Hot answers tagged

15 votes
Accepted

Extracting arguments from IDA

I received an answer from HexRays support which has a solution which does not rely on parsing the C string retrieved by GetType(ea). Let's imagine we start with a function prototype: int __cdecl ...
user avatar
  • 2,279
15 votes

Reverse Engineering program written in Python, compiled with "freeze"

This is how you should proceed in such cases. Step 1 : Load the executable in a debugger like Ollydbg. Step 2 : In the memory dump window, navigate to PyImport_FrozenModules by pressing Ctrl + G ...
user avatar
  • 5,850
11 votes
Accepted

Good training for IDAPython

I wrote Sark to avoid this banging-head-against-wall routine. It provides wrappers around most of the commonly-used IDAPython APIs, making them more pythonic. You can find the documentation for Sark ...
user avatar
  • 1,469
10 votes
Accepted

Run a python command with "run" on GDB

You do not have to use another file, it is just redundant You can do this by using "Here strings". In your example you can do : r <<< $(python -c "print '\x90'*52") You can read about "...
user avatar
8 votes

How to decompile python 2.4 bytecode?

You just need to search online. Anyways here are some python 2.4 decompilers worth trying, decompyle - http://murphey.org/code/decompyle-2.4.tgz pycdc - https://github.com/zrax/pycdc depython - http:/...
user avatar
  • 5,850
8 votes
Accepted

idapython - Determine if item is code or data

IDA utilizes flags for checking the properties of locations. Looking at the API you can use GetFlags(ea) and pass its output to isCode(flags) to check if a location is flagged as being code. You can ...
user avatar
  • 2,806
8 votes

Best way to protect source code of .exe program running on Python?

There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose. ...
user avatar
  • 5,850
7 votes
Accepted

Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?

I'm not sure I fully understood you, but I'll give it a try anyway. The following instructions will explain how to achieve something like this:| radare2 comes with its own webserver. Although at ...
user avatar
  • 8,579
7 votes

Run a python command with "run" on GDB

I don't know of any way to run a script as a run argument. A common solution is to redirect your input from a file. You first need to run the script and save the result: python -c "print 'A'*50" >...
user avatar
  • 693
6 votes

Python library for assembling x86, x64 and ARM exploits

Some Python assembler libraries: Pyasm - Python x86 Assembler Pyasm is a full-featured dynamic assembler written entirely in Python. By dynamic, it means that it can be used to generate and execute ...
user avatar
  • 5,850
6 votes

Getting user comments with IDAPython API (user_cmts_*)?

You might want to use the IDAPython wrapper functions. As you mentioned, the IDA API is quite poorly documented. One of the best, but not easiest way to actually understand it is to check the ...
user avatar
6 votes
Accepted

Reverse engineering car stereo panel

The first step is to figure out the purpose of each of those pins. The easiest way to do this is to Google for the LAC-M3600R's service manual (note that this is different from the user manual). That ...
user avatar
6 votes

Is it possible to get a list of user-defined names in IDA?

The idautils.Names function might be of interest to you, as it returns a list of (ea, name) tuples for all names defined in the IDB and the ea at which they're located. Additionally, you can use the ...
user avatar
  • 11.3k
5 votes
Accepted

Python library for assembling x86, x64 and ARM exploits

Take a look at Gallopsled's pwntools. Does all the things you want it to, and has most of it built in already. https://github.com/Gallopsled/pwntools For a few examples of it in use, I put up some ...
user avatar
  • 2,279
5 votes
Accepted

Which python library for parsing Linux ELF files?

Take a look at radare2. It can parse file formats (see here for an example of parsing the ELF header). Radare2 supports multiple architectures and is being actively developed. On top of that it has ...
user avatar
5 votes

What are the tools to analyze Python (obfuscated) bytecode?

A challenge in writing a tool to extract the control flow of python bytecode is that there are so many Python bytecodes versions to choose from, about 25 or so by now (if you include pypy variants). ...
user avatar
  • 193
5 votes
Accepted

Detecting weaknesses/vulnerabilities (in games). Scientific papers/Tutorials?

The approach to finding security vulnerabilities in games is no different than the approach to finding security vulnerabilities in other applications. As discussed here, "Most vulnerabilities in ...
user avatar
5 votes
Accepted

Reimplementing the x86 AESENC instruction in python

Three problems: mix_column returns _col (typo underscore?) The return value of mix_columns just concatenates the columns together like rows instead of slotting them back into columns - effectively ...
user avatar
  • 861
5 votes
Accepted

Adding a toolbar to IDA using PySide

New IDA 6.95 API Perhaps because they saw this question, maybe because of user requests, version 6.95 was released with two IDAPython API functions for creating a menu and a toolbar: create_menu and ...
user avatar
  • 11.3k
5 votes

Good training for IDAPython

Check out "The Beginner's Guide to IDAPython" by Alexander Hanel and his blog and this by Ero Carrera
user avatar
  • 357
5 votes
Accepted

How to decompile with Hex Rays via a Python API?

Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler. Originally, the Python bindings were written by EiNSTeiN around the Hex-Rays Decompiler SDK API. Later it has been ...
user avatar
  • 8,579
4 votes

IDA API - query number of parameters for cdecl functions

For cdecl the caller needs to clean up the stack. So somewhere after the function call there HAS to be a stack operation that removes the parameters from the stack (remove as in adjust the stack ...
user avatar
  • 260
4 votes
Accepted

Find register value of a remote process - pydbg

:\>cat memaccess.py from pydbg import * from pydbg.defines import * def handler_breakpoint (pydbg): if pydbg.first_breakpoint: return DBG_CONTINUE context = dbg.get_thread_context(dbg....
user avatar
  • 14.8k
4 votes

Decompiling .pyc files

I, of course, use uncompyle6. Disclaimer: I work on this project. I've written at length about the uncompyle6 and pycdc here.
user avatar
  • 193
4 votes
Accepted

How can I get the shared libraries' function calls using angr

However I don't know how to get the function calls from the nodes Are you saying you want to know which function a node belongs to, or which function a node is calling? For the former, each block ...
user avatar
  • 184
4 votes

Volatility - manually inspect heap of a process

So your question is somewhat vague. However, even without providing additional information of your target system, version and used profile, I try to give an introductive answer for Windows systems. ...
user avatar
  • 1,227
4 votes
Accepted

How can I reverse this recursive function?

I gave it a go. First I simplified your code a little bit. def the_process(stored, inp, size): global thstr idx = 0 idx = stored.index(inp[0]) if idx: the_process(stored[:idx],...
user avatar
  • 2,345
4 votes

The structure of the Python's marshaled code object (or .pyc file)

The answer below is with reference to Python 2.7 How the Virtual Machine will found the baz code object? I can't see all this information: 0x7f380995e5d0, file "foo.py", line 7 in the marshaled ...
user avatar
  • 5,850
4 votes
Accepted

Reverse Python Bytecode

You can use the marshal module to load the code object. Now, suppose you want to find out what does LOAD_NAME 1 loads on the evaluation stack. import marshal co = marshal.load(...) print co....
user avatar
  • 5,850
4 votes
Accepted

ghidra-python: create struct with big endian field

The following script shows hows to create a structure and set its field to Big Endian byte order using the Ghidra Python API. from ghidra.program.model.data import DataTypeConflictHandler from ...
user avatar
  • 5,850

Only top scored, non community-wiki answers of a minimum length are eligible