Skip to main content
10 votes
Accepted

Run a python command with "run" on GDB

You do not have to use another file, it is just redundant You can do this by using "Here strings". In your example you can do : r <<< $(python -c "print '\x90'*52") You can read about "...
yehuda corsia's user avatar
8 votes
Accepted

idapython - Determine if item is code or data

IDA utilizes flags for checking the properties of locations. Looking at the API you can use GetFlags(ea) and pass its output to isCode(flags) to check if a location is flagged as being code. You can ...
Nordwald's user avatar
  • 2,906
8 votes

Best way to protect source code of .exe program running on Python?

There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose. ...
0xec's user avatar
  • 6,090
7 votes
Accepted

Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?

I'm not sure I fully understood you, but I'll give it a try anyway. The following instructions will explain how to achieve something like this:| radare2 comes with its own webserver. Although at ...
Megabeets's user avatar
  • 8,999
7 votes
Accepted

ghidra-python: create struct with big endian field

The following script shows hows to create a structure and set its field to Big Endian byte order using the Ghidra Python API. from ghidra.program.model.data import DataTypeConflictHandler from ...
0xec's user avatar
  • 6,090
6 votes

Is it possible to get a list of user-defined names in IDA?

The idautils.Names function might be of interest to you, as it returns a list of (ea, name) tuples for all names defined in the IDB and the ea at which they're located. Additionally, you can use the ...
NirIzr's user avatar
  • 11.8k
5 votes

What are the tools to analyze Python (obfuscated) bytecode?

A challenge in writing a tool to extract the control flow of python bytecode is that there are so many Python bytecodes versions to choose from, about 25 or so by now (if you include pypy variants). ...
rocky's user avatar
  • 213
5 votes
Accepted

Adding a toolbar to IDA using PySide

New IDA 6.95 API Perhaps because they saw this question, maybe because of user requests, version 6.95 was released with two IDAPython API functions for creating a menu and a toolbar: create_menu and ...
NirIzr's user avatar
  • 11.8k
5 votes
Accepted

How can I get the shared libraries' function calls using angr

However I don't know how to get the function calls from the nodes Are you saying you want to know which function a node belongs to, or which function a node is calling? For the former, each block ...
Fish's user avatar
  • 194
5 votes
Accepted

How to decompile with Hex Rays via a Python API?

Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler. Originally, the Python bindings were written by EiNSTeiN around the Hex-Rays Decompiler SDK API. Later it has been ...
Megabeets's user avatar
  • 8,999
4 votes

Decompiling .pyc files

I, of course, use uncompyle6. Disclaimer: I work on this project. I've written at length about the uncompyle6 and pycdc here.
rocky's user avatar
  • 213
4 votes

Volatility - manually inspect heap of a process

So your question is somewhat vague. However, even without providing additional information of your target system, version and used profile, I try to give an introductive answer for Windows systems. ...
knx's user avatar
  • 1,257
4 votes
Accepted

How can I reverse this recursive function?

I gave it a go. First I simplified your code a little bit. def the_process(stored, inp, size): global thstr idx = 0 idx = stored.index(inp[0]) if idx: the_process(stored[:idx],...
sudhackar's user avatar
  • 2,709
4 votes

The structure of the Python's marshaled code object (or .pyc file)

The answer below is with reference to Python 2.7 How the Virtual Machine will found the baz code object? I can't see all this information: 0x7f380995e5d0, file "foo.py", line 7 in the marshaled ...
0xec's user avatar
  • 6,090
4 votes
Accepted

Reverse Python Bytecode

You can use the marshal module to load the code object. Now, suppose you want to find out what does LOAD_NAME 1 loads on the evaluation stack. import marshal co = marshal.load(...) print co....
0xec's user avatar
  • 6,090
4 votes

Sharing variable between scripts

if I understand the question correctly, then analyzeHeadless documentation will help you. Headless Scripts: Passing Values Between Scripts If you are running multiple scripts in headless operation ...
R4444's user avatar
  • 1,807
4 votes

How to highlight all external registers in a function

The answer to this question is to simply use Hex-Rays instead of IDA. It automatically does everything you've suggested, and the end result is the function's prototype, which will indicate register ...
Rolf Rolles's user avatar
  • 9,198
3 votes
Accepted

Deducing Protobuf Schema and Datatypes

I suspect these are IEEE doubles. For example, 0x3fd3333333333333 is 2.99999999999999988897769753748E-1, or around 0.3. I used this converter to check
Igor Skochinsky's user avatar
  • 36.8k
3 votes

Is it possible to get a list of user-defined names in IDA?

You can use View->Open subview->Names or Shift-F4. Note that the list included all names, both user-defined as well as generated by IDA (e.g. ASCII string names). See also related Get a list of ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

idapython - Determine if item is code or data

Additionally, you can use Sark to get it done: import sark # For current line sark.Line().is_code # For specific line sark.Line(ea).is_code Note: I am the creator of Sark.
tmr232's user avatar
  • 1,577
3 votes

What are the tools to analyze Python (obfuscated) bytecode?

The Flare-bytecode graph project can help with graphical bytecode CFG representation. Taken from the project README: ... It is also possible to create control flow diagrams using GraphViz. The ...
MaciejTe's user avatar
3 votes
Accepted

Extract conditional instructions using IDA python in ARM binaries

I was able to reproduce your problem on IDA 6.95 but it seems like this bug was fixed in IDA 7 since it works for me just fine. The solution below will be relevant to IDA 6.95 though it would probably ...
Megabeets's user avatar
  • 8,999
3 votes

Reverse engineering USB peripheral driver

Well, your question is a bit broad as it stands, but let's take it one by one. Typically (but not always) drivers for printers these days are user mode drivers (UMDF), which means you're looking for a ...
3 votes

What is a more efficient way to locate disasm patterns in IDAPython?

I typicall solve this by just walking over code references to the import. Something like for ref in CodeRefsTo(LocByName('GetTickCount'),True): print "%08x" % ref This is quite powerful because ...
Johann Aydinbas's user avatar
3 votes
Accepted

Decompile Python for ELF Binaries

It can be said with certainty that your binary has been compiled with PyInstaller. Searching for the string "Error detected starting Python VM." leads to the PyInstaller repo. Now that you know it's ...
0xec's user avatar
  • 6,090
3 votes
Accepted

how can i Encrypt a decrypted zte zxhn h108n V2.5 config file?

You can use the zcu module to do this. python examples/encode.py config.bin.xml out.bin --key 'GrWM2Hz&LTvz&f^5' --signature 'ZXHN H108N V2.5' Full disclosure: I wrote the zcu module. It's ...
mkst's user avatar
  • 266
3 votes
Accepted

Ghidra Headless Analyzer - Create Functions

The solution that I found is: analyze(currentProgram) Just after the disassembly.
macro_controller's user avatar
3 votes
Accepted

Decompiling .pyc file to 0 byte .py file

It's possible that the pyc file is obfuscated/malformed in a way that it trips uncompyle6. Rather than decompiling you can try disassembling the file instead. The dis module can disassemble Python ...
0xec's user avatar
  • 6,090
3 votes
Accepted

Ghidra Python - cancel decompilation task

You are already passing 1000 to a decompileFunction so according to the documentation an exception should be thrown if it takes more time than that. Though, the timeout is in seconds and you set it to ...
Paweł Łukasik's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible