Questions tagged [python]
General-purpose and high-level programming language. Python supports multiple programming paradigms, including object-oriented, imperative and functional programming styles.
221
questions
-1
votes
0
answers
50
views
What does this string mean?
Disclaimer: I am not gonna paste the whole string just in case it contains sensitive data.
The thing is, I have this string I got from a response's payload, and I am trying to understand what it is. I ...
- 1
0
votes
1
answer
161
views
Unable to decompile .pyc file
There is a huge problem with decompiling pyinstaller exe file,I tired uncompyle6, uncompyle3, decompyle++. Always main section is not decompiled. I wonder what's the problem. The program is working.
...
- 1
0
votes
1
answer
61
views
IDA Pro Debugging GDB SendDbgCommand
I'm following this tutorial here https://www.triplefault.io/2017/07/loading-kernel-symbols-vmm-debugging.html to load kernel symbols with debugging.
Setting up the debug environment with IDA Pro using ...
- 49
-1
votes
1
answer
144
views
Simple Question About Reversing a Python
So, detect it easy, shows that the .exe is a python 3.9 compiled on visual studio and the compiler was MS Visual C/C++. Trying to unpack it using pyinstxtractor fails, and shows me the error of
...
1
vote
1
answer
172
views
How to quickly mark functions library in IDA Pro?
I have a binary with debug information and I want to mark STL library functions with "Library function" tag as quick as possible, just by highlighting a range of functions and clicking some ...
- 33
1
vote
0
answers
126
views
How can I extract the timestamp from this bytestring?
I am missing a piece of the puzzle that is the TCP protocol the Battlefield Bad Company games use to transfer dogtag records to/from the FESL backend. The general packet structure is quite clear and I ...
- 11
1
vote
0
answers
56
views
Radare2: How to Create a Custom Scripted Panel?
TLDR: How do I get a panel in radare2 to correctly show the output of a radare2 command piped to an external script?
e.g. afvd | python var_displayer.py
This is my current view. Multiple panels, ...
- 11
3
votes
1
answer
138
views
Are win32api calls differentiable from real actions?
I've been tinkering with the win32api library on Python and interacting with Notepad. I now want to try it on an online game to automate some boring tasks but I'm scared I get banned for this.
Is for ...
- 31
3
votes
1
answer
113
views
How to highlight all external registers in a function
What I want:
detect all potentially usercall, userpurge - functions;
when entering the function, immediately see all external entities:
arguments passed through registers;
i.e., in order not to ...
user42316
2
votes
0
answers
68
views
Angr considers REP instruction as the end of a basic block
I'm developing a python script for angr that has to find all the basic blocks present in each function in a binary. I have noticed that angr splits the basic blocks when it finds a REP instruction, I'...
- 121
2
votes
0
answers
63
views
Why the global string varable exploitation using angr doesn't work?
To learn the angr module, I have made a simple C code like follows.
test.c
#include <stdio.h>
#include <string.h>
char input[6];
int main(void)
{
scanf("%s", input);
...
- 55
2
votes
1
answer
65
views
Why did I have gotten only null bytes argv variable from angr?
I have made simple program to test the angr.
My python code is here.
import angr
import claripy
p=angr.Project('./test2')
buf=claripy.BVS('buf', 8*10)
initial_state=p.factory.entry_state(args=[&...
- 55
2
votes
0
answers
131
views
Does AnyOne knows how to reverse python file that is encoded into elf binary .cpython-310.so extension? Please Help me Out
Following is the link to the file that I want to reverse. This is the python file that is encoded in cpython or cython and it is now a binary file.
Please help me to decode it as it is very important ...
2
votes
0
answers
289
views
neovim: pwntools process automatically stops when trying to invoke interactive shell
I'm using python pwntools.
I'm using python 3.10.x
This line of code should open a shell for me:
io.interactive()
But while running this file from vim using
!./% it doesn't open the shell doesn't ...
- 123
2
votes
1
answer
67
views
Capture and Replay
I was wondering if it was possible to create a python script that is able to capture and replay the instructions executed by a windows program for in depth analysis.
- 49
2
votes
1
answer
108
views
Clean Angr disassemble output
I'm developing a python script for Angr that has to print as output something in the form of:
Instruction_disassembled opcode_bytes_of_instruction
This is my python script:
f = open(sys....
- 121
2
votes
0
answers
212
views
Convert instructions to op code bytes in python script for IDA Pro
I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work.
This is my python ...
- 121
3
votes
1
answer
198
views
Simplifying and reversing an encryption/decryption algorithm in ASM X86 / Python
I'm trying to reverse a decoding function in order to produce the function for encoding (for the curious this is a save game for a legacy adventure game which use codes for saving).
So far I have ...
- 31
1
vote
1
answer
144
views
How to call the Color Picker window in Ida Pro from a script?
I'm going to make a python script that allows you to color selected functions - in the right colors.
To do this, I need to programmatically call the ColorPicker window so that the user can select the ...
user42316
2
votes
0
answers
104
views
Ghidra python - retrieve the name of the called method
I am using Ghidra to build the function call graph of a method in java and therefore I am analyzing the bytecode of java and when I read an "invoke" instruction I have to go back to the name ...
- 21
0
votes
1
answer
66
views
How to change the Equations in string format to normal equations in Python?
I have a set of equations in string format as given below. Need to assign some value to the left-hand side variable (In the below example: rsp, esp). Then have to calculate and store the results on ...
- 39
2
votes
1
answer
2k
views
How do I Decompile .Pyd file made with python, cython and pyinstaller 3.6
I created an app in 2018 with python and then used Cython and pyinstaller v 3.6.
I am wondering how to decompile it. I have tried uncompyle6 + pyinstxtractor however this only works for python files,...
- 121
1
vote
0
answers
44
views
Where can I get source code for ASCII graph parser?
My plan is to see source code graph in vim of doxygen.
I almost use TUI on Linux.
So, Where can I get C, Python based source code for ASCII graph parser?
- 31
3
votes
0
answers
145
views
Brute Force USB Fuzzing
I am working to reverse engineer a USB based robot arm, but the operating system for the robot won't allow me to create simple enough moves that I can isolate the commands with a USB Sniffer like ...
- 41
1
vote
1
answer
187
views
Python or C for a Qt application and security against reverse engineering
I actually have two choices : C or Python to create my application.
On my application users will need a key (on start) to access it, the key will be verified with an algorythm on the user's computer. ...
- 113
1
vote
0
answers
87
views
Implementing syscalls under Miasm
I'd like to use Miasm's DSE on a binary. This binary makes use of 2 syscalls: exit and ptrace. Miasm provides an implementation of some syscalls, but unfortunately, not of those two.
So I tried to ...
- 11
0
votes
0
answers
617
views
Basic buffer-overflow on a remote program with Python/pwntools
I work on a online program in which I should do a buffer Overflow.
When I run the program, I have to complete a sum of two numbers generated randomly) :
>>> 451389913 + 1587598959 =
If I put ...
- 101
0
votes
1
answer
3k
views
Frida hook multiple processes
There was such a situation. I run the frida hook on the process like this:
frida -f '..\hack2\hackme.exe' -l .\start.js
In the script itself I do this
var moduleData = Process.getModuleByName("...
- 65
2
votes
0
answers
168
views
Call function from dll
I am writing a program and I have injected "mydll" file into the program, but I cannot call the hello function in it. How can I call the hello function? My code:
import os
from ctypes import ...
- 21
3
votes
1
answer
3k
views
Is there a way to install Python 3 modules into IDAPython with pip?
I would like to use regular python packages in my IDAPython scripts, but I can't figure out how to install them into IDA's Python environment. I don't even know where this python environment is, or ...
- 183
0
votes
1
answer
1k
views
IDAPython - How can I read the value of a function argument? (IDA 7.6)
I'm trying to automate some of my debugging with a python script that automatically places breakpoints at the first and last instructions of the functions I want to analyze. I'm using the breakpoint's ...
- 183
2
votes
2
answers
438
views
C++, Windows UI Automation and DaVinci Resolve
I've been researching this topic for a while, but the information is extremely limited and very confusing.
DaVinci Resolve is an editing and color grading software, its tools are so many and so ...
1
vote
0
answers
586
views
How do I convert an adress to little endian such that I can feed it to my exploit?
I'm doing a small exploit exercise.
For this purpose, I have the following file:
#include <stdio.h>
void secretFunction() {
printf("Congratulations!\n");
printf("...
- 111
0
votes
0
answers
205
views
What is this CRC32 algorithm (written in C), and how can it be written in Java or Python?
I've been trying to convert this CRC32 algorithm to Java or Python, but I haven't been successful, I believe it's because I'm not familiar enough with c.
Note that I believe DAT_804818d0 is the seed, ...
- 101
1
vote
1
answer
1k
views
How to get function signature using IDA Python in IDA Pro
I open .exe file in IDA with .pdb attached to it, so IDA scans .pdb and shows function names.
I need to get signature strings of many functions. I can't do it manually so I want to use built-it IDA ...
- 11
1
vote
0
answers
267
views
Counting how many times a function is called
I want to change context (Rdx, Rax etc.) everytime a specific function gets called.
My solution: I seted up a breakpoint at function event.get_thread().set_context({"Rdx" : "bla bla&...
- 11
0
votes
1
answer
307
views
PEDA: Don't show context
gdb-peda shows a very useful context each time it stops (b, si, etc.), but sometimes I don't want it. Is there any way to quiet it so it won't show the context automatically (unless prompted context)?...
- 187
2
votes
1
answer
434
views
Hooking IAT in remote process with Python?
I'm trying to hook a win32 function call (CreateFileW) inside of a notepad process to have the function do additional actions before returning what it should do. Ultimately, this will assist me in ...
- 51
1
vote
0
answers
71
views
How to derive a state diagram from existing source code
to;dr; What tools or smart method can I use to derive a state (transition) overview from source code with 10 binary and three 16-bit input variables, and several output variables, both 16-bit and ...
- 111
1
vote
1
answer
157
views
Creating table with IDAPython
I'd like to create the table like below, I could not found any clue while googling it.
Is it possible to make table with IDAPython, especially with idaapi.simplecustviewer_t class?
Any advises would ...
- 153
1
vote
1
answer
257
views
IDA Pro 7.5 Breakpoint Python Script: 'invalid non-printable character U+FEFF'
I'm trying to set a python condition breakpoint, but it throws me a weird error and I don't understand what happens:
Even if I just return True, it throws the same error when I compile or when press &...
2
votes
1
answer
294
views
uncompyle6 gives success message but output is not readable
I am trying to use uncompyle6 to decompile a .pyc code. I even tried --verify option. It says
Successfully decompiled file
but the output only contains strings like \xe0\xb3\x0bh\x90.
What should I ...
- 21
1
vote
0
answers
34
views
Need help understanding the flow of a python script on github repository
OpenDroneMap is an open source command line toolkit to generate maps, point clouds, 3D models and DEMs from drone, balloon or kite images, here's their github link OpenDroneMap/ODM
Was pointed out to ...
3
votes
1
answer
263
views
Sharing variable between scripts
I wrote some Python scripts to help me disassemble one given file (only one), and I'd like to share some variables between differents scripts (or between 2 different executions of the same script).
Is ...
- 141
0
votes
0
answers
1k
views
Reversing PYARMOR (?)
I have already decompiled an .exe file and reached to a .py but it is obfuscated using PyArmor.
I have already used ''https://github.com/nlscc/unpyarmor'' to try it, but could not figure it out how to ...
- 1
3
votes
1
answer
1k
views
Printing all strings in a Ghidra project with python
I got the string objects from a Ghidra project using this code:
l = list()
def callback(s):
l.append(s)
ss = StringSearcher(currentProgram, 5, 1, False, True)
ss.search(None, callback, True, ...
- 41
0
votes
0
answers
499
views
Decompiling exe to python source code
I've recently tried to decompile a .exe to .py source code. It partly went well as the majority of the .pyc got translated into python code but partly also failed. Like the following part:
--- This ...
- 1
0
votes
1
answer
1k
views
How can I reverse this python code (obfuscated by b64, gzip and many more)
How can I Deobfuscate this python code
Link to code
I tried to replace eval places by print. but it won't work and output is also obfuscated
Head of the code looks like this
can anyone please help me
0
votes
0
answers
285
views
Help me please decode the string (looks like gzip but it is not)
The software sends to the main server such string:
\x1f\xe2\x80\xb9\x08\x00\x00\x00\x00\x00\x04\x00E...\x03\x00\x00"
decode_gzip(body)
Later I've tried to decode it through different online ...
- 101
3
votes
0
answers
3k
views
How to decompile python ELF file (Compiled with Nuitka)?
I have some files that compiled with nuitka. formats are .bin. I could get shell access to running process with pyrasite same as this guide. but I cannot decompile function codes or anything else, and ...
- 31