Questions tagged [python]

General-purpose and high-level programming language. Python supports multiple programming paradigms, including object-oriented, imperative and functional programming styles.

22 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
0answers
727 views

Python library for linux to demangle MSVC decorated names

I am looking for a python library for linux which can demangle the function names which are mangled by MSVC. for example : Project!??0?$allocator@D@std@@QAE@XZ to Project!public: __thiscall ...
4
votes
0answers
443 views

How do I perform concolic execution with Angr and collect constraints on input?

I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
3
votes
0answers
79 views

Z3 and If-logic

Z3 is a fantastic tool which helped me a lot! But sometimes I'm stuck on the binary code which implements custom If-logic. Recursive factorial function is good example of it: def fact(x): if x == ...
2
votes
0answers
123 views

Restore function key

I have a simple function which looks like that: keyAlphabet = [-1, 16, 32, 127, 61, -32, -31, 43, 0, 88, 2, 5, 7, 112, 64, 69, 96] key = ??? # only keyAlphabet values p = 0x1337 for i in key: ...p*=i ...
2
votes
0answers
195 views

ResumeThread doesn't work after attaching to the process using vTrace

In an effort to learn vtrace I've been trying to attach to a process and hook the import address table and then resume the main thread of a process. When I don't attach to the process the ...
1
vote
0answers
183 views

Reversing PyArmor + Pyinstaller

Created an application, protected by PyArmor and used pyinstaller. I'm trying to reverse engineer it. So far I've decompiled the exe into pyc files but it's still pyarmor encrypted I can only see the ...
1
vote
0answers
42 views

Angr Use argv as initialstate

I am currently trying to use angr, and I need to find a string "Done!" which results in the "good termination" of the program. The input is 32 bits and I need to know the input which leads to the "...
1
vote
1answer
427 views

Python Script to get disassembled output of an EXE file

I'm pretty new to Ghidra, and looking to use it's API (headless analyzer) and get the assembled file through command line using python. Here is my code, which is likely far from the correct code. It ...
1
vote
1answer
74 views

Regenerate PEM/DER keys from binary blobs

I have the binary blobs for the components of a private key including modulus, publicExponent, privateExponent, prime1, prime2, exponent1, exponent2 and coefficient, what is the easiest way to ...
1
vote
0answers
279 views

Decrypting the Config file of a Huawei router “HG630 V2”

followed that post from Wordpress https://hg658c.wordpress.com/2017/12/04/decrypting-configuration-files-from-other-huawei-home-gateway-routers/ Extracted the 4 Hex strings needed. But, looks ...
1
vote
1answer
149 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
1
vote
0answers
33 views

Parse / statically analyzing .NET binaries using python

Which libraries do you use to parse and statically analyze .NET binaries? Is there a python module, or do I have to use a .NET library such as dnlib? Does it make sense to write a python wrapper for ...
1
vote
1answer
234 views

pyelftools relocation section symbols

I have been trying to get into reverse engineering as of late and after playing with Radare2 I realized I was playing with a lot of things without really understanding what I was doing. In an effort ...
1
vote
0answers
83 views

Can't install sasquatch tool

Ubuntu 16.04 LTS. I'm trying to install sasquatch tool (which should apply patches to the standard unsquashfs utility), but got the issue, every time build process show error in one place: ./build.sh:...
1
vote
0answers
346 views

Illegal instruction fault in stack based buffer overflow

I wrote this short C program to practice buffer overflow exploits: #include <stdio.h> #include <string.h> #include <stddef.h> #include <inttypes.h> char *decode(char *s){ ...
1
vote
0answers
5k views

Plugin directory in IDA?

According to IDA docs, we can put a Python plugin into $HOME/.idapro/plugins/ directory. But when I copied my Python plugin there & restart IDA, IDA still do not see that. What can go wrong, and ...
0
votes
0answers
33 views

Debug dll file used in python script IDA

I am fairly new to RE on windows. I have a python script which via ctypes uses functions from a dll. I don't know if it's possible, but I would like to debug the dll used in the python script (the dll ...
0
votes
0answers
22 views

Debug x64dbgpy scripts in vscode?

i've tried to debug a x64dbgpy script using ptvsd and vscode. don't ask me how, but i was able to break into the script using a "remote python attach" session, setting breakpoints and stepping into ...
0
votes
0answers
28 views

help about methodology

I am a beginner in reverse engineering. For a challenge I need to reverse a code in python this code use enigma algorithm : To found the good configuration to decode the enigma code received. The ...
0
votes
0answers
46 views

Python based static c analysis tools

I want to analyze some open-source C code, and I'm looking for a static analysis python library for C, preferably open-source. Any ideas/suggestions, based on your experience?
0
votes
1answer
848 views

How to reverse a Cython shared object (.so)

I have a .so file (ELF 64-bit LSB shared object, x86-64, dynamically linked, no section header) with an embedded Cython program. To run the program inside the .so file there is a single python3 ...
0
votes
0answers
866 views

How to generate exe from compiled Python files?

I have extracted compiled files from exe (executable in windows) using PyInstaller Extractor script. In Resultant folder, i have got was pyc files bundled in pyz folder. Then I decompiled files (...