5
votes
Accepted
How to automatically rename some IDA functions from a given list?
This way to automate things called IDAPython, its documentation is here:
1 - Save this script somewhere, remember where.
#Not used, not debbugged, not ran even once
#Use on your own risk, beware ...
- 8,353
5
votes
Accepted
Automating bypassing anti-debug checks
What you could do:
With each found anti-debug, patch the exe with the bypass and continue with the patched one.
If your debugger is scriptable (like e.g. Ida) run it under the script, insert ...
- 1,964
5
votes
How to identify code ran when clicking on an object in a game
On windows you can
find winproc function, search click messages within it and add breakpoint/trace from there...
On different OS
trace mouse handlers ...
If OpenGL is used
The Object selection is ...
- 1,384
3
votes
Accepted
J1939 message payload checksum
Found the calculation in a newer version of the J1939 standard than I originally had access to. The manufacturer reused the following equation from SPN 4207:
Checksum =
(Byte1 + Byte2 + Byte3 + Byte4 ...
- 51
3
votes
Accepted
Automated instruction analysis of dynamic memory
Sounds like you want dynamic taint analysis. There is a well-supported, open-source option called Panda. If you have money to spend, check out the commercial offering Reven.
- 9,088
2
votes
Automating bypassing anti-debug checks
You don't need any external plugin, this is already a builtin feature in x64dbg:
- 89
2
votes
How to create empty IDB file with IDApython?
It seems that there is no API for creating an empty IDB. However, you can use the command line switches to start IDA with an empty IDB like so:
idaq.exe -t -p<ProcessorName> <IdbPath>
...
- 1,557
2
votes
How to identify code ran when clicking on an object in a game
An effective method in these cases (although not necessarily straightforward) is to use differential debugging.
The core principle is to run the application twice and record traces of the functions ...
- 1,041
1
vote
Accepted
IDApython - Turning a modified operand into a string reference
Well, I managed to do it with the add_dref() function:
add_dref(frm, to, type)
Create a data cross-reference.
Parameters:
to - linear address of referenced data (C++: ea_t)
type - cross-...
- 709
1
vote
Review a collection of executable binaries to determine similarity
I have done some academic research in the field of malware classification. It is not an easy task, and I don't know what similarity you are looking for, but I can list mostly used static features for ...
1
vote
Accepted
x64dbgpy: application unresponsive when trying to automate inside breakpoint callback
Currently it is not supported to do debug automation in callbacks. This is related to the threading model and is further explained at https://x64dbg.com/blog/2016/10/20/threading-model.html, which ...
- 1,652
1
vote
Automatically detecting and carving images from .doc, .docx and spreadsheets
If I understand you correctly then for what you want to achieve you dont need any tools as word files are just archives. You can use your favourite unzip program and then you can find images in \word\...
- 216
1
vote
(MacOS) disable codesign check / run codesign on multiple files
after some trial and error i managed to solve it easily with the following command in terminal
find . -name "*.bundle" -execdir sudo codesign -f -s - {} \;
find . -name "*.EXTENSION" is ...
- 41
1
vote
Automating a crackme solving process
If the number of instructions executed is proportional to the number of characters correct (i.e, maybe it's a simple byte-by-byte strcmp), then you could use instrumentation tools like Pintool to ...
- 96
1
vote
Automating a crackme solving process
windbg in windows and gdb in linux both are capable of executing scripts to automate tasks
what you ask should be doable fairly easily in both of the debuggers
here is a demeo for windbg
source ...
- 16.2k
Only top scored, non community-wiki answers of a minimum length are eligible