15

I lack 9 reputation points, so sadly I can't comment the great answer by w_s. ;) Just for completeness, the concept described is known in graph theory as "Tarjan's Algorithm" for finding strongly connected components. Wikipedia has a nice animation that helps following the steps. For study, here is another (more formal) Python implementation, it's the ...


12

It is not trivial task. You can do it relatively easy if you not taking in account indirect calls (for example such as virtual functions in C++) and calls from another function like this: int f() { g(); } int g() { f(); } It can be much more complicated if one of your functions is in another binary (dll for example). So, there are two ways to do ...


5

On windows you can find winproc function, search click messages within it and add breakpoint/trace from there... On different OS trace mouse handlers ... If OpenGL is used The Object selection is often done by it directly during rendering. You can trace calls to those functions used. If any framework is used learn what function for mouse it has and trace ...


5

This way to automate things called IDAPython, its documentation is here: 1 - Save this script somewhere, remember where. #Not used, not debbugged, not ran even once #Use on your own risk, beware errors import idaapi import idautils import idc def do_rename(l): splitted = l.split() straddr = splitted[0] strname = splitted[1].replace("\r", "")....


4

I wish I had an easy way to help you. When I did something similar previously, I used distorm and pefile. Basically, the approach I took in my code (and it, admittedly, wasn't a great one) was to: Walk the IAT of the executable to locate the function(s) of interest. Perform a recursive-descent disassembly of the executable looking for calls to that ...


2

An effective method in these cases (although not necessarily straightforward) is to use differential debugging. The core principle is to run the application twice and record traces of the functions being executed, or even basic blocks if you need to get so granular. The idea boils down to: The first time you record a trace try to exercise as much ...


2

According to the SDK, the PDB loader is implemented as an IDA plugin (see the SDK, e.g: \idasdk67\plugins\pdb). The plugin name is "pdb", so you can call the plugin directly, like this: idaapi.load_and_run_plugin("pdb", call_code) Where call_code is an enum defined in \idasdk67\plugins\pdb\common.h, 0, 1 and 2 are already defined and will ask for user ...


2

My current command: idaw.exe -c -A -SC:\someScript.py Remove the -c and add the existing IDB file's path: idaw.exe -A -SC:\someScript.py C:\existingIdb.idb


2

What you could do: With each found anti-debug, patch the exe with the bypass and continue with the patched one. If your debugger is scriptable (like e.g. Ida) run it under the script, insert breakpoints in your script and bypass the anti-debug in your script. This is a particularly useful in "dynamic" anti-debug cases where static patching is not possible ...


1

It seems that there is no API for creating an empty IDB. However, you can use the command line switches to start IDA with an empty IDB like so: idaq.exe -t -p<ProcessorName> <IdbPath> This will launch IDA with a new, empty IDB.


1

Currently it is not supported to do debug automation in callbacks. This is related to the threading model and is further explained at https://x64dbg.com/blog/2016/10/20/threading-model.html, which links to some older resources. Recently there was an interesting development though, because it became possible to automate in the debug callbacks with x64dbg’s ...


1

If I understand you correctly then for what you want to achieve you dont need any tools as word files are just archives. You can use your favourite unzip program and then you can find images in \word\media folder. I dont know python but should be simple to unzip files and search for image files.


1

after some trial and error i managed to solve it easily with the following command in terminal find . -name "*.bundle" -execdir sudo codesign -f -s - {} \; find . -name "*.EXTENSION" is responsible for finding the certain file extension in a directory -execdir YOUR COMMAND {} \; is responsible to executing the command. using -execdir -> on the ...


1

If the number of instructions executed is proportional to the number of characters correct (i.e, maybe it's a simple byte-by-byte strcmp), then you could use instrumentation tools like Pintool to count the number of instructions executed, and use that to brute-force the password byte-by-byte. Here's an example of that.


1

windbg in windows and gdb in linux both are capable of executing scripts to automate tasks what you ask should be doable fairly easily in both of the debuggers here is a demeo for windbg source for a simple crackme that takes a password :\>cat simcram.cpp #include <stdio.h> #include <string.h> #include <stdlib.h> int checkpass(...


1

I finally managed to modify LC_ENCRYPTION_INFO as fellow and it works! http://www.infointox.net/?p=114 Just be sure for multiple architectures, choose correct bytes to filp.


Only top voted, non community-wiki answers of a minimum length are eligible