15
This is how you should proceed in such cases.
Step 1 : Load the executable in a debugger like Ollydbg.
Step 2 : In the memory dump window, navigate to PyImport_FrozenModules by pressing Ctrl + G
Step 3 : PyImport_FrozenModules is a pointer which is initialized to point to an array of struct _frozen records. Follow this pointer in dump.
Step 4 : Now you ...
15
I received an answer from HexRays support which has a solution which does not rely on parsing the C string retrieved by GetType(ea).
Let's imagine we start with a function prototype:
int __cdecl main(int argc, const char **argv, const char **envp)
That's from an ELF file, x86 abi; stuff is passed on the stack.
Then, I can do the following:
Python>...
11
I wrote Sark to avoid this banging-head-against-wall routine. It provides wrappers around most of the commonly-used IDAPython APIs, making them more pythonic.
You can find the documentation for Sark here on Read-The-Docs.
As mentioned before by @CrazyFrog, you can use:
Alexander Hanel's book and blog;
Ero Carrera's Intro to IDAPyton;
Additionally, there ...
10
Slightly modified version from pydasm's README.txt
import pydasm
import binascii
# Open, and read 200 bytes out of the file,
# while converting buffer to hex string
with open('file.bin','r') as f:
buffer = binascii.hexlify(f.read(200))
# Iterate through the buffer and disassemble
offset = 0
while offset < len(buffer):
i = pydasm.get_instruction(...
10
Maynard is a (dis)assembler for Python byte code written by a member of Python core and the release manager for Python 3.4. Reading material here and here. I'm not aware of a public tool (besides the one you linked) that can do CFG visualization like that, but you certainly could build one on top of Maynard.
10
You do not have to use another file, it is just redundant
You can do this by using "Here strings".
In your example you can do :
r <<< $(python -c "print '\x90'*52")
You can read about "Here strings" here
9
There are several tools dedicated to Python's bytecode reversing:
Uncompyle and Uncompyle2
'uncompyle' converts Python byte-code back into equivalent Python
source. It accepts byte-code from Python version 2.7 only. The generated source is very readable: docstrings, lists, tuples and hashes get pretty-printed.
'uncompyle' may also verify the ...
8
While in IDA's Hex View you can go to Edit->Patch Program->Change Byte, but I think this only lets you patch 16 bytes at a time. If you need to patch more bytes than that you can use IDAPython's idc.PatchByte / idc.PatchWord / idc.PatchDword to change bytes in the IDA database.
EDIT:
Just a quick note, if you want your patches applied to the original file ...
8
You can do this. Last summer I worked with Hexrays and WingIDE guys and got this working. In fact its in the docs!
http://wingware.com/doc/howtos/idapython
It rocks.
Riley
8
You just need to search online.
Anyways here are some python 2.4 decompilers worth trying,
decompyle - http://murphey.org/code/decompyle-2.4.tgz
pycdc - https://github.com/zrax/pycdc
depython - http://depython.com/
decompyle service - http://www.crazy-compilers.com/decompyle/
Python-Decompiler - https://gitorious.org/python-decompiler
Note : Easy Python ...
8
IDA utilizes flags for checking the properties of locations.
Looking at the API you can use GetFlags(ea) and pass its output to isCode(flags) to check if a location is flagged as being code.
You can find the exact definitions of the flags in IDC.IDC. A small excerpt:
#define isCode(F) ((F & MS_CLS) == FF_CODE) // is code byte?
#define isData(F) ...
8
There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose.
The way Python works is fully documented and open-source. For instance, consider the pyc file format. Much of the code which deals with reading/writing pyc's ...
7
You cannot prevent reverse engineering. You can make it more or less harder but you cannot prevent it. No.
Update
Ok, as the author updated it with a more clearer question... this is what one can do:
Strip symbols from the binaries. At the very least.
Obfuscate the code. This may help: https://stackoverflow.com/questions/4111808/c-c-compiler-generating-...
7
I'm not sure I fully understood you, but I'll give it a try anyway.
The following instructions will explain how to achieve something like this:|
radare2 comes with its own webserver. Although at first, it might seems like an overkill, its actually quite useful, especially when you want to debug embedded systems, or simply to execute commands from a remote ...
7
I don't know of any way to run a script as a run argument.
A common solution is to redirect your input from a file.
You first need to run the script and save the result:
python -c "print 'A'*50" > my_file
and redirect it to gdb run.
r < my_file
also, from the help run command:
Input and output redirection with ">", "<", or ">>" are also ...
6
pyREtic from Immunity Sec can also provide some help in looking into original source code and perform modifications as well.
You may be interested in review the capabilities of the tool in this document:
"pyREtic, In memory reverse engineering for obfuscated Python bytecode" by Rich Smith [PDF]
6
FastLogHook is one of the 13 hook types that Immunity Debugger comes with. Essentially, the purpose of this type of hook is to use tiny assembly stub to transfer execution to a hook function in order to log particular registers and/or memory locations. FastLogHook is essentially an python object, which allows us to setup hard hook relatively easy.
The ...
6
Don't rely on the IAT entry in the PE Data Directory to be accurate. The only truly accurate way to find the IAT(s) is to find actual calls from the disassembled code to statically imported API functions.
Let's use the following code in IDA as an example:
FF 15 44 60 03 01 call ds:GetVersion
The actual disassembly of FF 15 44 60 03 01 is call dword ...
6
Some Python assembler libraries:
Pyasm - Python x86 Assembler
Pyasm is a full-featured dynamic assembler written entirely in Python. By dynamic, it means that it can be used to generate and execute machine code in python at runtime without requiring the generation of object files and linkage. It essentially allow 'inline' assembly in Python modules on x86 ...
6
You might want to use the IDAPython wrapper functions. As you mentioned, the IDA API is quite poorly documented. One of the best, but not easiest way to actually understand it is to check the IDAPython wrapper library in your IDA/Python/idc.py folder.
Based on what I've seen in the idc.py file, there's some functions you might want to check out to help you ...
6
The first step is to figure out the purpose of each of those pins. The easiest way to do this is to Google for the LAC-M3600R's service manual (note that this is different from the user manual). That device's service manual contains the following diagram for the back of the faceplate:
As you can see above, the pins are (beginning from top-right, moving ...
6
The idautils.Names function might be of interest to you, as it returns a list of (ea, name) tuples for all names defined in the IDB and the ea at which they're located.
Additionally, you can use the answer to the question Igor linked (Get a list of global variables with IDA python) to get a list of all functions.
Once you have the eas you can do the ...
5
You should rather ask your questions with some kind of example output so that answers are not based on guesswork.
Does iam loading the struct mean
I wrote a program where I am employing OpenProcess() ReadProcessMemory()
or does it mean
i am opening the raw file with FILE * fp ; fopen("c:\XXX","wb") fread(fp); or load it in say ollydbg or in a ...
5
You need to check the PE headers of the modules, the offset is dependent on the OS version (the settings can be different for the executable and each loaded DLL). You can look at the mona.py script for examples on how to do that. The script is very large but you should find what you are looking for in the class MnModule, for example the flag for ALSR is ...
5
I will assume you are talking about Windows Sockets and IPv4, since you have not mentioned otherwise. sockaddr is very well described in MSDN. It is defined as for IPv4 as follows:
struct sockaddr {
ushort sa_family;
char sa_data[14];
};
struct sockaddr_in {
short sin_family;
u_short sin_port;
struct in_addr ...
5
A challenge in writing a tool to extract the control flow of python bytecode is that there are so many Python bytecodes versions to choose from, about 25 or so by now (if you include pypy variants).
The bytecode in the example graph with its JUMP_IF_FALSE followed by some POP_TOPs and PRINT_NEWLINE instruction, reflect Python before 2.7.
However the ...
5
Take a look at Gallopsled's pwntools. Does all the things you want it to, and has most of it built in already.
https://github.com/Gallopsled/pwntools
For a few examples of it in use, I put up some writeups from Codegate 2013 and the pwnies do their own writeups as well.
Here's a quick example of "I want to dup file descriptor #4 (e.g. a connected TCP ...
5
The approach to finding security vulnerabilities in games is no different than the approach to finding security vulnerabilities in other applications.
As discussed here, "Most vulnerabilities in closed-source products are found via fuzzing and static reverse engineering... Typically you don't need to analyze the entire program, but only the entrypoints for ...
5
Three problems:
mix_column returns _col (typo underscore?)
The return value of mix_columns just concatenates the columns together like rows instead of slotting them back into columns - effectively transposing the result.
AESENC takes its parameters and returns its results as columns concatenated together. Your aesenc takes the parameters and returns the ...
5
New IDA 6.95 API
Perhaps because they saw this question, maybe because of user requests, version 6.95 was released with two IDAPython API functions for creating a menu and a toolbar: create_menu and create_toolbar so now these can be done trivially.
Old trick - Before 6.95
A hack I've been using is finding the application's main window manually and then ...
Only top voted, non community-wiki answers of a minimum length are eligible
