Questions tagged [python]

General-purpose and high-level programming language. Python supports multiple programming paradigms, including object-oriented, imperative and functional programming styles.

Filter by
Sorted by
Tagged with
3
votes
1answer
118 views

reason of padding in exploit

I was doing vulnserver bufferflow exploit. I saw a tutorial where the he makes a payload to exploit the server. Take a look at the exploit: #!/usr/bin/python import socket target_ip = "10.0.2....
3
votes
1answer
1k views

String Encoding and Decoding Method

so I came across the following string encoding method in python. def encode(the_string): encoded_string = '' rotations = ord(the_string[-1]) + 5 for i in range(0, len(the_string)): ...
3
votes
1answer
534 views

Modifying PPID to avoid anti-debugging measure

I'm trying to debug an application that reads the Parent Process Id(PPID), to check if the application is being debugged. It expects the PPID to be the PID of explorer.exe, if it isn't, it quits. To ...
3
votes
1answer
143 views

On reverse engineering an udp protocol to control a drone

My goal is to control my drone with my raspberry pi using python and not the app that is being delivered together with it. First I connected the app to the drone, flew and used aircrack-ng to get the ...
3
votes
0answers
126 views

Z3 and If-logic

Z3 is a fantastic tool which helped me a lot! But sometimes I'm stuck on the binary code which implements custom If-logic. Recursive factorial function is good example of it: def fact(x): if x == ...
2
votes
4answers
5k views

How to decompile with Hex Rays via a Python API?

If i have a large set of files and I'd like to run Hex-rays over them to produce output as C - can I do so in python? I see there is IDA Python And I see Hex-rays has a C++ SDK Is there a python Hex-...
2
votes
1answer
626 views

Reverse engineering car stereo panel

I'd like to reverse engineer a car stereo front removable panel. It's a leftover from a broken car stereo. I'd like to do so by connecting the panel's 14 connections to Raspberry Pi 2 model B's GPIO ...
2
votes
1answer
283 views

Server-side bind() function, immlib

How do I get IP address and port number out of bind function in Server application. Can it be achieved with hooks like bphook in immunity debugger? My problem is that I don't know how to unpack ...
2
votes
2answers
601 views

How can I reverse this recursive function?

This is the python code I wrote of a simple crackme that I have reversed but I am not able to understand what the recursive function here does. def the_process(stored, inp, size): idx = 0 ...
2
votes
2answers
385 views

Prevent Memory Inspection in a Cython program?

Cython is a great way to protect the source code of a Python program. However, memory inspection and memory reverse engineering can still be done to this Cython program. What are ways to prevent (or ...
2
votes
1answer
749 views

Find register value of a remote process - pydbg

How can I find the register value of another process at a specific address using python pydbg or any other module that can do that? Lets say that: Address opcode 006122CB ...
2
votes
1answer
286 views

How to start out in reversing?

I'm new in reversing and I'd like a lot to learn about it. I have little to no knowledge about it. Is still worth to learn x86 Assembly? Since almost everything these days work on x64 architecture. ...
2
votes
1answer
102 views

Ghidra Python - cancel decompilation task

The way to decompile a function in Ghidra Python is: decomp = DecompInterface() decomp.openProgram(currentProgram) decompile = decomp.decompileFunction(func, 1000, monitor) However, in ...
2
votes
2answers
131 views

Regenerate PEM/DER keys from binary blobs

I have the binary blobs for the components of a private key including modulus, publicExponent, privateExponent, prime1, prime2, exponent1, exponent2 and coefficient, what is the easiest way to ...
2
votes
1answer
685 views

how can i Encrypt a decrypted zte zxhn h108n V2.5 config file?

i have decrypted the config file using a program i found online ( maybe made by python to exe ) so to decrypt using it you type is command into CMD decode_zte_config.exe config.bin config.bin.xml ...
2
votes
1answer
870 views

Deducing Protobuf Schema and Datatypes

I have a number of protobuf files but no .proto schema file! cat myfile.pbuf | protoc --decode_raw > outputfile.txt Using the above command, I was able to decode the file into a somewhat readable ...
2
votes
3answers
2k views

How to monitor/reverse engineer RS485-connected display device traffic?

Can anyone point me in the right direction for tutorials etc on reverse engineering RS484 connected battery management system? I have a large 12V lithium battery module which has an internal BMS and ...
2
votes
1answer
753 views

Use of FastLogHook function in immlib?

I am a newbie in python programming for Debugging . I wrote a code for using the function FastLogHook() in immlib but i am not able to figure out the exact problem with my code as it is not working :( ...
2
votes
1answer
67 views

Hooking IAT in remote process with Python?

I'm trying to hook a win32 function call (CreateFileW) inside of a notepad process to have the function do additional actions before returning what it should do. Ultimately, this will assist me in ...
2
votes
1answer
219 views

How do I get the all the basic binary blocks containing a special instruction like 'CALL' or 'RET' using python in Ghidra?

I am using Ghidra to do reverse engineering of an ARM binary. I want to print the disassembly of all blocks across all functions containing a specific instruction like 'CALL' or 'RET'. How do I do ...
2
votes
1answer
233 views

How to reverse engineer cx_Freeze exe's?

How to reverse engineer Python scripts turned into binaries with cx_Freeze?
2
votes
2answers
541 views

IDA Python get struct type with dependencies

Over the IDA Gui it is possible to export a local type with dependencies to a header file. For example if i export a struct that has one member from type DWORD than the header file also contains "...
2
votes
2answers
1k views

IDA: call a function with different arguments

I'm reversing some software and found the function which decrypts some stuff: As you can see it has the password parameter for it which gets decrypted in this function. Function disassembly: ...
2
votes
2answers
277 views

Defining Pointers outside the Target Proccess Memory Space

I am making a memory editor for an application written in Python. I've successfully grabbed the memory data from the target process using OpenProcess and ReadProcessMemory functions from the kernel32....
2
votes
1answer
836 views

Reverse Engineering a python mac application compiled with "freeze"

(Note)I have already seen this post: Reverse Engineering program written in Python, compiled with "freeze" Would anyone know how to do what is done in the link above using the PyCommand but ...
2
votes
1answer
1k views

Python Script to get disassembled output of an EXE file

I'm pretty new to Ghidra, and looking to use it's API (headless analyzer) and get the assembled file through command line using python. Here is my code, which is likely far from the correct code. It ...
2
votes
1answer
675 views

Decrypting the Config file of a Huawei router "HG630 V2"

followed that post from Wordpress https://hg658c.wordpress.com/2017/12/04/decrypting-configuration-files-from-other-huawei-home-gateway-routers/ Extracted the 4 Hex strings needed. But, looks ...
2
votes
1answer
323 views

ROP chain: Buffer Overflow Return Pointer

I am trying to get a ROP exploit to work on Ubuntu 18.04 LTS 64bit. I have a 64 bit binary (Nx enabled, ASLR disabled) with vuln function as follows: public vuln vuln proc near var_100= byte ptr -...
2
votes
1answer
213 views

vivisect parse assembly

I'm using the vivisect library to parse functions within a binary, the documentation for vivisect is quite slim and I was wondering if there was a way to get information about the assembly ...
2
votes
4answers
2k views

Locate address of function in DLL

I need to locate the address of a function in a DLL at runtime which isn't exported. The DLL in question is vbe7.dll related to Visual Basic (and macros). The function is ___vbaInStr, can be found in ...
2
votes
1answer
2k views

Getting pydbg working on windows 10

I downloaded the paimei tool and dropped the pydbg package files inside .../paimai/pydbg then installed paimei but I can't seem to get pydbg to work. I keep getting an error with pydasm when trying to ...
2
votes
1answer
62 views

Immnunity Debugger Python API Incorrect code execution order

PyCommand import immlib def main(args): imm = immlib.Debugger() imm.setBreakpoint(0x411077) imm.setReg("EAX",0x0) imm.log("EAX: {}".format(imm.getRegs()['EAX'])...
2
votes
1answer
400 views

Adding Types to GDB via Python

GDB has a reasonably robust API which is exposed to Python at runtime. It allows for inspecting various types, but does not appear to allow creation of types. However, types can be manually added by ...
2
votes
0answers
554 views

How to decompile python ELF file (Compiled with Nuitka)?

I have some files that compiled with nuitka. formats are .bin. I could get shell access to running process with pyrasite same as this guide. but I cannot decompile function codes or anything else, and ...
2
votes
0answers
78 views

Twitter scraping using Python

I've been working on a project to reverse-enginner twitter's app to scrape public posts from Twitter using an unofficial API, with Python. (I want to create an "alternative" app, which is ...
2
votes
1answer
317 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
2
votes
0answers
575 views

Debugging Ghidra Script [closed]

I want to write a new script for ghidra to extract variuous information from the binary and store it to an external file for future management. I need to perform the analyisis with Ghidra Headless in ...
2
votes
1answer
2k views

IDA Dump Memory

I am learning how to use IDC Scripting,or IDAPython in IDA for Reversing binary.One day i face this problem: You are given an array of random integer(4-byte integer) lies within the memory .The ...
2
votes
0answers
144 views

Restore function key

I have a simple function which looks like that: keyAlphabet = [-1, 16, 32, 127, 61, -32, -31, 43, 0, 88, 2, 5, 7, 112, 64, 69, 96] key = ??? # only keyAlphabet values p = 0x1337 for i in key: ...p*=i ...
2
votes
0answers
7k views

Plugin directory in IDA?

According to IDA docs, we can put a Python plugin into $HOME/.idapro/plugins/ directory. But when I copied my Python plugin there & restart IDA, IDA still do not see that. What can go wrong, and ...
2
votes
0answers
207 views

ResumeThread doesn't work after attaching to the process using vTrace

In an effort to learn vtrace I've been trying to attach to a process and hook the import address table and then resume the main thread of a process. When I don't attach to the process the ...
1
vote
2answers
2k views

How to decompile python 2.4 bytecode?

I need a good decompiler that can decompile python 2.4 byte code. I have looked over the internet and can only find python 2.5+ There are about a few hundred .pycs, so if it can decompile a directory ...
1
vote
3answers
106 views

How to input ascii control character into program?

I am working on a CTF where I need to pass an address as input to a program. This address contains the value 0x09 (the tab character). This is causing me problems, because it seems that bash is ...
1
vote
1answer
626 views

Reverse Python Bytecode

I try reverse python bytecode (Content in a .pyc file). I do not want to decompile the code, just understand the Python bytecode :) The LOAD_NAME statement, pushes the value associated with co_names (...
1
vote
2answers
423 views

What is a more efficient way to locate disasm patterns in IDAPython?

This is my first "serious" IDAPython script. As I sorta suspected, it's performing waaaayyyyy too slow so I wanted to ask for some pointers on this: fp = MinEA() end = MaxEA() while fp < end: ...
1
vote
1answer
2k views

Extract conditional instructions using IDA python in ARM binaries

While using IDA Python for extract ARM instructions, I noticed that some instructions are not extracted completely. For example, conditional instructions such as BCS or BCC are printed as B. For ...
1
vote
3answers
4k views

Python: Adding a asection to a PE file

I am working with PE binaries using Python and the pefile library. Its good for reading information out of a binary and rewriting certain bytes. If I wanted to add a section to the file then i am ...
1
vote
1answer
607 views

Ghidra python - get string x-refs in a binary

In Ghidra, there is Defined Strings window, that lists all the strings in the binary and their location. I want to access the strings from Ghidra Python, and to get all the x-refs to those strings. ...
1
vote
1answer
5k views

How to turn .pyd files generated by pyinstaller into source?

I have decompiled a pyinstaller exe and then decompiled the .pyc source inside it. only problem is the source is this import secretmodule secretmodule.main() Annoying, I know. i found secretmodule ...
1
vote
1answer
1k views

Buffer overflow: pwntools does not give me a shell, despite exploit working without pwntools

Recently, I've been trying to learn how to use the pwntools library. I am trying to exploit the following program using pwntools: #include <stdio.h> #include <stdlib.h> int main(void) { ...