Questions tagged [python]
General-purpose and high-level programming language. Python supports multiple programming paradigms, including object-oriented, imperative and functional programming styles.
227
questions
0
votes
0
answers
1k
views
Reversing PYARMOR (?)
I have already decompiled an .exe file and reached to a .py but it is obfuscated using PyArmor.
I have already used ''https://github.com/nlscc/unpyarmor'' to try it, but could not figure it out how to ...
- 1
3
votes
1
answer
1k
views
Printing all strings in a Ghidra project with python
I got the string objects from a Ghidra project using this code:
l = list()
def callback(s):
l.append(s)
ss = StringSearcher(currentProgram, 5, 1, False, True)
ss.search(None, callback, True, ...
- 41
0
votes
0
answers
601
views
Decompiling exe to python source code
I've recently tried to decompile a .exe to .py source code. It partly went well as the majority of the .pyc got translated into python code but partly also failed. Like the following part:
--- This ...
- 1
0
votes
1
answer
2k
views
How can I reverse this python code (obfuscated by b64, gzip and many more)
How can I Deobfuscate this python code
Link to code
I tried to replace eval places by print. but it won't work and output is also obfuscated
Head of the code looks like this
can anyone please help me
0
votes
0
answers
325
views
Help me please decode the string (looks like gzip but it is not)
The software sends to the main server such string:
\x1f\xe2\x80\xb9\x08\x00\x00\x00\x00\x00\x04\x00E...\x03\x00\x00"
decode_gzip(body)
Later I've tried to decode it through different online ...
- 101
3
votes
0
answers
3k
views
How to decompile python ELF file (Compiled with Nuitka)?
I have some files that compiled with nuitka. formats are .bin. I could get shell access to running process with pyrasite same as this guide. but I cannot decompile function codes or anything else, and ...
- 31
0
votes
2
answers
393
views
convert code to python
i have snippet code that i want to convert to python to understand the types that ghidra use such *(byte *) and *(code *) and *(uchar *) etc..
the first code:
void one(int param_1,int param_2) {
int ...
2
votes
0
answers
139
views
Twitter scraping using Python
I've been working on a project to reverse-enginner twitter's app to scrape public posts from Twitter using an unofficial API, with Python. (I want to create an "alternative" app, which is ...
- 21
4
votes
2
answers
636
views
On reverse engineering an udp protocol to control a drone
My goal is to control my drone with my raspberry pi using python and not the app that is being delivered together with it.
First I connected the app to the drone, flew and used aircrack-ng to get the ...
-1
votes
1
answer
1k
views
Reversing a TXT obfuscated with pyArmor
Ok, so.
PyArmor. Apparently, my friend used it to protect some script, except it's not a python script, it's a few TXT files. Is it possible to reverse engineer it so I can see whats in the actual TXT ...
0
votes
1
answer
47
views
How to use two commands in python -c?
I am wanting to execute python command by using python -c but it contain in string library so i need import it.
While reading man i find this:
when called with -c command, it executes the
...
- 13
0
votes
1
answer
283
views
Need starter-help on reverse-engineering a game algorithm
I've got a dataset of about 1700 attacks in this game. A subset of the data is provided here. It consists of 9 columns:
modifier
Astr
Aspd
Adex
Adef
Dstr
Dspd
Ddex
Ddef
The modifier is in a range of ...
- 9
3
votes
1
answer
1k
views
How do I get the all the basic binary blocks containing a special instruction like 'CALL' or 'RET' using python in Ghidra?
I am using Ghidra to do reverse engineering of an ARM binary. I want to print the disassembly of all blocks across all functions containing a specific instruction like 'CALL' or 'RET'. How do I do ...
- 31
2
votes
0
answers
308
views
Automating binary patching in Hopper Disassembler using python
I am curious to know if anyone has done anything similar to what I am looking to achieve...
I have a .ipa file (iOS application) that I load into to Hopper Disassembler.
I search for a string to ...
- 21
-1
votes
1
answer
115
views
can a stdout captured at a parameter to python script
I'm working on a CTF challenge that is find a secret password.This secret password base on the username and password that i input and the hash value had print out after hash calculation and i want to ...
- 1
2
votes
1
answer
2k
views
Ghidra python - get string x-refs in a binary
In Ghidra, there is Defined Strings window, that lists all the strings in the binary and their location.
I want to access the strings from Ghidra Python, and to get all the x-refs to those strings.
...
- 1,858
2
votes
1
answer
987
views
How to reverse engineer cx_Freeze exe's?
How to reverse engineer Python scripts turned into binaries with cx_Freeze?
- 51
1
vote
1
answer
16k
views
How to turn .pyd files generated by pyinstaller into source?
I have decompiled a pyinstaller exe and then decompiled the .pyc source inside it. only problem is the source is this
import secretmodule
secretmodule.main()
Annoying, I know. i found secretmodule ...
- 51
0
votes
0
answers
1k
views
Decoding messages sent/received by Python websocket client
I am using the websocket module for my client in python3, and I am trying to troubleshoot some errors I am getting that lead to the client disconnecting after seemingly random intervals.
When I ...
2
votes
1
answer
2k
views
How can I debug Ghidra plugin Python scripts in IDE?
I'd like to debug Ghidra plugin scripts written in python using an IDE such as Eclipse. I have installed Pydev and the GhidraDev plugin (from Ghidra open a script in Eclipse to autoinstall the plugin)...
- 63
0
votes
0
answers
3k
views
Reverse exe file compiled by pyinstaller
I am trying to get python source code from only exe file compiled by pyinstaller.
I used the pyinstxtractor.py and got extracted folder.
And then what or how should I do?
Or could you explain other ...
- 101
1
vote
1
answer
5k
views
Buffer overflow: pwntools does not give me a shell, despite exploit working without pwntools
Recently, I've been trying to learn how to use the pwntools library. I am trying to exploit the following program using pwntools:
#include <stdio.h>
#include <stdlib.h>
int main(void) {
...
1
vote
1
answer
2k
views
Extract PYZ Error
I successfully recovered some PYC files from an ELF built by PyInstaller (https://github.com/extremecoders-re/pyinstxtractor/wiki/Extracting-Linux-ELF-binaries). There is a PYZ archive in the dump. I ...
- 119
0
votes
1
answer
295
views
Is command injection using a valid file path possible?
My question is theoretical, and not bound to python - but for the sake of simplicity, I'll use Python code snippet.
Let's assume I have the following code:
import os
import sys
if os.path.exist(sys....
- 1,858
2
votes
1
answer
498
views
How to start out in reversing?
I'm new in reversing and I'd like a lot to learn about it. I have little to no knowledge about it. Is still worth to learn x86 Assembly? Since almost everything these days work on x64 architecture. ...
- 153
2
votes
1
answer
222
views
Using angr/radare2 to estimate values given chunks of assembly
I'm currently using radare2 in order to construct a simple CFG, each block/node in that graph is composed of one or more assembly instructions, I wish to estimate the value of specific register or ...
- 141
0
votes
1
answer
166
views
Python decompilation seems to return gibberish (partly)
I decompiled a pyc file with uncompyle6, and this is the result:
# uncompyle6 version 3.7.3
# Python bytecode 3.6 (3379)
# Decompiled from: Python 3.6.9 (default, Aug 24 2020, 10:24:35)
# [GCC 9.3.0]
...
- 13
3
votes
1
answer
267
views
reason of padding in exploit
I was doing vulnserver bufferflow exploit. I saw a tutorial where the he makes a payload to exploit the server.
Take a look at the exploit:
#!/usr/bin/python
import socket
target_ip = "10.0.2....
- 143
0
votes
0
answers
213
views
Debug dll file used in python script IDA
I am fairly new to RE on windows.
I have a python script which via ctypes uses functions from a dll.
I don't know if it's possible, but I would like to debug the dll used in the python script (the dll ...
- 1
1
vote
0
answers
2k
views
Reversing PyArmor + Pyinstaller
Created an application, protected by PyArmor and used pyinstaller. I'm trying to reverse engineer it. So far I've decompiled the exe into pyc files but it's still pyarmor encrypted I can only see the ...
- 19
2
votes
1
answer
229
views
Ghidra Python - cancel decompilation task
The way to decompile a function in Ghidra Python is:
decomp = DecompInterface()
decomp.openProgram(currentProgram)
decompile = decomp.decompileFunction(func, 1000, monitor)
However, in ...
- 1,858
0
votes
0
answers
43
views
help about methodology
I am a beginner in reverse engineering.
For a challenge I need to reverse a code in python this code use enigma algorithm :
To found the good configuration to decode the enigma code received.
The ...
3
votes
1
answer
5k
views
Decompiling .pyc file to 0 byte .py file
i am doing the CTF-like challenges. One of these tasks need us to decompiling Python bytecode 3.8 (.pyc file) into py file. However, the py file that generated by pyc file is 0 byte
The original file'...
- 33
1
vote
1
answer
147
views
Ida python No module named tempo
I tried to run tempo.py from ida python github , but I got error No module named tempo
According to Igor Skochinsky answer , this script is wrong
Apparently, tempo was an internal module used ...
- 71
0
votes
1
answer
1k
views
Ghidra Python - Get Decompile Line Text by RVA
Is there a way in Ghidra Python to get the corresponding decompile line by RVA?
Or the opposite - get the corresponding RVA from a given line in a decompile?
- 1,858
1
vote
3
answers
4k
views
Ghidra Python - Get x-refs of a specific function
What is the best way to get calling x-refs for a specific function?
I am aware of the following method:
func = getFirstFunction()
while func is not None:
func_name = func.getName()
if ...
- 1,858
0
votes
1
answer
1k
views
GDB - Send Python output to the program after SIGINT
I am trying to learn GDB to better understand buffer overflows but I can't find an answer to my problem which is how can I send a Python-generated output to the program when the program asks for user ...
- 3
2
votes
1
answer
5k
views
Using Python 3.7 and 2.x in same IDA
I have IDA Pro 7.4 that use with Python 3.7 and I have some IDA-plugin that works only with Python 2.7.
Is there any way to run that Python 2.7 based plugin?
- 71
1
vote
1
answer
5k
views
Decompiling Python Files: ValueError
So I have this python file and I successfully unpacked its content inside of it we have our file.pyc
I appended the magic bytes to it so it went from:
E3 00 00 00 00 00 00 00 00 00 00 00 00
to ...
- 51
0
votes
0
answers
51
views
Python based static c analysis tools
I want to analyze some open-source C code, and I'm looking for a static analysis python library for C, preferably open-source. Any ideas/suggestions, based on your experience?
- 1,858
3
votes
1
answer
2k
views
ghidra-python: create struct with big endian field
Using ghidra's python scripting engine, I'd like to create a struct which contains a big endian, unsigned integer. This field is always big endian, no matter what the endainess of the binary CPU is.
...
- 33
-2
votes
1
answer
5k
views
How to decompile obfuscated Python code?
I have an executable file, which I am trying to decompile. I have already deduced that it was originally programmed in Python. I know that it was obfuscated with PyArmor and possibly compiled with ...
- 61
-1
votes
1
answer
180
views
Help to understand what's inside base64 string
While performing a file upload, a template parameter is sent together with file. Service acts differently when different parameters are passed.
I need help to figure out what this parameter contains.
...
- 1
1
vote
1
answer
408
views
Python self decryption script, as mean of obfuscation
I have a software with an embedded python interpreter. The software can open upon startup a given .py script and execute it. Let's assume that in my python environment I can't open other files, and I ...
- 1,858
4
votes
1
answer
1k
views
Ghidra Headless Analyzer - Create Functions
I'm interested in open a binary file (.bin, without arch info), and analyze it with analyzeHeadless.bat (Ghidra version without GUI).
I know what is the architecture of the file, so I pass it as a ...
- 1,858
1
vote
3
answers
227
views
How to input ascii control character into program?
I am working on a CTF where I need to pass an address as input to a program. This address contains the value 0x09 (the tab character). This is causing me problems, because it seems that bash is ...
- 29
3
votes
1
answer
7k
views
How to reverse a Cython shared object (.so)
I have a .so file (ELF 64-bit LSB shared object, x86-64, dynamically linked, no section header) with an embedded Cython program.
To run the program inside the .so file there is a single python3 ...
- 131
1
vote
1
answer
12k
views
How to to decompile a pyinstaller exe, back to source code?
Python versions, this method has been tried on: 3.7.5, 3.6.0, 3.5.0, 2.7.17? (I know, I'm just too desperate to get my source back.)
I have problem with decompiling an exe. I kind of deleted the ...
- 11
4
votes
1
answer
12k
views
Best way to protect source code of .exe program running on Python?
I am developing proprietary software that would be distributed in a form of .exe file. In order to use it, users will have to authenticate with their whitelist credentials (username + password).
The ...
- 141
2
votes
2
answers
568
views
Prevent Memory Inspection in a Cython program?
Cython is a great way to protect the source code of a Python program. However, memory inspection and memory reverse engineering can still be done to this Cython program.
What are ways to prevent (or ...
- 21