Questions tagged [python]

General-purpose and high-level programming language. Python supports multiple programming paradigms, including object-oriented, imperative and functional programming styles.

Filter by
Sorted by
Tagged with
7
votes
2answers
9k views

Decompile Python for ELF Binaries

There are several solutions available to extract Pyc files from Windows binaries and then decompile them using uncompyle2 or uncompyle6. However, I have a Linux ELF 64-bit binary which was compiled ...
22
votes
5answers
10k views

What are the tools to analyze Python (obfuscated) bytecode?

Recently on Reddit ReverseEngineering I stumbled on a self-modifying code in Python. Looking at the Github repository was quite instructive and I found picture of the Python bytecode program exposed ...
0
votes
1answer
55 views

generating byte file with IDA batch command

how to use the command line to generate the byte file using IDA? I know how to get the .asm but not the byte file
1
vote
1answer
2k views

Resolving DLL function names using ordinals

I am trying to figure out how to get the imports of a PE using the PEfile python project (https://github.com/erocarrera/pefile) One thing special about that library is the ordlookup folder. It looks ...
2
votes
2answers
588 views

How can I reverse this recursive function?

This is the python code I wrote of a simple crackme that I have reversed but I am not able to understand what the recursive function here does. def the_process(stored, inp, size): idx = 0 ...
-1
votes
1answer
223 views

How to use Python while debugging in IDA

I'm debugging an .exe file in IDA. At a specific point during debugging, I want the Python code to automatically take the data in *(eax+8) and encrypt it with that module and print the result to file ...
0
votes
1answer
238 views

Pyemu - cannot use PEPyEmu() module, Python

I want to run code from Gray Hat Python book for upx_unpacker. I have downloaded PyEmu, but when I run script I got this error: AttributeError: PEPyEmu instance has no attribute 'load' My script use ...
5
votes
1answer
646 views

Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?

I understand that I can execute my script within a session using [0x401000]> . server.py and the pipe will be connected to it when I call r2pipe.open() with no arguments. Ideally I would like to ...
2
votes
2answers
991 views

IDA: call a function with different arguments

I'm reversing some software and found the function which decrypts some stuff: As you can see it has the password parameter for it which gets decrypted in this function. Function disassembly: ...
1
vote
2answers
381 views

What is a more efficient way to locate disasm patterns in IDAPython?

This is my first "serious" IDAPython script. As I sorta suspected, it's performing waaaayyyyy too slow so I wanted to ask for some pointers on this: fp = MinEA() end = MaxEA() while fp < end: ...
3
votes
1answer
515 views

Modifying PPID to avoid anti-debugging measure

I'm trying to debug an application that reads the Parent Process Id(PPID), to check if the application is being debugged. It expects the PPID to be the PID of explorer.exe, if it isn't, it quits. To ...
1
vote
0answers
439 views

How to hook Windows syscall ntcreatefile an get path to saved file from notepad? Python 3 [closed]

I need to automate some text editing and encryption. I've been doing some research and it seems uhooker can detect when a file is saved or when a program is closed, but I didn't see any examples to ...
1
vote
1answer
2k views

Processor Type in IDA Python

While using IDA Python and related code of idaapi, the processor type is not returned correctly. Specially we will have MetaPC instead of the exact processor type. This is my code that I used it: ...
1
vote
1answer
2k views

Extract conditional instructions using IDA python in ARM binaries

While using IDA Python for extract ARM instructions, I noticed that some instructions are not extracted completely. For example, conditional instructions such as BCS or BCC are printed as B. For ...
5
votes
1answer
791 views

How can I get the shared libraries' function calls using angr

I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like: import sys, angr import networkx as nx proj = angr....
4
votes
1answer
2k views

How do I trace instructions in an Immunity Debugger PyCommand?

This sounds like a very simple thing to accomplish but I can't seem to get it working. I'd like to run a part of a program in ImmDbg instruction by instruction and keep track of some actions that it ...
0
votes
1answer
271 views

Can anyone help me identify and decode this string? [closed]

Below is a part of a code that I reversed with repy2exe and I want to understand what it does and especially how to decode the value in the "secret" variable: using = [ 'Mg==\n', 'MTA1\n', ...
6
votes
1answer
802 views

Immunity Debugger PyPlugin

Immunity Debugger offers a feature called PyPlugin. However there is not enough documentation on it. The help for immdbg says this : PyPlugins are python scripts located at PyPlugins\ directory, ...
2
votes
1answer
777 views

Deducing Protobuf Schema and Datatypes

I have a number of protobuf files but no .proto schema file! cat myfile.pbuf | protoc --decode_raw > outputfile.txt Using the above command, I was able to decode the file into a somewhat readable ...
4
votes
1answer
2k views

Pydasm: Disassembling limited length executable shellcode

How to disassemble first 200 bytes of an executable code using pydasm library in Python? I want to know how to set size of buffer to disassemble it.
7
votes
1answer
761 views

Adding a toolbar to IDA using PySide

So i'm trying to add a custom toolbar to IDA 6.4 using their PySide download and the IDAAPI. I've tried adding a toolbar by just creating one but since it doesn't have an exec_() method I can't get ...
0
votes
1answer
582 views

Decode Ascii string values from reverse-engineered lua file

I decompiled a lua file with unluac and it turns out all the string variables are not readable and are instead ascii encoded clues = { { answer = { "\216\173", "\216\177", "\...
-1
votes
1answer
116 views

Python winappdbg getting process name from event object

I'm developing a debugging automation system using https://github.com/MarioVilas/winappdbg. I would like to retrieve process name from event object. Here is my code: def EventHandler(event): ...
3
votes
2answers
2k views

IDA - Some issues regarding function's/data/code recognition

I have to write an IDAPython script and I came across many false positives in IDA's function/code/data recognition. Case 1 - Invalid function's end (rpcrt4.dll): In some DLLs (especially in rpcrt4....
3
votes
1answer
2k views

Using Python pydbg - Find out what addresses does an instruction access

I want to know how to accomplish this task with python pydbg. How does pydbg trace an instruction? For instance: should I set a breakpoint at the instruction address? Then what should I do? The ...
2
votes
1answer
197 views

vivisect parse assembly

I'm using the vivisect library to parse functions within a binary, the documentation for vivisect is quite slim and I was wondering if there was a way to get information about the assembly ...
0
votes
1answer
513 views

Handling of the communication data I received with PySerial (Python)

In a nutshell: I've sniffed the data that goes from the controlling PC to the modem via RS232 serial port by building a little Y-adapter, now I want to figure out how to reverse engineer that data so ...
1
vote
1answer
355 views

QtNetwork in IDA's PyQt5

I'm interested in writing a network component to my IDAPython plugin, and QtNetwork looks really attractive, however it isn't include-able from IDAPython shell. Is there a simple way to add that ...
0
votes
1answer
976 views

Write own obfuscator in Python [closed]

I want to create my own, static obfuscator for any executables. What is the best way to do it with python? How should I start or what sources should I learn to do it? Anyon can give me some tips or ...
1
vote
2answers
2k views

How to decompile python 2.4 bytecode?

I need a good decompiler that can decompile python 2.4 byte code. I have looked over the internet and can only find python 2.5+ There are about a few hundred .pycs, so if it can decompile a directory ...
2
votes
4answers
2k views

Locate address of function in DLL

I need to locate the address of a function in a DLL at runtime which isn't exported. The DLL in question is vbe7.dll related to Visual Basic (and macros). The function is ___vbaInStr, can be found in ...
2
votes
1answer
2k views

Getting pydbg working on windows 10

I downloaded the paimei tool and dropped the pydbg package files inside .../paimai/pydbg then installed paimei but I can't seem to get pydbg to work. I keep getting an error with pydasm when trying to ...
2
votes
0answers
137 views

Restore function key

I have a simple function which looks like that: keyAlphabet = [-1, 16, 32, 127, 61, -32, -31, 43, 0, 88, 2, 5, 7, 112, 64, 69, 96] key = ??? # only keyAlphabet values p = 0x1337 for i in key: ...p*=i ...
2
votes
0answers
6k views

Plugin directory in IDA?

According to IDA docs, we can put a Python plugin into $HOME/.idapro/plugins/ directory. But when I copied my Python plugin there & restart IDA, IDA still do not see that. What can go wrong, and ...
0
votes
1answer
353 views

How to DUMP the full hexa of each function extracted by analysis of binary file?

I used a script python from radare2-bindings to write a code analysing a binary file, i extracted the name , the start address and the size of each function , but i can't dump the hexa of each ...
2
votes
1answer
59 views

Immnunity Debugger Python API Incorrect code execution order

PyCommand import immlib def main(args): imm = immlib.Debugger() imm.setBreakpoint(0x411077) imm.setReg("EAX",0x0) imm.log("EAX: {}".format(imm.getRegs()['EAX'])...
1
vote
0answers
451 views

To write a Python file to return a JSON represented list [closed]

I need to write a script that uses the r2pipe API to call the radare2 instance, analyze notepad.exe, and have it return a JSON-represented list of each function in the binary along with its virtual ...
1
vote
1answer
403 views

Pydbg setting registers without breakpoint?

In pydbg, is it possible to set a register without having it hit a break point first? Consider the following example break point handler: def handler_breakpoint(mdbg): print "[+]Hit breakpoint" ...
0
votes
1answer
151 views

Get DLL name with PyDBG and System_dll.py?

Is it possible to get the name and path of a DLL that is loaded by the application using PyDBG and System_dll.py? I have a script and PyDBG handles loaded dlls with just: dbg.set_callback(...
1
vote
1answer
348 views

Can I get different thread registers with PyDBG?

I am writing a python debugger and disassembler using the PyDBG library I have the disassembler part working, but not all of the debugger. Is it possible to use it to return something similar to: [*] ...
2
votes
1answer
585 views

Reverse engineering car stereo panel

I'd like to reverse engineer a car stereo front removable panel. It's a leftover from a broken car stereo. I'd like to do so by connecting the panel's 14 connections to Raspberry Pi 2 model B's GPIO ...
1
vote
0answers
614 views

Reverse Engineering program written in Python, compiled with “freeze 2 [REWRITE] [closed]

I am already aware of the question: 'Reverse Engineering program written in Python, compiled with “freeze”' I have Immunity Debugger and is this the pyc code and the structures? When I run the ...
8
votes
2answers
7k views

Good training for IDAPython

I'm familiar with python and IDA in general. I found a few very basic tutorials but nothing that goes through an explanation of the classes used and the full capability set. Near as I can tell the ...
1
vote
1answer
361 views

Analyse a piece of code using FloatingPoint instructions and calculations

i'm reversing this function doing this floating point calculations which eventually leads to a crucial compare. I need to understand what exactly are the calculations that are made and i want to re-...
3
votes
1answer
5k views

Getting user comments with IDAPython API (user_cmts_*)?

How do I call the user_cmts_* functions from the IDAPython API? I am quite new to the SDK and IDAPython, so I'm kind of lost as to what I'm supposed to pass to these functions, as it's not the user-...
9
votes
1answer
8k views

Reverse Engineering program written in Python, compiled with “freeze”

I am attempting to reverse engineer an EXE compiled using the utility "Freeze" or "pfreeze" that ships with Python (not to get confused with "cx_freeze"). Inside the EXE there is an array of memory ...
1
vote
2answers
305 views

pydbg: Disassemble at $exentry and relative offset from $exentry

I am attempting to disassemble a test binary I compiled written in masm. Here are the follwing bytes: Microsoft (R) COFF/PE Dumper Version 10.00.40219.01 Copyright (C) Microsoft Corporation. All ...
1
vote
1answer
136 views

Capstone Disassembly Engine Issue: OP_Access throws TypeError

After installing the Capstone python module, I ran this example on a Win7x86 PC with a minor edit (added arch and mode). However, when attempting to use insn.regs_access(), it throws a NoneType ...
3
votes
3answers
1k views

Reimplementing the x86 AESENC instruction in python

I'm having troubles implementing the AESENC x86 instruction in python. I'm reverse engineering the decryption of a indie video game. They use AES but they xor some generated data around and the key ...
1
vote
0answers
750 views

Implementation of mul x86 assembly instruction in python [closed]

I'm trying to implement the mul x86 assembly instruction in python and would like your advise to do it in the most pythonic way. Here is what I've done so far: eax = 0x51EB851F edx = 0x5D0FCF # mul ...