Questions tagged [python]

General-purpose and high-level programming language. Python supports multiple programming paradigms, including object-oriented, imperative and functional programming styles.

Filter by
Sorted by
Tagged with
2
votes
1answer
83 views

Ghidra Python - cancel decompilation task

The way to decompile a function in Ghidra Python is: decomp = DecompInterface() decomp.openProgram(currentProgram) decompile = decomp.decompileFunction(func, 1000, monitor) However, in ...
0
votes
0answers
36 views

help about methodology

I am a beginner in reverse engineering. For a challenge I need to reverse a code in python this code use enigma algorithm : To found the good configuration to decode the enigma code received. The ...
3
votes
1answer
2k views

Decompiling .pyc file to 0 byte .py file

i am doing the CTF-like challenges. One of these tasks need us to decompiling Python bytecode 3.8 (.pyc file) into py file. However, the py file that generated by pyc file is 0 byte The original file'...
1
vote
1answer
102 views

Ida python No module named tempo

I tried to run tempo.py from ida python github , but I got error No module named tempo According to Igor Skochinsky answer , this script is wrong Apparently, tempo was an internal module used ...
1
vote
1answer
2k views

Using Python 3.7 and 2.x in same IDA

I have IDA Pro 7.4 that use with Python 3.7 and I have some IDA-plugin that works only with Python 2.7. Is there any way to run that Python 2.7 based plugin?
0
votes
1answer
355 views

Ghidra Python - Get Decompile Line Text by RVA

Is there a way in Ghidra Python to get the corresponding decompile line by RVA? Or the opposite - get the corresponding RVA from a given line in a decompile?
1
vote
3answers
615 views

Ghidra Python - Get x-refs of a specific function

What is the best way to get calling x-refs for a specific function? I am aware of the following method: func = getFirstFunction() while func is not None: func_name = func.getName() if ...
1
vote
1answer
6k views

What is the right way to pack a payload with Python3's pwntools

On the tutorial by Megabeets, "A journey into Radare 2 – Part 2: Exploitation", he shows an example of how to create a payload with Python2 # Initial payload payload = "A"*140 # padding ropchain = ...
0
votes
1answer
419 views

GDB - Send Python output to the program after SIGINT

I am trying to learn GDB to better understand buffer overflows but I can't find an answer to my problem which is how can I send a Python-generated output to the program when the program asks for user ...
0
votes
0answers
47 views

Python based static c analysis tools

I want to analyze some open-source C code, and I'm looking for a static analysis python library for C, preferably open-source. Any ideas/suggestions, based on your experience?
-2
votes
1answer
3k views

How to decompile obfuscated Python code?

I have an executable file, which I am trying to decompile. I have already deduced that it was originally programmed in Python. I know that it was obfuscated with PyArmor and possibly compiled with ...
3
votes
1answer
685 views

ghidra-python: create struct with big endian field

Using ghidra's python scripting engine, I'd like to create a struct which contains a big endian, unsigned integer. This field is always big endian, no matter what the endainess of the binary CPU is. ...
4
votes
3answers
5k views

Is it possible to get a list of user-defined names in IDA?

IDA allows one to rename a program entity (e.g. register, variable, function) using N shortcut. Is it possible to get a list of such user-defined names in IDA?
3
votes
1answer
6k views

Best way to protect source code of .exe program running on Python?

I am developing proprietary software that would be distributed in a form of .exe file. In order to use it, users will have to authenticate with their whitelist credentials (username + password). The ...
1
vote
0answers
515 views

Decrypting the Config file of a Huawei router “HG630 V2”

followed that post from Wordpress https://hg658c.wordpress.com/2017/12/04/decrypting-configuration-files-from-other-huawei-home-gateway-routers/ Extracted the 4 Hex strings needed. But, looks ...
-1
votes
1answer
131 views

Help to understand what's inside base64 string

While performing a file upload, a template parameter is sent together with file. Service acts differently when different parameters are passed. I need help to figure out what this parameter contains. ...
1
vote
3answers
90 views

How to input ascii control character into program?

I am working on a CTF where I need to pass an address as input to a program. This address contains the value 0x09 (the tab character). This is causing me problems, because it seems that bash is ...
1
vote
1answer
251 views

Python self decryption script, as mean of obfuscation

I have a software with an embedded python interpreter. The software can open upon startup a given .py script and execute it. Let's assume that in my python environment I can't open other files, and I ...
1
vote
1answer
676 views

How to create executable (create build) from original decompiled exe?

I have reverse engineered exe file using pyinstxtractor.py script. There were around 1120 files in PYZ archive. F:\Python Test>python pyinstxtractor.py test.exe [*] Processing test.exe [*] ...
1
vote
1answer
766 views

How to embed PYZ.-00.pyz_extracted folder with entry .py file to generate exe file?

I have decompiled exe using pyextractor script and generated these files: PYZ-00.pyz PYZ-00.pyz_extracted gui pyi_rth_tkinter pyi_rth_multiprocessing pyi_rth_pkgres pyi_rth_win32comgenpy ...
4
votes
0answers
597 views

How do I perform concolic execution with Angr and collect constraints on input?

I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
4
votes
1answer
507 views

Ghidra Headless Analyzer - Create Functions

I'm interested in open a binary file (.bin, without arch info), and analyze it with analyzeHeadless.bat (Ghidra version without GUI). I know what is the architecture of the file, so I pass it as a ...
2
votes
2answers
319 views

Prevent Memory Inspection in a Cython program?

Cython is a great way to protect the source code of a Python program. However, memory inspection and memory reverse engineering can still be done to this Cython program. What are ways to prevent (or ...
1
vote
1answer
6k views

How to to decompile a pyinstaller exe, back to source code?

Python versions, this method has been tried on: 3.7.5, 3.6.0, 3.5.0, 2.7.17? (I know, I'm just too desperate to get my source back.) I have problem with decompiling an exe. I kind of deleted the ...
1
vote
3answers
3k views

Python: Adding a asection to a PE file

I am working with PE binaries using Python and the pefile library. Its good for reading information out of a binary and rewriting certain bytes. If I wanted to add a section to the file then i am ...
0
votes
1answer
124 views

x64dbgpy: application unresponsive when trying to automate inside breakpoint callback

When a breakpoint callback is triggered trying to automate the debugger inside the callback causes the application to become unresponsive. x64dbg continues functioning but the application itself doesn'...
1
vote
0answers
92 views

Angr Use argv as initialstate

I am currently trying to use angr, and I need to find a string "Done!" which results in the "good termination" of the program. The input is 32 bits and I need to know the input which leads to the "...
5
votes
2answers
10k views

Run a python command with “run” on GDB

Hi I'd like to run a python command python -c 'print "\x90"*52' when the program start in GDB, as I would do when I execute : python -c 'print "\x90"*52' | ./myProg . Does anyone knows any way to ...
3
votes
0answers
122 views

Z3 and If-logic

Z3 is a fantastic tool which helped me a lot! But sometimes I'm stuck on the binary code which implements custom If-logic. Recursive factorial function is good example of it: def fact(x): if x == ...
3
votes
2answers
6k views

Volatility - manually inspect heap of a process

According to the book The Art of Memory Forensics[1], there is a heaps plugin that can extract out information from the heap memory of a process. I'm using latest version of volatility - 2.6 , but the ...
9
votes
5answers
19k views

What are the techniques and tools to obfuscate Python programs?

This question is related to this other one. I just wonder what are the techniques applicable and which can be found in the real world to obfuscate Python program (similar questions can be found on ...
6
votes
3answers
4k views

Reverse engineering USB peripheral driver

I'm looking to reverse engineer a Windows driver for a printer I have here. I found out a bit about USB sniffing but I don't think Snoopy runs on Windows 7. I know the driver is on my computer ...
16
votes
3answers
5k views

How to debug an IDAPython script from within IDA?

IDAPython is great plugin in IDA. It is so handy to write small script to decode, decrypt or fix (patch) a binary in IDA. I can just write, load and run a script, and can use print for the usual ...
1
vote
0answers
67 views

Parse / statically analyzing .NET binaries using python

Which libraries do you use to parse and statically analyze .NET binaries? Is there a python module, or do I have to use a .NET library such as dnlib? Does it make sense to write a python wrapper for ...
1
vote
1answer
447 views

Reverse Python Bytecode

I try reverse python bytecode (Content in a .pyc file). I do not want to decompile the code, just understand the Python bytecode :) The LOAD_NAME statement, pushes the value associated with co_names (...
0
votes
1answer
257 views

IdaPython aob search and rename example

Iv'e never used python before and in looking at other example I can't find what I'm looking for exactly so I have come here to humbly ask for an example script if anyone could be so kind, I am trying ...
1
vote
1answer
228 views

picoCTF be-quick-or-be-dead-1 dcrypt simulation with python

This is be-quick-or-be-dead-1 in picoCTF challenge (Download) in this file we can see decrypt_flag() function, this function return this flag: ./be-quick-or-be-dead-1 Calculating key... Done ...
3
votes
1answer
706 views

String Encoding and Decoding Method

so I came across the following string encoding method in python. def encode(the_string): encoded_string = '' rotations = ord(the_string[-1]) + 5 for i in range(0, len(the_string)): ...
1
vote
1answer
1k views

How to find out address in binary file (like IDA) with python code only?

I have binary for example https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap that I open with IDA , and search some data that I want to find without open IDA ,only ...
1
vote
0answers
144 views

Can't install sasquatch tool

Ubuntu 16.04 LTS. I'm trying to install sasquatch tool (which should apply patches to the standard unsquashfs utility), but got the issue, every time build process show error in one place: ./build.sh:...
2
votes
4answers
4k views

How to decompile with Hex Rays via a Python API?

If i have a large set of files and I'd like to run Hex-rays over them to produce output as C - can I do so in python? I see there is IDA Python And I see Hex-rays has a C++ SDK Is there a python Hex-...
3
votes
2answers
1k views

The structure of the Python's marshaled code object (or .pyc file)

Help me to decipher the Python's marshaled code object. The .pyc files are almost the same: The structure of .pyc files. I have: The code object compiled from the source. The marshaled ...
1
vote
0answers
462 views

Illegal instruction fault in stack based buffer overflow

I wrote this short C program to practice buffer overflow exploits: #include <stdio.h> #include <string.h> #include <stddef.h> #include <inttypes.h> char *decode(char *s){ ...
1
vote
1answer
194 views

Best python framework/library for constructing the call-graph from binary?

So i have written a python tool using capstone that disassembles the code section of a ELF binary using capstone. now i want to also create and show the call-graph of this binary in a dot format, I ...
2
votes
0answers
518 views

Debugging Ghidra Script [closed]

I want to write a new script for ghidra to extract variuous information from the binary and store it to an external file for future management. I need to perform the analyisis with Ghidra Headless in ...
5
votes
2answers
3k views

idapython - Determine if item is code or data

I need to determine whether an IDA's item is code or data. Sometimes, data resides in an executable's code section (virtual functions tables, switch tables and stuff). So in IDA, you can sometimes see ...
33
votes
5answers
88k views

How do you reverse engineer an EXE “compiled” with PyInstaller

Having recently watched/read a presentation given by Dave Kennedy at DEF CON 20 [PDF], I'd like to know how to decompile a Python script compiled with PyInstaller. In his presentation, he is creating ...
0
votes
2answers
296 views

capturing the sub processes's PID of a process

When a program is executed, some processes may be created by the parent process. Especially, if a program is malware, created (or forked or even injected) sub-processes will be named as a systemic ...
2
votes
1answer
283 views

ROP chain: Buffer Overflow Return Pointer

I am trying to get a ROP exploit to work on Ubuntu 18.04 LTS 64bit. I have a 64 bit binary (Nx enabled, ASLR disabled) with vuln function as follows: public vuln vuln proc near var_100= byte ptr -...
1
vote
2answers
2k views

IDA scripting - get local variable by its name

During the debugging I can see all the function's local variables in tab Locals (Debugger -> Debugger Windows -> Locals(HEXRAYS)). For example I have a struct variable a1 0x891E1160:{pBuf=...