15
This is how you should proceed in such cases.
Step 1 : Load the executable in a debugger like Ollydbg.
Step 2 : In the memory dump window, navigate to PyImport_FrozenModules by pressing Ctrl + G
Step 3 : PyImport_FrozenModules is a pointer which is initialized to point to an array of struct _frozen records. Follow this pointer in dump.
Step 4 : Now you ...
15
I received an answer from HexRays support which has a solution which does not rely on parsing the C string retrieved by GetType(ea).
Let's imagine we start with a function prototype:
int __cdecl main(int argc, const char **argv, const char **envp)
That's from an ELF file, x86 abi; stuff is passed on the stack.
Then, I can do the following:
Python>...
11
I wrote Sark to avoid this banging-head-against-wall routine. It provides wrappers around most of the commonly-used IDAPython APIs, making them more pythonic.
You can find the documentation for Sark here on Read-The-Docs.
As mentioned before by @CrazyFrog, you can use:
Alexander Hanel's book and blog;
Ero Carrera's Intro to IDAPyton;
Additionally, there ...
10
You do not have to use another file, it is just redundant
You can do this by using "Here strings".
In your example you can do :
r <<< $(python -c "print '\x90'*52")
You can read about "Here strings" here
9
There are several tools dedicated to Python's bytecode reversing:
Uncompyle and Uncompyle2
'uncompyle' converts Python byte-code back into equivalent Python
source. It accepts byte-code from Python version 2.7 only. The generated source is very readable: docstrings, lists, tuples and hashes get pretty-printed.
'uncompyle' may also verify the ...
8
You can do this. Last summer I worked with Hexrays and WingIDE guys and got this working. In fact its in the docs!
http://wingware.com/doc/howtos/idapython
It rocks.
Riley
8
While in IDA's Hex View you can go to Edit->Patch Program->Change Byte, but I think this only lets you patch 16 bytes at a time. If you need to patch more bytes than that you can use IDAPython's idc.PatchByte / idc.PatchWord / idc.PatchDword to change bytes in the IDA database.
EDIT:
Just a quick note, if you want your patches applied to the original file ...
8
You just need to search online.
Anyways here are some python 2.4 decompilers worth trying,
decompyle - http://murphey.org/code/decompyle-2.4.tgz
pycdc - https://github.com/zrax/pycdc
depython - http://depython.com/
decompyle service - http://www.crazy-compilers.com/decompyle/
Python-Decompiler - https://gitorious.org/python-decompiler
Note : Easy Python ...
8
IDA utilizes flags for checking the properties of locations.
Looking at the API you can use GetFlags(ea) and pass its output to isCode(flags) to check if a location is flagged as being code.
You can find the exact definitions of the flags in IDC.IDC. A small excerpt:
#define isCode(F) ((F & MS_CLS) == FF_CODE) // is code byte?
#define isData(F) ...
8
There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose.
The way Python works is fully documented and open-source. For instance, consider the pyc file format. Much of the code which deals with reading/writing pyc's ...
7
You cannot prevent reverse engineering. You can make it more or less harder but you cannot prevent it. No.
Update
Ok, as the author updated it with a more clearer question... this is what one can do:
Strip symbols from the binaries. At the very least.
Obfuscate the code. This may help: https://stackoverflow.com/questions/4111808/c-c-compiler-generating-...
7
I'm not sure I fully understood you, but I'll give it a try anyway.
The following instructions will explain how to achieve something like this:|
radare2 comes with its own webserver. Although at first, it might seems like an overkill, its actually quite useful, especially when you want to debug embedded systems, or simply to execute commands from a remote ...
7
I don't know of any way to run a script as a run argument.
A common solution is to redirect your input from a file.
You first need to run the script and save the result:
python -c "print 'A'*50" > my_file
and redirect it to gdb run.
r < my_file
also, from the help run command:
Input and output redirection with ">", "<", or ">>" are also ...
6
Don't rely on the IAT entry in the PE Data Directory to be accurate. The only truly accurate way to find the IAT(s) is to find actual calls from the disassembled code to statically imported API functions.
Let's use the following code in IDA as an example:
FF 15 44 60 03 01 call ds:GetVersion
The actual disassembly of FF 15 44 60 03 01 is call dword ...
6
Some Python assembler libraries:
Pyasm - Python x86 Assembler
Pyasm is a full-featured dynamic assembler written entirely in Python. By dynamic, it means that it can be used to generate and execute machine code in python at runtime without requiring the generation of object files and linkage. It essentially allow 'inline' assembly in Python modules on x86 ...
6
You might want to use the IDAPython wrapper functions. As you mentioned, the IDA API is quite poorly documented. One of the best, but not easiest way to actually understand it is to check the IDAPython wrapper library in your IDA/Python/idc.py folder.
Based on what I've seen in the idc.py file, there's some functions you might want to check out to help you ...
6
The first step is to figure out the purpose of each of those pins. The easiest way to do this is to Google for the LAC-M3600R's service manual (note that this is different from the user manual). That device's service manual contains the following diagram for the back of the faceplate:
As you can see above, the pins are (beginning from top-right, moving ...
6
The idautils.Names function might be of interest to you, as it returns a list of (ea, name) tuples for all names defined in the IDB and the ea at which they're located.
Additionally, you can use the answer to the question Igor linked (Get a list of global variables with IDA python) to get a list of all functions.
Once you have the eas you can do the ...
5
Take a look at Gallopsled's pwntools. Does all the things you want it to, and has most of it built in already.
https://github.com/Gallopsled/pwntools
For a few examples of it in use, I put up some writeups from Codegate 2013 and the pwnies do their own writeups as well.
Here's a quick example of "I want to dup file descriptor #4 (e.g. a connected TCP ...
5
You should rather ask your questions with some kind of example output so that answers are not based on guesswork.
Does iam loading the struct mean
I wrote a program where I am employing OpenProcess() ReadProcessMemory()
or does it mean
i am opening the raw file with FILE * fp ; fopen("c:\XXX","wb") fread(fp); or load it in say ollydbg or in a ...
5
A challenge in writing a tool to extract the control flow of python bytecode is that there are so many Python bytecodes versions to choose from, about 25 or so by now (if you include pypy variants).
The bytecode in the example graph with its JUMP_IF_FALSE followed by some POP_TOPs and PRINT_NEWLINE instruction, reflect Python before 2.7.
However the ...
5
The approach to finding security vulnerabilities in games is no different than the approach to finding security vulnerabilities in other applications.
As discussed here, "Most vulnerabilities in closed-source products are found via fuzzing and static reverse engineering... Typically you don't need to analyze the entire program, but only the entrypoints for ...
5
Three problems:
mix_column returns _col (typo underscore?)
The return value of mix_columns just concatenates the columns together like rows instead of slotting them back into columns - effectively transposing the result.
AESENC takes its parameters and returns its results as columns concatenated together. Your aesenc takes the parameters and returns the ...
5
New IDA 6.95 API
Perhaps because they saw this question, maybe because of user requests, version 6.95 was released with two IDAPython API functions for creating a menu and a toolbar: create_menu and create_toolbar so now these can be done trivially.
Old trick - Before 6.95
A hack I've been using is finding the application's main window manually and then ...
5
Check out "The Beginner's Guide to IDAPython" by Alexander Hanel and his blog
and this by Ero Carrera
5
Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler.
Originally, the Python bindings were written by EiNSTeiN around the Hex-Rays Decompiler SDK API. Later it has been merged into IDAPython.
You can find the documentation under "ida_hexrays" in the IDAPython docs.
Examples can be found in IDAPython repository. Check the scripts ...
4
I, of course, use uncompyle6. Disclaimer: I work on this project.
I've written at length about the uncompyle6 and pycdc here.
4
The one stop solution for all pyinstaller exe things. Use this program to reverse engineer a pyinstaller generated exe file.
https://sourceforge.net/projects/pyinstallerexerebuilder/
4
There's a nice blog entry on it here: http://www.singlehop.com/blog/binary-vivisection-part-1/
...
While looking over the changelog and documentation, I realized that
there doesn’t really seem to be a good tutorial or primer for getting
familiar with the Vivisect framework so hopefully we can remediate
that today. In this series, we’ll be ...
4
As for C compiler (gcc), first make sure you do not make a mistake of compiling it with -g option (adds symbols for debugging, basically whole source code).
-g Produce debugging information in the operating system's native format
Secondly, try with -s option:
-s Remove all symbol table and relocation information from the executable.
Without ...
Only top voted, non community-wiki answers of a minimum length are eligible