15
votes
Accepted
Extracting arguments from IDA
I received an answer from HexRays support which has a solution which does not rely on parsing the C string retrieved by GetType(ea).
Let's imagine we start with a function prototype:
int __cdecl ...
- 2,279
15
votes
Reverse Engineering program written in Python, compiled with "freeze"
This is how you should proceed in such cases.
Step 1 : Load the executable in a debugger like Ollydbg.
Step 2 : In the memory dump window, navigate to PyImport_FrozenModules by pressing Ctrl + G
...
- 5,850
11
votes
Accepted
Good training for IDAPython
I wrote Sark to avoid this banging-head-against-wall routine. It provides wrappers around most of the commonly-used IDAPython APIs, making them more pythonic.
You can find the documentation for Sark ...
- 1,469
10
votes
Accepted
Run a python command with "run" on GDB
You do not have to use another file, it is just redundant
You can do this by using "Here strings".
In your example you can do :
r <<< $(python -c "print '\x90'*52")
You can read about "...
- 116
8
votes
How to decompile python 2.4 bytecode?
You just need to search online.
Anyways here are some python 2.4 decompilers worth trying,
decompyle - http://murphey.org/code/decompyle-2.4.tgz
pycdc - https://github.com/zrax/pycdc
depython - http:/...
- 5,850
8
votes
Accepted
idapython - Determine if item is code or data
IDA utilizes flags for checking the properties of locations.
Looking at the API you can use GetFlags(ea) and pass its output to isCode(flags) to check if a location is flagged as being code.
You can ...
- 2,806
8
votes
Best way to protect source code of .exe program running on Python?
There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose.
...
- 5,850
7
votes
Accepted
Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?
I'm not sure I fully understood you, but I'll give it a try anyway.
The following instructions will explain how to achieve something like this:|
radare2 comes with its own webserver. Although at ...
- 8,579
7
votes
Run a python command with "run" on GDB
I don't know of any way to run a script as a run argument.
A common solution is to redirect your input from a file.
You first need to run the script and save the result:
python -c "print 'A'*50" >...
- 693
6
votes
Python library for assembling x86, x64 and ARM exploits
Some Python assembler libraries:
Pyasm - Python x86 Assembler
Pyasm is a full-featured dynamic assembler written entirely in Python. By dynamic, it means that it can be used to generate and execute ...
- 5,850
6
votes
Getting user comments with IDAPython API (user_cmts_*)?
You might want to use the IDAPython wrapper functions. As you mentioned, the IDA API is quite poorly documented. One of the best, but not easiest way to actually understand it is to check the ...
- 397
6
votes
Accepted
Reverse engineering car stereo panel
The first step is to figure out the purpose of each of those pins. The easiest way to do this is to Google for the LAC-M3600R's service manual (note that this is different from the user manual). That ...
- 20.4k
6
votes
Is it possible to get a list of user-defined names in IDA?
The idautils.Names function might be of interest to you, as it returns a list of (ea, name) tuples for all names defined in the IDB and the ea at which they're located.
Additionally, you can use the ...
- 11.3k
5
votes
Accepted
Python library for assembling x86, x64 and ARM exploits
Take a look at Gallopsled's pwntools. Does all the things you want it to, and has most of it built in already.
https://github.com/Gallopsled/pwntools
For a few examples of it in use, I put up some ...
- 2,279
5
votes
Accepted
Which python library for parsing Linux ELF files?
Take a look at radare2. It can parse file formats (see here for an example of parsing the ELF header).
Radare2 supports multiple architectures and is being actively developed. On top of that it has ...
- 991
5
votes
What are the tools to analyze Python (obfuscated) bytecode?
A challenge in writing a tool to extract the control flow of python bytecode is that there are so many Python bytecodes versions to choose from, about 25 or so by now (if you include pypy variants).
...
- 193
5
votes
Accepted
Detecting weaknesses/vulnerabilities (in games). Scientific papers/Tutorials?
The approach to finding security vulnerabilities in games is no different than the approach to finding security vulnerabilities in other applications.
As discussed here, "Most vulnerabilities in ...
- 20.4k
5
votes
Accepted
Reimplementing the x86 AESENC instruction in python
Three problems:
mix_column returns _col (typo underscore?)
The return value of mix_columns just concatenates the columns together like rows instead of slotting them back into columns - effectively ...
- 861
5
votes
Accepted
Adding a toolbar to IDA using PySide
New IDA 6.95 API
Perhaps because they saw this question, maybe because of user requests, version 6.95 was released with two IDAPython API functions for creating a menu and a toolbar: create_menu and ...
- 11.3k
5
votes
Good training for IDAPython
Check out "The Beginner's Guide to IDAPython" by Alexander Hanel and his blog
and this by Ero Carrera
- 357
5
votes
Accepted
How to decompile with Hex Rays via a Python API?
Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler.
Originally, the Python bindings were written by EiNSTeiN around the Hex-Rays Decompiler SDK API. Later it has been ...
- 8,579
4
votes
IDA API - query number of parameters for cdecl functions
For cdecl the caller needs to clean up the stack. So somewhere after the function call there HAS to be a stack operation that removes the parameters from the stack (remove as in adjust the stack ...
- 260
4
votes
Accepted
Find register value of a remote process - pydbg
:\>cat memaccess.py
from pydbg import *
from pydbg.defines import *
def handler_breakpoint (pydbg):
if pydbg.first_breakpoint:
return DBG_CONTINUE
context = dbg.get_thread_context(dbg....
- 14.8k
4
votes
Decompiling .pyc files
I, of course, use uncompyle6. Disclaimer: I work on this project.
I've written at length about the uncompyle6 and pycdc here.
- 193
4
votes
Accepted
How can I get the shared libraries' function calls using angr
However I don't know how to get the function calls from the nodes
Are you saying you want to know which function a node belongs to, or which function a node is calling?
For the former, each block ...
- 184
4
votes
Volatility - manually inspect heap of a process
So your question is somewhat vague. However, even without providing additional information of your target system, version and used profile, I try to give an introductive answer for Windows systems.
...
- 1,227
4
votes
Accepted
How can I reverse this recursive function?
I gave it a go. First I simplified your code a little bit.
def the_process(stored, inp, size):
global thstr
idx = 0
idx = stored.index(inp[0])
if idx:
the_process(stored[:idx],...
- 2,345
4
votes
The structure of the Python's marshaled code object (or .pyc file)
The answer below is with reference to Python 2.7
How the Virtual Machine will found the baz code object? I can't see all this information: 0x7f380995e5d0, file "foo.py", line 7 in the marshaled ...
- 5,850
4
votes
Accepted
Reverse Python Bytecode
You can use the marshal module to load the code object.
Now, suppose you want to find out what does LOAD_NAME 1 loads on the evaluation stack.
import marshal
co = marshal.load(...)
print co....
- 5,850
4
votes
Accepted
ghidra-python: create struct with big endian field
The following script shows hows to create a structure and set its field to Big Endian byte order using the Ghidra Python API.
from ghidra.program.model.data import DataTypeConflictHandler
from ...
- 5,850
Only top scored, non community-wiki answers of a minimum length are eligible