5 votes
Accepted

Automating bypassing anti-debug checks

What you could do: With each found anti-debug, patch the exe with the bypass and continue with the patched one. If your debugger is scriptable (like e.g. Ida) run it under the script, insert ...
user avatar
  • 1,814
5 votes

How to identify code ran when clicking on an object in a game

On windows you can find winproc function, search click messages within it and add breakpoint/trace from there... On different OS trace mouse handlers ... If OpenGL is used The Object selection is ...
user avatar
  • 1,374
5 votes
Accepted

How to automatically rename some IDA functions from a given list?

This way to automate things called IDAPython, its documentation is here: 1 - Save this script somewhere, remember where. #Not used, not debbugged, not ran even once #Use on your own risk, beware ...
user avatar
  • 7,875
3 votes
Accepted

Automated instruction analysis of dynamic memory

Sounds like you want dynamic taint analysis. There is a well-supported, open-source option called Panda. If you have money to spend, check out the commercial offering Reven.
user avatar
  • 7,879
2 votes

Automating bypassing anti-debug checks

You don't need any external plugin, this is already a builtin feature in x64dbg:
user avatar
  • 89
2 votes

How to create empty IDB file with IDApython?

It seems that there is no API for creating an empty IDB. However, you can use the command line switches to start IDA with an empty IDB like so: idaq.exe -t -p<ProcessorName> <IdbPath> ...
user avatar
  • 1,479
2 votes

How to identify code ran when clicking on an object in a game

An effective method in these cases (although not necessarily straightforward) is to use differential debugging. The core principle is to run the application twice and record traces of the functions ...
user avatar
2 votes

IDAPython load PDB-file of analysed binary

According to the SDK, the PDB loader is implemented as an IDA plugin (see the SDK, e.g: \idasdk67\plugins\pdb). The plugin name is "pdb", so you can call the plugin directly, like this: idaapi....
user avatar
  • 402
2 votes
Accepted

Using an existing IDB from IDA command line interface

My current command: idaw.exe -c -A -SC:\someScript.py Remove the -c and add the existing IDB file's path: idaw.exe -A -SC:\someScript.py C:\existingIdb.idb
user avatar
1 vote
Accepted

IDApython - Turning a modified operand into a string reference

Well, I managed to do it with the add_dref() function: add_dref(frm, to, type) Create a data cross-reference. Parameters: to - linear address of referenced data (C++: ea_t) type - cross-...
user avatar
  • 629
1 vote
Accepted

x64dbgpy: application unresponsive when trying to automate inside breakpoint callback

Currently it is not supported to do debug automation in callbacks. This is related to the threading model and is further explained at https://x64dbg.com/blog/2016/10/20/threading-model.html, which ...
user avatar
  • 1,602
1 vote

Automatically detecting and carving images from .doc, .docx and spreadsheets

If I understand you correctly then for what you want to achieve you dont need any tools as word files are just archives. You can use your favourite unzip program and then you can find images in \word\...
user avatar
1 vote

(MacOS) disable codesign check / run codesign on multiple files

after some trial and error i managed to solve it easily with the following command in terminal find . -name "*.bundle" -execdir sudo codesign -f -s - {} \; find . -name "*.EXTENSION" is ...
user avatar
  • 41
1 vote

Automating a crackme solving process

If the number of instructions executed is proportional to the number of characters correct (i.e, maybe it's a simple byte-by-byte strcmp), then you could use instrumentation tools like Pintool to ...
user avatar
1 vote

Automating a crackme solving process

windbg in windows and gdb in linux both are capable of executing scripts to automate tasks what you ask should be doable fairly easily in both of the debuggers here is a demeo for windbg source ...
user avatar
  • 15k

Only top scored, non community-wiki answers of a minimum length are eligible