Questions tagged [python]
General-purpose and high-level programming language. Python supports multiple programming paradigms, including object-oriented, imperative and functional programming styles.
220
questions
40
votes
5
answers
127k
views
How do you reverse engineer an EXE "compiled" with PyInstaller
Having recently watched/read a presentation given by Dave Kennedy at DEF CON 20 [PDF], I'd like to know how to decompile a Python script compiled with PyInstaller.
In his presentation, he is creating ...
- 7,542
27
votes
7
answers
93k
views
Decompiling .pyc files
Does anybody have a suggestion for (non commercial) software to decompile "byte-code" Python (.pyc) files?
Everything I've found seems to break...
- 1,041
24
votes
5
answers
12k
views
What are the tools to analyze Python (obfuscated) bytecode?
Recently on Reddit ReverseEngineering I stumbled on a self-modifying code in Python. Looking at the Github repository was quite instructive and I found picture of the Python bytecode program exposed ...
- 18.9k
18
votes
2
answers
8k
views
Is it possible to get python bytecode without using co_code?
I posted this a while back on stackoverflow (too old to migrate though).
Say I am in the python interpreter and define a function as follows:
def h(a):
return a
If I want to look at the bytecode (...
- 1,072
17
votes
3
answers
6k
views
How to debug an IDAPython script from within IDA?
IDAPython is great plugin in IDA. It is so handy to write small script to decode, decrypt or fix (patch) a binary in IDA. I can just write, load and run a script, and can use print for the usual ...
- 173
11
votes
2
answers
15k
views
Which python library for parsing Linux ELF files?
I want to be able to parse 32 and 64 bit ELF files - but not create or modify them (e.g. as discussed in this thread). The ELF binaries may possibly come from embedded Linux systems, that is, the ...
- 1,550
10
votes
1
answer
6k
views
Extracting arguments from IDA
Let's say I have the following function in IDA:
int __usercall function<eax>(char* message<ebp>, unsigned int count<edi>)
What's the fastest way to extract the argument information ...
- 2,317
9
votes
5
answers
19k
views
What are the techniques and tools to obfuscate Python programs?
This question is related to this other one. I just wonder what are the techniques applicable and which can be found in the real world to obfuscate Python program (similar questions can be found on ...
- 18.9k
9
votes
2
answers
7k
views
Good training for IDAPython [closed]
I'm familiar with python and IDA in general. I found a few very basic tutorials but nothing that goes through an explanation of the classes used and the full capability set. Near as I can tell the ...
- 238
9
votes
1
answer
9k
views
Reverse Engineering program written in Python, compiled with "freeze"
I am attempting to reverse engineer an EXE compiled using the utility "Freeze" or "pfreeze" that ships with Python (not to get confused with "cx_freeze"). Inside the EXE there is an array of memory ...
- 101
8
votes
2
answers
14k
views
Decompile Python for ELF Binaries
There are several solutions available to extract Pyc files from Windows binaries and then decompile them using uncompyle2 or uncompyle6.
However, I have a Linux ELF 64-bit binary which was compiled ...
- 765
8
votes
1
answer
355
views
Setup an IDA (python) callback when an instruction is selected
I am using the IDA python features, and I am trying to setup a callback. When a user selects an instruction in the hex or graph view, I want my callback to be triggered. I have browsed the docs, but I ...
- 181
7
votes
3
answers
10k
views
Paste hex bytes into IDA Pro Hex View
Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01......
- 547
7
votes
1
answer
867
views
Adding a toolbar to IDA using PySide
So i'm trying to add a custom toolbar to IDA 6.4 using their PySide download and the IDAAPI. I've tried adding a toolbar by just creating one but since it doesn't have an exec_() method I can't get ...
- 193
7
votes
1
answer
1k
views
Read a struct from memory
I'm trying to load a struct defined in a program that i'm reading the memory of, so I can use it to define objects in my python debugger (in windows).
What format do structs take in memory, and what ...
- 173
7
votes
1
answer
3k
views
Is it possible to create data xrefs manually?
I have a binary with lots of indirect calls (call dword ptr [register + offset ]) the register is calculated with a simple math which I manage to statically calculate on my own (the call itself lead ...
- 71
7
votes
1
answer
981
views
Importing external libraries in Hopper scripts?
Can external libraries be used in Hopper scripts? I'd like to add PDB support to Hopper using pdbparse, but I haven't been able to get it to use external libraries.
Alternatively, I suppose one could ...
- 2,868
6
votes
2
answers
16k
views
Run a python command with "run" on GDB
Hi I'd like to run a python command python -c 'print "\x90"*52' when the program start in GDB, as I would do when I execute : python -c 'print "\x90"*52' | ./myProg . Does anyone knows any way to ...
- 281
6
votes
3
answers
11k
views
Python library for assembling x86, x64 and ARM exploits
It would be very useful to have a pure Python library that could assemble x86, x64, and ARM instructions. Do you have a recommendation?
I don't mind if they are not pure Python, but that'd be ...
user1743
6
votes
3
answers
6k
views
Reverse engineering USB peripheral driver
I'm looking to reverse engineer a Windows driver for a printer I have here. I found out a bit about USB sniffing but I don't think Snoopy runs on Windows 7. I know the driver is on my computer ...
- 71
6
votes
1
answer
1k
views
How can I get the shared libraries' function calls using angr
I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like:
import sys, angr
import networkx as nx
proj = angr....
- 63
6
votes
1
answer
1k
views
Immunity Debugger PyPlugin
Immunity Debugger offers a feature called PyPlugin. However there is not enough documentation on it. The help for immdbg says this :
PyPlugins are python scripts located at PyPlugins\ directory,
...
- 6,040
5
votes
2
answers
4k
views
idapython - Determine if item is code or data
I need to determine whether an IDA's item is code or data.
Sometimes, data resides in an executable's code section (virtual functions tables, switch tables and stuff).
So in IDA, you can sometimes see ...
- 337
5
votes
1
answer
2k
views
Pydasm: Disassembling limited length executable shellcode
How to disassemble first 200 bytes of an executable code using pydasm library in Python?
I want to know how to set size of buffer to disassemble it.
- 265
5
votes
1
answer
864
views
Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?
I understand that I can execute my script within a session using [0x401000]> . server.py and the pipe will be connected to it when I call r2pipe.open() with no arguments.
Ideally I would like to ...
- 133
5
votes
1
answer
2k
views
How to use fastloghook in immunity debugger
How does fastloghook work in immunity debugger pycommand section? i cant figure it out. Everything i try does not work and i know this code is a mess. I seriously dont understand fastloghook which ...
- 126
5
votes
1
answer
1k
views
vtrace / vivisect resources
Where can I find some resources to start learning about vivisect?
Blog posts, presentations, PDFs, code examples, anything would be appreciated.
I am aware I can read the code but before doing that ...
- 1,041
5
votes
1
answer
7k
views
API hooking using DLL injection with Python C-Types
I'd like to write something using Python C-Types that hooks API calls and can be leveraged for unpacking executables. Currently my (Python with C-Types) code launches an executable in a suspended ...
- 211
5
votes
0
answers
948
views
How do I perform concolic execution with Angr and collect constraints on input?
I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
- 151
5
votes
0
answers
923
views
Python library for linux to demangle MSVC decorated names
I am looking for a python library for linux which can demangle the function names which are mangled by MSVC.
for example :
Project!??0?$allocator@D@std@@QAE@XZ
to
Project!public: __thiscall
...
- 265
4
votes
3
answers
6k
views
Is it possible to get a list of user-defined names in IDA?
IDA allows one to rename a program entity (e.g. register, variable, function) using N shortcut. Is it possible to get a list of such user-defined names in IDA?
- 1,361
4
votes
2
answers
1k
views
Using Python CTypes to get to the IAT
I'm trying to get to IAT of a PE file. My plan is eventually overwrite some values so I can hook some stuff to help with unpacking, etc. I'm using this post https://stackoverflow.com/questions/...
- 211
4
votes
1
answer
11k
views
Best way to protect source code of .exe program running on Python?
I am developing proprietary software that would be distributed in a form of .exe file. In order to use it, users will have to authenticate with their whitelist credentials (username + password).
The ...
- 141
4
votes
1
answer
1k
views
Ghidra Headless Analyzer - Create Functions
I'm interested in open a binary file (.bin, without arch info), and analyze it with analyzeHeadless.bat (Ghidra version without GUI).
I know what is the architecture of the file, so I pass it as a ...
- 1,848
4
votes
1
answer
521
views
Function calls: xref.type always 'Code_Far_Call' or 'Code_Near_Call'?
Given a disassembly line in IDA Pro such as
.text:0040255B call sub_407C10
Am I right to assume that analyzing the belonging address using
idautils.XrefsFrom(0x0040255B)
always returns an ...
- 1,550
4
votes
2
answers
3k
views
IDA - Some issues regarding function's/data/code recognition
I have to write an IDAPython script and I came across many false positives in IDA's function/code/data recognition.
Case 1 - Invalid function's end (rpcrt4.dll):
In some DLLs (especially in rpcrt4....
- 337
4
votes
1
answer
204
views
Logging lpRect and uFormat from DrawTextA
Using APIMonitor from Rohitab I found that DrawTextA has some additional arguments I would like to log using Python and Pydbg (I'm currently logging lpchText, se below).
My current hooking code looks ...
- 163
4
votes
2
answers
554
views
On reverse engineering an udp protocol to control a drone
My goal is to control my drone with my raspberry pi using python and not the app that is being delivered together with it.
First I connected the app to the drone, flew and used aircrack-ng to get the ...
4
votes
1
answer
2k
views
How do I trace instructions in an Immunity Debugger PyCommand?
This sounds like a very simple thing to accomplish but I can't seem to get it working.
I'd like to run a part of a program in ImmDbg instruction by instruction and keep track of some actions that it ...
- 41
4
votes
1
answer
497
views
How to make IDA processor for file format with tree structure
Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on.
However when it comes to tree-structured file format, I can't come up with a ...
- 428
3
votes
2
answers
712
views
How to compile c, cpp and python code as "Released/Final" version?
I want to know if there are ways to compile C, C++ and Python code in order to not be able to reverse engineering it over Linux or not?
I have heard there are some ways over Windows to do it, but I ...
- 331
3
votes
3
answers
6k
views
Check DEP , ASLR and SafeSEH enabled or not , immlib
How to check if DEP, ASLR and SafeSEH defense mechanism are enabled or not in a program using immlib library of Python in Immunity Debugger ?
Actually I am looking for small code snippet for each.
- 265
3
votes
3
answers
1k
views
Reimplementing the x86 AESENC instruction in python
I'm having troubles implementing the AESENC x86 instruction in python.
I'm reverse engineering the decryption of a indie video game. They use AES but they xor some generated data around and the key ...
- 33
3
votes
1
answer
2k
views
ghidra-python: create struct with big endian field
Using ghidra's python scripting engine, I'd like to create a struct which contains a big endian, unsigned integer. This field is always big endian, no matter what the endainess of the binary CPU is.
...
- 33
3
votes
1
answer
6k
views
Getting user comments with IDAPython API (user_cmts_*)?
How do I call the user_cmts_* functions from the IDAPython API? I am quite new to the SDK and IDAPython, so I'm kind of lost as to what I'm supposed to pass to these functions, as it's not the user-...
- 133
3
votes
2
answers
2k
views
The structure of the Python's marshaled code object (or .pyc file)
Help me to decipher the Python's marshaled code object. The .pyc files are almost the same: The structure of .pyc files.
I have:
The code object compiled from the source.
The marshaled ...
- 141
3
votes
1
answer
113
views
How to highlight all external registers in a function
What I want:
detect all potentially usercall, userpurge - functions;
when entering the function, immediately see all external entities:
arguments passed through registers;
i.e., in order not to ...
user42316
3
votes
1
answer
258
views
Sharing variable between scripts
I wrote some Python scripts to help me disassemble one given file (only one), and I'd like to share some variables between differents scripts (or between 2 different executions of the same script).
Is ...
- 141
3
votes
2
answers
7k
views
Volatility - manually inspect heap of a process
According to the book The Art of Memory Forensics[1], there is a heaps plugin that can extract out information from the heap memory of a process. I'm using latest version of volatility - 2.6 , but the ...
- 31
3
votes
1
answer
1k
views
IDA API - query number of parameters for cdecl functions
I'm writing a script that, among other things, reads and does some processing with parameters to a function. Right now my solution to find the number of arguments for a given function at addr is:
(...
- 1,022