Questions tagged [python]

General-purpose and high-level programming language. Python supports multiple programming paradigms, including object-oriented, imperative and functional programming styles.

Filter by
Sorted by
Tagged with
2
votes
2answers
3k views

Volatility - manually inspect heap of a process

According to the book The Art of Memory Forensics[1], there is a heaps plugin that can extract out information from the heap memory of a process. I'm using latest version of volatility - 2.6 , but the ...
5
votes
1answer
459 views

How can I get the shared libraries' function calls using angr

I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like: import sys, angr import networkx as nx proj = angr....
0
votes
1answer
154 views

Can anyone help me identify and decode this string? [closed]

Below is a part of a code that I reversed with repy2exe and I want to understand what it does and especially how to decode the value in the "secret" variable: using = [ 'Mg==\n', 'MTA1\n', ...
2
votes
1answer
551 views

Deducing Protobuf Schema and Datatypes

I have a number of protobuf files but no .proto schema file! cat myfile.pbuf | protoc --decode_raw > outputfile.txt Using the above command, I was able to decode the file into a somewhat readable ...
0
votes
1answer
382 views

Decode Ascii string values from reverse-engineered lua file

I decompiled a lua file with unluac and it turns out all the string variables are not readable and are instead ascii encoded clues = { { answer = { "\216\173", "\216\177", "\...
-1
votes
1answer
106 views

Python winappdbg getting process name from event object

I'm developing a debugging automation system using https://github.com/MarioVilas/winappdbg. I would like to retrieve process name from event object. Here is my code: def EventHandler(event): ...
3
votes
2answers
2k views

IDA - Some issues regarding function's/data/code recognition

I have to write an IDAPython script and I came across many false positives in IDA's function/code/data recognition. Case 1 - Invalid function's end (rpcrt4.dll): In some DLLs (especially in rpcrt4....
1
vote
3answers
2k views

How to monitor/reverse engineer RS485-connected display device traffic?

Can anyone point me in the right direction for tutorials etc on reverse engineering RS484 connected battery management system? I have a large 12V lithium battery module which has an internal BMS and ...
1
vote
1answer
6k views

IDA python : reading n bytes from an offset

Using python in IDA, I would like tu create a partial file dump. For exemple I would like to dump the data from offset X for a size of Y. I believe I could do it by using the idc.Dword function : ...
2
votes
1answer
185 views

vivisect parse assembly

I'm using the vivisect library to parse functions within a binary, the documentation for vivisect is quite slim and I was wondering if there was a way to get information about the assembly ...
0
votes
1answer
370 views

Handling of the communication data I received with PySerial (Python)

In a nutshell: I've sniffed the data that goes from the controlling PC to the modem via RS232 serial port by building a little Y-adapter, now I want to figure out how to reverse engineer that data so ...
0
votes
1answer
715 views

Write own obfuscator in Python [closed]

I want to create my own, static obfuscator for any executables. What is the best way to do it with python? How should I start or what sources should I learn to do it? Anyon can give me some tips or ...
3
votes
2answers
3k views

Is it possible to get a list of user-defined names in IDA?

IDA allows one to rename a program entity (e.g. register, variable, function) using N shortcut. Is it possible to get a list of such user-defined names in IDA?
2
votes
4answers
1k views

Locate address of function in DLL

I need to locate the address of a function in a DLL at runtime which isn't exported. The DLL in question is vbe7.dll related to Visual Basic (and macros). The function is ___vbaInStr, can be found in ...
2
votes
1answer
2k views

Getting pydbg working on windows 10

I downloaded the paimei tool and dropped the pydbg package files inside .../paimai/pydbg then installed paimei but I can't seem to get pydbg to work. I keep getting an error with pydasm when trying to ...
5
votes
2answers
2k views

idapython - Determine if item is code or data

I need to determine whether an IDA's item is code or data. Sometimes, data resides in an executable's code section (virtual functions tables, switch tables and stuff). So in IDA, you can sometimes see ...
2
votes
0answers
115 views

Restore function key

I have a simple function which looks like that: keyAlphabet = [-1, 16, 32, 127, 61, -32, -31, 43, 0, 88, 2, 5, 7, 112, 64, 69, 96] key = ??? # only keyAlphabet values p = 0x1337 for i in key: ...p*=i ...
1
vote
0answers
4k views

Plugin directory in IDA?

According to IDA docs, we can put a Python plugin into $HOME/.idapro/plugins/ directory. But when I copied my Python plugin there & restart IDA, IDA still do not see that. What can go wrong, and ...
1
vote
1answer
312 views

QtNetwork in IDA's PyQt5

I'm interested in writing a network component to my IDAPython plugin, and QtNetwork looks really attractive, however it isn't include-able from IDAPython shell. Is there a simple way to add that ...
2
votes
1answer
48 views

Immnunity Debugger Python API Incorrect code execution order

PyCommand import immlib def main(args): imm = immlib.Debugger() imm.setBreakpoint(0x411077) imm.setReg("EAX",0x0) imm.log("EAX: {}".format(imm.getRegs()['EAX'])...
0
votes
1answer
283 views

How to DUMP the full hexa of each function extracted by analysis of binary file?

I used a script python from radare2-bindings to write a code analysing a binary file, i extracted the name , the start address and the size of each function , but i can't dump the hexa of each ...
3
votes
1answer
489 views

Modifying PPID to avoid anti-debugging measure

I'm trying to debug an application that reads the Parent Process Id(PPID), to check if the application is being debugged. It expects the PPID to be the PID of explorer.exe, if it isn't, it quits. To ...
1
vote
1answer
1k views

Resolving DLL function names using ordinals

I am trying to figure out how to get the imports of a PE using the PEfile python project (https://github.com/erocarrera/pefile) One thing special about that library is the ordlookup folder. It looks ...
1
vote
0answers
441 views

To write a Python file to return a JSON represented list [closed]

I need to write a script that uses the r2pipe API to call the radare2 instance, analyze notepad.exe, and have it return a JSON-represented list of each function in the binary along with its virtual ...
1
vote
1answer
371 views

Pydbg setting registers without breakpoint?

In pydbg, is it possible to set a register without having it hit a break point first? Consider the following example break point handler: def handler_breakpoint(mdbg): print "[+]Hit breakpoint" ...
0
votes
1answer
135 views

Get DLL name with PyDBG and System_dll.py?

Is it possible to get the name and path of a DLL that is loaded by the application using PyDBG and System_dll.py? I have a script and PyDBG handles loaded dlls with just: dbg.set_callback(...
2
votes
1answer
436 views

Reverse engineering car stereo panel

I'd like to reverse engineer a car stereo front removable panel. It's a leftover from a broken car stereo. I'd like to do so by connecting the panel's 14 connections to Raspberry Pi 2 model B's GPIO ...
1
vote
1answer
318 views

Can I get different thread registers with PyDBG?

I am writing a python debugger and disassembler using the PyDBG library I have the disassembler part working, but not all of the debugger. Is it possible to use it to return something similar to: [*] ...
1
vote
0answers
548 views

Reverse Engineering program written in Python, compiled with “freeze 2 [REWRITE] [closed]

I am already aware of the question: 'Reverse Engineering program written in Python, compiled with “freeze”' I have Immunity Debugger and is this the pyc code and the structures? When I run the ...
8
votes
2answers
6k views

Good training for IDAPython

I'm familiar with python and IDA in general. I found a few very basic tutorials but nothing that goes through an explanation of the classes used and the full capability set. Near as I can tell the ...
1
vote
1answer
318 views

Analyse a piece of code using FloatingPoint instructions and calculations

i'm reversing this function doing this floating point calculations which eventually leads to a crucial compare. I need to understand what exactly are the calculations that are made and i want to re-...
1
vote
2answers
1k views

IDA scripting - get local variable by its name

During the debugging I can see all the function's local variables in tab Locals (Debugger -> Debugger Windows -> Locals(HEXRAYS)). For example I have a struct variable a1 0x891E1160:{pBuf=...
7
votes
1answer
638 views

Adding a toolbar to IDA using PySide

So i'm trying to add a custom toolbar to IDA 6.4 using their PySide download and the IDAAPI. I've tried adding a toolbar by just creating one but since it doesn't have an exec_() method I can't get ...
3
votes
1answer
4k views

Getting user comments with IDAPython API (user_cmts_*)?

How do I call the user_cmts_* functions from the IDAPython API? I am quite new to the SDK and IDAPython, so I'm kind of lost as to what I'm supposed to pass to these functions, as it's not the user-...
1
vote
2answers
287 views

pydbg: Disassemble at $exentry and relative offset from $exentry

I am attempting to disassemble a test binary I compiled written in masm. Here are the follwing bytes: Microsoft (R) COFF/PE Dumper Version 10.00.40219.01 Copyright (C) Microsoft Corporation. All ...
1
vote
1answer
129 views

Capstone Disassembly Engine Issue: OP_Access throws TypeError

After installing the Capstone python module, I ran this example on a Win7x86 PC with a minor edit (added arch and mode). However, when attempting to use insn.regs_access(), it throws a NoneType ...
3
votes
3answers
1k views

Reimplementing the x86 AESENC instruction in python

I'm having troubles implementing the AESENC x86 instruction in python. I'm reverse engineering the decryption of a indie video game. They use AES but they xor some generated data around and the key ...
1
vote
0answers
650 views

Implementation of mul x86 assembly instruction in python [closed]

I'm trying to implement the mul x86 assembly instruction in python and would like your advise to do it in the most pythonic way. Here is what I've done so far: eax = 0x51EB851F edx = 0x5D0FCF # mul ...
2
votes
2answers
244 views

Defining Pointers outside the Target Proccess Memory Space

I am making a memory editor for an application written in Python. I've successfully grabbed the memory data from the target process using OpenProcess and ReadProcessMemory functions from the kernel32....
4
votes
0answers
697 views

Python library for linux to demangle MSVC decorated names

I am looking for a python library for linux which can demangle the function names which are mangled by MSVC. for example : Project!??0?$allocator@D@std@@QAE@XZ to Project!public: __thiscall ...
2
votes
1answer
539 views

Reverse Engineering a python mac application compiled with “freeze”

(Note)I have already seen this post: Reverse Engineering program written in Python, compiled with "freeze" Would anyone know how to do what is done in the link above using the PyCommand but ...
0
votes
2answers
416 views

How I can get the text with c# from Tkinter (python) window?

I'm trying to find a way how I can read the textbox inside the idle. The Idle is (I think) written in python (Tkinter ?). I have tried to find the function which reads the textbox.text through ...
10
votes
1answer
3k views

Extracting arguments from IDA

Let's say I have the following function in IDA: int __usercall function<eax>(char* message<ebp>, unsigned int count<edi>) What's the fastest way to extract the argument information ...
6
votes
1answer
9k views

Which python library for parsing Linux ELF files?

I want to be able to parse 32 and 64 bit ELF files - but not create or modify them (e.g. as discussed in this thread). The ELF binaries may possibly come from embedded Linux systems, that is, the ...
0
votes
2answers
500 views

Reverse engineering a java applet using python/Javascript

I love doing online stock trading in my free time. Because I spend most of the day at my job I cannot do much of it. So, I'm thinking of making a software that will automatically place trades for me ...
3
votes
1answer
386 views

Function calls: xref.type always 'Code_Far_Call' or 'Code_Near_Call'?

Given a disassembly line in IDA Pro such as .text:0040255B call sub_407C10 Am I right to assume that analyzing the belonging address using idautils.XrefsFrom(0x0040255B) always returns an ...
1
vote
3answers
2k views

Python: Adding a asection to a PE file

I am working with PE binaries using Python and the pefile library. Its good for reading information out of a binary and rewriting certain bytes. If I wanted to add a section to the file then i am ...
0
votes
1answer
3k views

How to decompile python [duplicate]

How can I decompile python 3.3 files ?? Can you please suggest me a tool for linux ubuntu 14.10 in specific note easy decompiler didn't work for me :(
2
votes
1answer
326 views

Adding Types to GDB via Python

GDB has a reasonably robust API which is exposed to Python at runtime. It allows for inspecting various types, but does not appear to allow creation of types. However, types can be manually added by ...
0
votes
1answer
615 views

Using PyDBG how to find in which loaded module callee functions is present

Is there any quick/ faster way to find , any address resides in which loaded module. For example from stack if I have ret address of any api. I want to check from which module actually that function ...