu instance has no attribute 'load' My script use ...
1
vote
3answers
1k views

How to monitor/reverse engineer RS485-connected display device traffic?

Can anyone point me in the right direction for tutorials etc on reverse engineering RS484 connected battery management system? I have a large 12V lithium battery module which has an internal BMS and ...
4
votes
1answer
271 views

Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?

I understand that I can execute my script within a session using [0x401000]> . server.py and the pipe will be connected to it when I call r2pipe.open() with no arguments. Ideally I would like to ...
2
votes
2answers
315 views

IDA: call a function with different arguments

I'm reversing some software and found the function which decrypts some stuff: As you can see it has the password parameter for it which gets decrypted in this function. Function disassembly: ...
1
vote
2answers
244 views

What is a more efficient way to locate disasm patterns in IDAPython?

This is my first "serious" IDAPython script. As I sorta suspected, it's performing waaaayyyyy too slow so I wanted to ask for some pointers on this: fp = MinEA() end = MaxEA() while fp < end: ...
4
votes
1answer
466 views

Modifying PPID to avoid anti-debugging measure

I'm trying to debug an application that reads the Parent Process Id(PPID), to check if the application is being debugged. It expects the PPID to be the PID of explorer.exe, if it isn't, it quits. To ...
1
vote
0answers
267 views

How to hook Windows syscall ntcreatefile an get path to saved file from notepad? Python 3 [closed]

I need to automate some text editing and encryption. I've been doing some research and it seems uhooker can detect when a file is saved or when a program is closed, but I didn't see any examples to ...
1
vote
1answer
755 views

Processor Type in IDA Python

While using IDA Python and related code of idaapi, the processor type is not returned correctly. Specially we will have MetaPC instead of the exact processor type. This is my code that I used it: ...
1
vote
1answer
687 views

Extract conditional instructions using IDA python in ARM binaries

While using IDA Python for extract ARM instructions, I noticed that some instructions are not extracted completely. For example, conditional instructions such as BCS or BCC are printed as B. For ...
4
votes
2answers
2k views

Is it possible to get a list of user-defined names in IDA?

IDA allows one to rename a program entity (e.g. register, variable, function) using N shortcut. Is it possible to get a list of such user-defined names in IDA?
2
votes
1answer
2k views

Volatility - manually inspect heap of a process

According to the book The Art of Memory Forensics[1], there is a heaps plugin that can extract out information from the heap memory of a process. I'm using latest version of volatility - 2.6 , but the ...
5
votes
1answer
340 views

How can I get the shared libraries' function calls using angr

I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like: import sys, angr import networkx as nx proj = angr....
4
votes
1answer
2k views

How do I trace instructions in an Immunity Debugger PyCommand?

This sounds like a very simple thing to accomplish but I can't seem to get it working. I'd like to run a part of a program in ImmDbg instruction by instruction and keep track of some actions that it ...
0
votes
1answer
136 views

Can anyone help me identify and decode this string? [closed]

Below is a part of a code that I reversed with repy2exe and I want to understand what it does and especially how to decode the value in the "secret" variable: using = [ 'Mg==\n', 'MTA1\n', ...
6
votes
1answer
545 views

Immunity Debugger PyPlugin

Immunity Debugger offers a feature called PyPlugin. However there is not enough documentation on it. The help for immdbg says this : PyPlugins are python scripts located at PyPlugins\ directory, ...
2
votes
1answer
403 views

Deducing Protobuf Schema and Datatypes

I have a number of protobuf files but no .proto schema file! cat myfile.pbuf | protoc --decode_raw > outputfile.txt Using the above command, I was able to decode the file into a somewhat readable ...
5
votes
2answers
8k views

Python lib for assembling x86, x64 and ARM exploits

It would be very useful to have a pure python library that could assemble x86, x64 and ARM instructions. Do you have any recommendations? I don't mind if they are not pure-python, but that'd be ...
4
votes
1answer
2k views

Pydasm: Disassembling limited length executable shellcode

How to disassemble first 200 bytes of an executable code using pydasm library in Python? I want to know how to set size of buffer to disassemble it.
7
votes
1answer
539 views

Adding a toolbar to IDA using PySide

So i'm trying to add a custom toolbar to IDA 6.4 using their PySide download and the IDAAPI. I've tried adding a toolbar by just creating one but since it doesn't have an exec_() method I can't get ...
0
votes
1answer
311 views

Decode Ascii string values from reverse-engineered lua file

I decompiled a lua file with unluac and it turns out all the string variables are not readable and are instead ascii encoded clues = { { answer = { "\216\173", "\216\177", "\...
-1
votes
1answer
87 views

Python winappdbg getting process name from event object

I'm developing a debugging automation system using https://github.com/MarioVilas/winappdbg. I would like to retrieve process name from event object. Here is my code: def EventHandler(event): ...
9
votes
5answers
16k views

What are the techniques and tools to obfuscate Python programs?

This question is related to this other one. I just wonder what are the techniques applicable and which can be found in the real world to obfuscate Python program (similar questions can be found on ...
4
votes
2answers
1k views

IDA - Some issues regarding function's/data/code recognition

I have to write an IDAPython script and I came across many false positives in IDA's function/code/data recognition. Case 1 - Invalid function's end (rpcrt4.dll): In some DLLs (especially in rpcrt4....
3
votes
1answer
1k views

Using Python pydbg - Find out what addresses does an instruction access

I want to know how to accomplish this task with python pydbg. How does pydbg trace an instruction? For instance: should I set a breakpoint at the instruction address? Then what should I do? The ...
1
vote
1answer
4k views

IDA python : reading n bytes from an offset

Using python in IDA, I would like tu create a partial file dump. For exemple I would like to dump the data from offset X for a size of Y. I believe I could do it by using the idc.Dword function : ...