Questions tagged [python]

General-purpose and high-level programming language. Python supports multiple programming paradigms, including object-oriented, imperative and functional programming styles.

Filter by
Sorted by
Tagged with
1
vote
2answers
2k views

Modify py2exe packed executable

I have an application in Python compiled with py2exe. I have successfully extracted python scripts using Py2ExeDumper converted to .py using Easy Python Decompiler. I made some modification to the ...
0
votes
2answers
476 views

Detecting weaknesses/vulnerabilities (in games). Scientific papers/Tutorials?

I am a student of informatics with additional games engineering. I currently have a project about Reverse Code Engineering. Mainly my task is to gather information about the topic "Detecting ...
3
votes
1answer
786 views

IDA API - query number of parameters for cdecl functions

I'm writing a script that, among other things, reads and does some processing with parameters to a function. Right now my solution to find the number of arguments for a given function at addr is: (...
1
vote
2answers
2k views

How to decompile python 2.4 bytecode?

I need a good decompiler that can decompile python 2.4 byte code. I have looked over the internet and can only find python 2.5+ There are about a few hundred .pycs, so if it can decompile a directory ...
6
votes
1answer
631 views

Immunity Debugger PyPlugin

Immunity Debugger offers a feature called PyPlugin. However there is not enough documentation on it. The help for immdbg says this : PyPlugins are python scripts located at PyPlugins\ directory, ...
9
votes
1answer
6k views

Reverse Engineering program written in Python, compiled with “freeze”

I am attempting to reverse engineer an EXE compiled using the utility "Freeze" or "pfreeze" that ships with Python (not to get confused with "cx_freeze"). Inside the EXE there is an array of memory ...
5
votes
2answers
8k views

Python library for assembling x86, x64 and ARM exploits

It would be very useful to have a pure Python library that could assemble x86, x64, and ARM instructions. Do you have a recommendation? I don't mind if they are not pure Python, but that'd be ...
0
votes
1answer
537 views

Extract a global variable [duplicate]

I'm trying to extact a global variable from an executable. Basically, I'm tryin to reverse an executable that put some python bytecode in a global variable and I'd like to extract it. I found out that ...
2
votes
0answers
175 views

ResumeThread doesn't work after attaching to the process using vTrace

In an effort to learn vtrace I've been trying to attach to a process and hook the import address table and then resume the main thread of a process. When I don't attach to the process the ...
2
votes
1answer
625 views

Find register value of a remote process - pydbg

How can I find the register value of another process at a specific address using python pydbg or any other module that can do that? Lets say that: Address opcode 006122CB ...
3
votes
1answer
1k views

Using Python pydbg - Find out what addresses does an instruction access

I want to know how to accomplish this task with python pydbg. How does pydbg trace an instruction? For instance: should I set a breakpoint at the instruction address? Then what should I do? The ...
3
votes
2answers
538 views

How to compile c, cpp and python code as “Released/Final” version?

I want to know if there are ways to compile C, C++ and Python code in order to not be able to reverse engineering it over Linux or not? I have heard there are some ways over Windows to do it, but I ...
4
votes
1answer
2k views

How do I trace instructions in an Immunity Debugger PyCommand?

This sounds like a very simple thing to accomplish but I can't seem to get it working. I'd like to run a part of a program in ImmDbg instruction by instruction and keep track of some actions that it ...
6
votes
3answers
7k views

Paste hex bytes into IDA Pro Hex View

Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01......
4
votes
1answer
1k views

vtrace / vivisect resources

Where can I find some resources to start learning about vivisect? Blog posts, presentations, PDFs, code examples, anything would be appreciated. I am aware I can read the code but before doing that ...
3
votes
2answers
899 views

Using Python CTypes to get to the IAT

I'm trying to get to IAT of a PE file. My plan is eventually overwrite some values so I can hook some stuff to help with unpacking, etc. I'm using this post https://stackoverflow.com/questions/...
6
votes
1answer
895 views

Read a struct from memory

I'm trying to load a struct defined in a program that i'm reading the memory of, so I can use it to define objects in my python debugger (in windows). What format do structs take in memory, and what ...
4
votes
1answer
6k views

API hooking using DLL injection with Python C-Types

I'd like to write something using Python C-Types that hooks API calls and can be leveraged for unpacking executables. Currently my (Python with C-Types) code launches an executable in a suspended ...
3
votes
1answer
166 views

Logging lpRect and uFormat from DrawTextA

Using APIMonitor from Rohitab I found that DrawTextA has some additional arguments I would like to log using Python and Pydbg (I'm currently logging lpchText, se below). My current hooking code looks ...
4
votes
1answer
2k views

Pydasm: Disassembling limited length executable shellcode

How to disassemble first 200 bytes of an executable code using pydasm library in Python? I want to know how to set size of buffer to disassemble it.
3
votes
3answers
4k views

Check DEP , ASLR and SafeSEH enabled or not , immlib

How to check if DEP, ASLR and SafeSEH defense mechanism are enabled or not in a program using immlib library of Python in Immunity Debugger ? Actually I am looking for small code snippet for each.
2
votes
1answer
274 views

Server-side bind() function, immlib

How do I get IP address and port number out of bind function in Server application. Can it be achieved with hooks like bphook in immunity debugger? My problem is that I don't know how to unpack ...
2
votes
1answer
705 views

Use of FastLogHook function in immlib?

I am a newbie in python programming for Debugging . I wrote a code for using the function FastLogHook() in immlib but i am not able to figure out the exact problem with my code as it is not working :( ...
5
votes
1answer
1k views

How to use fastloghook in immunity debugger

How does fastloghook work in immunity debugger pycommand section? i cant figure it out. Everything i try does not work and i know this code is a mess. I seriously dont understand fastloghook which ...
7
votes
1answer
268 views

Setup an IDA (python) callback when an instruction is selected

I am using the IDA python features, and I am trying to setup a callback. When a user selects an instruction in the hex or graph view, I want my callback to be triggered. I have browsed the docs, but I ...
15
votes
3answers
4k views

How to debug an IDAPython script from within IDA?

IDAPython is great plugin in IDA. It is so handy to write small script to decode, decrypt or fix (patch) a binary in IDA. I can just write, load and run a script, and can use print for the usual ...
5
votes
1answer
2k views

Is it possible to create data xrefs manually?

I have a binary with lots of indirect calls (call dword ptr [register + offset ]) the register is calculated with a simple math which I manage to statically calculate on my own (the call itself lead ...
22
votes
5answers
8k views

What are the tools to analyze Python (obfuscated) bytecode?

Recently on Reddit ReverseEngineering I stumbled on a self-modifying code in Python. Looking at the Github repository was quite instructive and I found picture of the Python bytecode program exposed ...
9
votes
5answers
17k views

What are the techniques and tools to obfuscate Python programs?

This question is related to this other one. I just wonder what are the techniques applicable and which can be found in the real world to obfuscate Python program (similar questions can be found on ...
17
votes
2answers
5k views

Is it possible to get python bytecode without using co_code?

I posted this a while back on stackoverflow (too old to migrate though). Say I am in the python interpreter and define a function as follows: def h(a): return a If I want to look at the bytecode (...
19
votes
6answers
53k views

Decompiling .pyc files

Does anybody have a suggestion for (non commercial) software to decompile "byte-code" Python (.pyc) files? Everything I've found seems to break...
6
votes
1answer
813 views

Importing external libraries in Hopper scripts?

Can external libraries be used in Hopper scripts? I'd like to add PDB support to Hopper using pdbparse, but I haven't been able to get it to use external libraries. Alternatively, I suppose one could ...
24
votes
5answers
51k views

How do you reverse engineer an EXE “compiled” with PyInstaller

Having recently watched/read a presentation given by Dave Kennedy at DEF CON 20 [PDF], I'd like to know how to decompile a Python script compiled with PyInstaller. In his presentation, he is creating ...