26
extract EXE's appended data (block starting with PYZ, until the end of the file)
extract wanted files with PyInstaller's archive viewer
decompyle .PYCs - I personally recommend Uncompyle2 for that.
21
What Python version you're decompiling? Py3k is not well supported, but there are quite a few decompilers for 2.x. One of the latest projects is this:
https://github.com/Mysterie/uncompyle2
It runs on Python 2.7 but supports decompiling 2.5 to 2.7.
Note that some commercial projects has been known to use modified Python interpreters. Modifications can ...
20
First, just a small reminder about "what is co_code".
In Python, every element of the language (functions, methods, classes, ...) is defined and stored in an object. The co_code is one of the fields attached to the class used to represent a function or a method. Lets practice a bit with Python 2.7.
$> python2.7
Python 2.7.3 (default, Mar 4 2013, 14:57:...
19
Here are tricks you can use when packaging your python app with a custom interpreter.
Remap the opcodes for the interpreter
Encrypt the pyc files (the custom interpreter decrypts before importing)
Remove access to co_code in the interpreter (delete the reference to co_code in the code_memberlist array declaration in codeobject.c of the interpreter)
...
15
This is how you should proceed in such cases.
Step 1 : Load the executable in a debugger like Ollydbg.
Step 2 : In the memory dump window, navigate to PyImport_FrozenModules by pressing Ctrl + G
Step 3 : PyImport_FrozenModules is a pointer which is initialized to point to an array of struct _frozen records. Follow this pointer in dump.
Step 4 : Now you ...
14
I received an answer from HexRays support which has a solution which does not rely on parsing the C string retrieved by GetType(ea).
Let's imagine we start with a function prototype:
int __cdecl main(int argc, const char **argv, const char **envp)
That's from an ELF file, x86 abi; stuff is passed on the stack.
Then, I can do the following:
Python>...
13
You might find pyREtic from Immunity to be useful. The presentation from BlackHat USA 2010 on pyREtic is here (YouTube).
pyREtic
Reverse Engineer Obfuscated Python Bytecode This toolkit allows you to
take a object in memory back to source code, without needing access to
the bytecode directly on disk. This can be useful if the applictions
pyc's ...
11
I wrote Sark to avoid this banging-head-against-wall routine. It provides wrappers around most of the commonly-used IDAPython APIs, making them more pythonic.
You can find the documentation for Sark here on Read-The-Docs.
As mentioned before by @CrazyFrog, you can use:
Alexander Hanel's book and blog;
Ero Carrera's Intro to IDAPyton;
Additionally, there ...
10
PyInstaller publishes it's source so you see exactly how it packs the python code in the executable...
A more general approach would be to use a tool like binwalk on the exe as a first step.
10
Maynard is a (dis)assembler for Python byte code written by a member of Python core and the release manager for Python 3.4. Reading material here and here. I'm not aware of a public tool (besides the one you linked) that can do CFG visualization like that, but you certainly could build one on top of Maynard.
10
Slightly modified version from pydasm's README.txt
import pydasm
import binascii
# Open, and read 200 bytes out of the file,
# while converting buffer to hex string
with open('file.bin','r') as f:
buffer = binascii.hexlify(f.read(200))
# Iterate through the buffer and disassemble
offset = 0
while offset < len(buffer):
i = pydasm.get_instruction(...
9
There are several tools dedicated to Python's bytecode reversing:
Uncompyle and Uncompyle2
'uncompyle' converts Python byte-code back into equivalent Python
source. It accepts byte-code from Python version 2.7 only. The generated source is very readable: docstrings, lists, tuples and hashes get pretty-printed.
'uncompyle' may also verify the ...
9
The presentation at hack.lu 2012 titled "A Critical Analysis of Dropbox Software Security" discussed reversing of the Dropbox desktop client which used a similar implementation but with an added twist of customized Python interpreter with changed bytecode.
Presentation review: http://blog.csnc.ch/2012/12/asfws-a-critical-analysis-of-dropbox-software-...
8
You can do this. Last summer I worked with Hexrays and WingIDE guys and got this working. In fact its in the docs!
http://wingware.com/doc/howtos/idapython
It rocks.
Riley
8
This process should get you as close to the original source as possible.
Basically what tools like pyinstaller and py2exe do is package libraries and dependencies all together so you can run the 'stand-alone' EXE without having to download them or prepare the machine with a python interpreter.
When you launch the EXE - it is unpackaged in memory. This ...
8
While in IDA's Hex View you can go to Edit->Patch Program->Change Byte, but I think this only lets you patch 16 bytes at a time. If you need to patch more bytes than that you can use IDAPython's idc.PatchByte / idc.PatchWord / idc.PatchDword to change bytes in the IDA database.
EDIT:
Just a quick note, if you want your patches applied to the original file ...
8
You just need to search online.
Anyways here are some python 2.4 decompilers worth trying,
decompyle - http://murphey.org/code/decompyle-2.4.tgz
pycdc - https://github.com/zrax/pycdc
depython - http://depython.com/
decompyle service - http://www.crazy-compilers.com/decompyle/
Python-Decompiler - https://gitorious.org/python-decompiler
Note : Easy Python ...
8
IDA utilizes flags for checking the properties of locations.
Looking at the API you can use GetFlags(ea) and pass its output to isCode(flags) to check if a location is flagged as being code.
You can find the exact definitions of the flags in IDC.IDC. A small excerpt:
#define isCode(F) ((F & MS_CLS) == FF_CODE) // is code byte?
#define isData(F) ...
8
You do not have to use another file, it is just redundant
You can do this by using "Here strings".
In your example you can do :
r <<< $(python -c "print '\x90'*52")
You can read about "Here strings" here
7
I don't know of any specific Python obfuscation tools (probably because the kind of people who want to write obfuscated code aren't going to be doing it in Python, except for amusement/education).
However, if I did need to obfuscate Python code, I'd probably use the same techniques you'd use for a program in any language. The lack of tools means you need to ...
7
You cannot prevent reverse engineering. You can make it more or less harder but you cannot prevent it. No.
Update
Ok, as the author updated it with a more clearer question... this is what one can do:
Strip symbols from the binaries. At the very least.
Obfuscate the code. This may help: https://stackoverflow.com/questions/4111808/c-c-compiler-generating-...
7
I'm not sure I fully understood you, but I'll give it a try anyway.
The following instructions will explain how to achieve something like this:|
radare2 comes with its own webserver. Although at first, it might seems like an overkill, its actually quite useful, especially when you want to debug embedded systems, or simply to execute commands from a remote ...
7
I don't know of any way to run a script as a run argument.
A common solution is to redirect your input from a file.
You first need to run the script and save the result:
python -c "print 'A'*50" > my_file
and redirect it to gdb run.
r < my_file
also, from the help run command:
Input and output redirection with ">", "<", or ">>" are also ...
6
pyREtic from Immunity Sec can also provide some help in looking into original source code and perform modifications as well.
You may be interested in review the capabilities of the tool in this document:
"pyREtic, In memory reverse engineering for obfuscated Python bytecode" by Rich Smith [PDF]
6
FastLogHook is one of the 13 hook types that Immunity Debugger comes with. Essentially, the purpose of this type of hook is to use tiny assembly stub to transfer execution to a hook function in order to log particular registers and/or memory locations. FastLogHook is essentially an python object, which allows us to setup hard hook relatively easy.
The ...
6
Don't rely on the IAT entry in the PE Data Directory to be accurate. The only truly accurate way to find the IAT(s) is to find actual calls from the disassembled code to statically imported API functions.
Let's use the following code in IDA as an example:
FF 15 44 60 03 01 call ds:GetVersion
The actual disassembly of FF 15 44 60 03 01 is call dword ...
6
Some Python assembler libraries:
Pyasm - Python x86 Assembler
Pyasm is a full-featured dynamic assembler written entirely in Python. By dynamic, it means that it can be used to generate and execute machine code in python at runtime without requiring the generation of object files and linkage. It essentially allow 'inline' assembly in Python modules on ...
6
You might want to use the IDAPython wrapper functions. As you mentioned, the IDA API is quite poorly documented. One of the best, but not easiest way to actually understand it is to check the IDAPython wrapper library in your IDA/Python/idc.py folder.
Based on what I've seen in the idc.py file, there's some functions you might want to check out to help you ...
6
The first step is to figure out the purpose of each of those pins. The easiest way to do this is to Google for the LAC-M3600R's service manual (note that this is different from the user manual). That device's service manual contains the following diagram for the back of the faceplate:
As you can see above, the pins are (beginning from top-right, moving ...
5
You need to check the PE headers of the modules, the offset is dependent on the OS version (the settings can be different for the executable and each loaded DLL). You can look at the mona.py script for examples on how to do that. The script is very large but you should find what you are looking for in the class MnModule, for example the flag for ALSR is ...
Only top voted, non community-wiki answers of a minimum length are eligible
