Hot answers tagged

12 votes
Accepted

Good training for IDAPython

I wrote Sark to avoid this banging-head-against-wall routine. It provides wrappers around most of the commonly-used IDAPython APIs, making them more pythonic. You can find the documentation for Sark ...
tmr232's user avatar
  • 1,557
10 votes
Accepted

Run a python command with "run" on GDB

You do not have to use another file, it is just redundant You can do this by using "Here strings". In your example you can do : r <<< $(python -c "print '\x90'*52") You can read about "...
yehuda corsia's user avatar
8 votes
Accepted

idapython - Determine if item is code or data

IDA utilizes flags for checking the properties of locations. Looking at the API you can use GetFlags(ea) and pass its output to isCode(flags) to check if a location is flagged as being code. You can ...
Nordwald's user avatar
  • 2,896
8 votes

Best way to protect source code of .exe program running on Python?

There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose. ...
0xec's user avatar
  • 6,030
7 votes
Accepted

Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?

I'm not sure I fully understood you, but I'll give it a try anyway. The following instructions will explain how to achieve something like this:| radare2 comes with its own webserver. Although at ...
Megabeets's user avatar
  • 8,909
6 votes
Accepted

Reimplementing the x86 AESENC instruction in python

Three problems: mix_column returns _col (typo underscore?) The return value of mix_columns just concatenates the columns together like rows instead of slotting them back into columns - effectively ...
booto's user avatar
  • 901
6 votes

Good training for IDAPython

Check out "The Beginner's Guide to IDAPython" by Alexander Hanel and his blog and this by Ero Carrera
krusty's user avatar
  • 367
6 votes

Getting user comments with IDAPython API (user_cmts_*)?

You might want to use the IDAPython wrapper functions. As you mentioned, the IDA API is quite poorly documented. One of the best, but not easiest way to actually understand it is to check the ...
InfectedPacket's user avatar
6 votes
Accepted

Reverse engineering car stereo panel

The first step is to figure out the purpose of each of those pins. The easiest way to do this is to Google for the LAC-M3600R's service manual (note that this is different from the user manual). That ...
Jason Geffner's user avatar
6 votes

Is it possible to get a list of user-defined names in IDA?

The idautils.Names function might be of interest to you, as it returns a list of (ea, name) tuples for all names defined in the IDB and the ea at which they're located. Additionally, you can use the ...
NirIzr's user avatar
  • 11.7k
6 votes
Accepted

ghidra-python: create struct with big endian field

The following script shows hows to create a structure and set its field to Big Endian byte order using the Ghidra Python API. from ghidra.program.model.data import DataTypeConflictHandler from ...
0xec's user avatar
  • 6,030
5 votes
Accepted

Adding a toolbar to IDA using PySide

New IDA 6.95 API Perhaps because they saw this question, maybe because of user requests, version 6.95 was released with two IDAPython API functions for creating a menu and a toolbar: create_menu and ...
NirIzr's user avatar
  • 11.7k
5 votes

What are the tools to analyze Python (obfuscated) bytecode?

A challenge in writing a tool to extract the control flow of python bytecode is that there are so many Python bytecodes versions to choose from, about 25 or so by now (if you include pypy variants). ...
rocky's user avatar
  • 213
5 votes
Accepted

How can I get the shared libraries' function calls using angr

However I don't know how to get the function calls from the nodes Are you saying you want to know which function a node belongs to, or which function a node is calling? For the former, each block ...
Fish's user avatar
  • 194
5 votes
Accepted

How to decompile with Hex Rays via a Python API?

Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler. Originally, the Python bindings were written by EiNSTeiN around the Hex-Rays Decompiler SDK API. Later it has been ...
Megabeets's user avatar
  • 8,909
4 votes

Decompiling .pyc files

I, of course, use uncompyle6. Disclaimer: I work on this project. I've written at length about the uncompyle6 and pycdc here.
rocky's user avatar
  • 213
4 votes

Volatility - manually inspect heap of a process

So your question is somewhat vague. However, even without providing additional information of your target system, version and used profile, I try to give an introductive answer for Windows systems. ...
knx's user avatar
  • 1,257
4 votes
Accepted

How can I reverse this recursive function?

I gave it a go. First I simplified your code a little bit. def the_process(stored, inp, size): global thstr idx = 0 idx = stored.index(inp[0]) if idx: the_process(stored[:idx],...
sudhackar's user avatar
  • 2,584
4 votes

The structure of the Python's marshaled code object (or .pyc file)

The answer below is with reference to Python 2.7 How the Virtual Machine will found the baz code object? I can't see all this information: 0x7f380995e5d0, file "foo.py", line 7 in the marshaled ...
0xec's user avatar
  • 6,030
4 votes
Accepted

Reverse Python Bytecode

You can use the marshal module to load the code object. Now, suppose you want to find out what does LOAD_NAME 1 loads on the evaluation stack. import marshal co = marshal.load(...) print co....
0xec's user avatar
  • 6,030
4 votes

Sharing variable between scripts

if I understand the question correctly, then analyzeHeadless documentation will help you. Headless Scripts: Passing Values Between Scripts If you are running multiple scripts in headless operation ...
R4444's user avatar
  • 1,767
4 votes

How to highlight all external registers in a function

The answer to this question is to simply use Hex-Rays instead of IDA. It automatically does everything you've suggested, and the end result is the function's prototype, which will indicate register ...
Rolf Rolles's user avatar
  • 9,088
3 votes

idapython - Determine if item is code or data

Additionally, you can use Sark to get it done: import sark # For current line sark.Line().is_code # For specific line sark.Line(ea).is_code Note: I am the creator of Sark.
tmr232's user avatar
  • 1,557
3 votes
Accepted

Get DLL name with PyDBG and System_dll.py?

:>type ENUMMODS.PY import sys from pydbg import * for modules in pydbg().attach(int(sys.argv[1])).enumerate_modules(): print modules pydbg().detach() :>ENUMMODS.PY ('calc.exe', 12517376L) (...
blabb's user avatar
  • 16.2k
3 votes

What are the tools to analyze Python (obfuscated) bytecode?

The Flare-bytecode graph project can help with graphical bytecode CFG representation. Taken from the project README: ... It is also possible to create control flow diagrams using GraphViz. The ...
MaciejTe's user avatar
3 votes

Is it possible to get a list of user-defined names in IDA?

You can use View->Open subview->Names or Shift-F4. Note that the list included all names, both user-defined as well as generated by IDA (e.g. ASCII string names). See also related Get a list of ...
Igor Skochinsky's user avatar
  • 36.2k
3 votes
Accepted

Deducing Protobuf Schema and Datatypes

I suspect these are IEEE doubles. For example, 0x3fd3333333333333 is 2.99999999999999988897769753748E-1, or around 0.3. I used this converter to check
Igor Skochinsky's user avatar
  • 36.2k
3 votes
Accepted

Extract conditional instructions using IDA python in ARM binaries

I was able to reproduce your problem on IDA 6.95 but it seems like this bug was fixed in IDA 7 since it works for me just fine. The solution below will be relevant to IDA 6.95 though it would probably ...
Megabeets's user avatar
  • 8,909
3 votes

Reverse engineering USB peripheral driver

Well, your question is a bit broad as it stands, but let's take it one by one. Typically (but not always) drivers for printers these days are user mode drivers (UMDF), which means you're looking for a ...

Only top scored, non community-wiki answers of a minimum length are eligible