12
votes
Accepted
Good training for IDAPython
I wrote Sark to avoid this banging-head-against-wall routine. It provides wrappers around most of the commonly-used IDAPython APIs, making them more pythonic.
You can find the documentation for Sark ...
- 1,557
10
votes
Accepted
Run a python command with "run" on GDB
You do not have to use another file, it is just redundant
You can do this by using "Here strings".
In your example you can do :
r <<< $(python -c "print '\x90'*52")
You can read about "...
- 216
8
votes
Accepted
idapython - Determine if item is code or data
IDA utilizes flags for checking the properties of locations.
Looking at the API you can use GetFlags(ea) and pass its output to isCode(flags) to check if a location is flagged as being code.
You can ...
- 2,896
8
votes
Best way to protect source code of .exe program running on Python?
There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose.
...
- 6,030
7
votes
Accepted
Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?
I'm not sure I fully understood you, but I'll give it a try anyway.
The following instructions will explain how to achieve something like this:|
radare2 comes with its own webserver. Although at ...
- 8,909
6
votes
Accepted
Reimplementing the x86 AESENC instruction in python
Three problems:
mix_column returns _col (typo underscore?)
The return value of mix_columns just concatenates the columns together like rows instead of slotting them back into columns - effectively ...
- 901
6
votes
Good training for IDAPython
Check out "The Beginner's Guide to IDAPython" by Alexander Hanel and his blog
and this by Ero Carrera
- 367
6
votes
Getting user comments with IDAPython API (user_cmts_*)?
You might want to use the IDAPython wrapper functions. As you mentioned, the IDA API is quite poorly documented. One of the best, but not easiest way to actually understand it is to check the ...
- 397
6
votes
Accepted
Reverse engineering car stereo panel
The first step is to figure out the purpose of each of those pins. The easiest way to do this is to Google for the LAC-M3600R's service manual (note that this is different from the user manual). That ...
- 20.6k
6
votes
Is it possible to get a list of user-defined names in IDA?
The idautils.Names function might be of interest to you, as it returns a list of (ea, name) tuples for all names defined in the IDB and the ea at which they're located.
Additionally, you can use the ...
- 11.7k
6
votes
Accepted
ghidra-python: create struct with big endian field
The following script shows hows to create a structure and set its field to Big Endian byte order using the Ghidra Python API.
from ghidra.program.model.data import DataTypeConflictHandler
from ...
- 6,030
5
votes
Accepted
Adding a toolbar to IDA using PySide
New IDA 6.95 API
Perhaps because they saw this question, maybe because of user requests, version 6.95 was released with two IDAPython API functions for creating a menu and a toolbar: create_menu and ...
- 11.7k
5
votes
What are the tools to analyze Python (obfuscated) bytecode?
A challenge in writing a tool to extract the control flow of python bytecode is that there are so many Python bytecodes versions to choose from, about 25 or so by now (if you include pypy variants).
...
- 213
5
votes
Accepted
How can I get the shared libraries' function calls using angr
However I don't know how to get the function calls from the nodes
Are you saying you want to know which function a node belongs to, or which function a node is calling?
For the former, each block ...
- 194
5
votes
Accepted
How to decompile with Hex Rays via a Python API?
Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler.
Originally, the Python bindings were written by EiNSTeiN around the Hex-Rays Decompiler SDK API. Later it has been ...
- 8,909
4
votes
Decompiling .pyc files
I, of course, use uncompyle6. Disclaimer: I work on this project.
I've written at length about the uncompyle6 and pycdc here.
- 213
4
votes
Volatility - manually inspect heap of a process
So your question is somewhat vague. However, even without providing additional information of your target system, version and used profile, I try to give an introductive answer for Windows systems.
...
- 1,257
4
votes
Accepted
How can I reverse this recursive function?
I gave it a go. First I simplified your code a little bit.
def the_process(stored, inp, size):
global thstr
idx = 0
idx = stored.index(inp[0])
if idx:
the_process(stored[:idx],...
- 2,584
4
votes
The structure of the Python's marshaled code object (or .pyc file)
The answer below is with reference to Python 2.7
How the Virtual Machine will found the baz code object? I can't see all this information: 0x7f380995e5d0, file "foo.py", line 7 in the marshaled ...
- 6,030
4
votes
Accepted
Reverse Python Bytecode
You can use the marshal module to load the code object.
Now, suppose you want to find out what does LOAD_NAME 1 loads on the evaluation stack.
import marshal
co = marshal.load(...)
print co....
- 6,030
4
votes
Sharing variable between scripts
if I understand the question correctly, then analyzeHeadless documentation will help you.
Headless Scripts: Passing Values Between Scripts If you are running
multiple scripts in headless operation ...
- 1,767
4
votes
How to highlight all external registers in a function
The answer to this question is to simply use Hex-Rays instead of IDA. It automatically does everything you've suggested, and the end result is the function's prototype, which will indicate register ...
- 9,088
3
votes
idapython - Determine if item is code or data
Additionally, you can use Sark to get it done:
import sark
# For current line
sark.Line().is_code
# For specific line
sark.Line(ea).is_code
Note: I am the creator of Sark.
- 1,557
3
votes
Accepted
Get DLL name with PyDBG and System_dll.py?
:>type ENUMMODS.PY
import sys
from pydbg import *
for modules in pydbg().attach(int(sys.argv[1])).enumerate_modules():
print modules
pydbg().detach()
:>ENUMMODS.PY
('calc.exe', 12517376L)
(...
- 16.2k
3
votes
What are the tools to analyze Python (obfuscated) bytecode?
The Flare-bytecode graph project can help with graphical bytecode CFG representation. Taken from the project README:
...
It is also possible to create control flow diagrams using GraphViz. The ...
- 31
3
votes
Is it possible to get a list of user-defined names in IDA?
You can use View->Open subview->Names or Shift-F4. Note that the list included all names, both user-defined as well as generated by IDA (e.g. ASCII string names).
See also related Get a list of ...
- 36.2k
3
votes
Accepted
Deducing Protobuf Schema and Datatypes
I suspect these are IEEE doubles. For example, 0x3fd3333333333333 is 2.99999999999999988897769753748E-1, or around 0.3. I used this converter to check
- 36.2k
3
votes
Accepted
Extract conditional instructions using IDA python in ARM binaries
I was able to reproduce your problem on IDA 6.95 but it seems like this bug was fixed in IDA 7 since it works for me just fine. The solution below will be relevant to IDA 6.95 though it would probably ...
- 8,909
3
votes
Reverse engineering USB peripheral driver
Well, your question is a bit broad as it stands, but let's take it one by one. Typically (but not always) drivers for printers these days are user mode drivers (UMDF), which means you're looking for a ...
Only top scored, non community-wiki answers of a minimum length are eligible