Hot answers tagged

4

if I understand the question correctly, then analyzeHeadless documentation will help you. Headless Scripts: Passing Values Between Scripts If you are running multiple scripts in headless operation and would like to store a value in one script that is accessible by another script, use the HeadlessScript methods below. They facilitate the storage and ...


3

I'm starting in RE too (since beggining of 2020), and I thought I could put here what I've learned so far. Maybe it might be of help. So first of all, you need Assembly knowledges. You asked if it's still worth to learn x86 because there is x64 now. Well, that's a thing I learned too. x64 is just an extension of x86. The real name for x64 is actually x86_64. ...


2

You can do something like: # get all functions functions = program.getFunctionManager().getFunctions(True) for function in functions: cur = function.getEntryPoint() while cur: inst = getInstructionAt(cur) if inst: # add similar check for call instruction if "RET" in inst.getMnemonicString(): ...


2

This is one method to do it. from ghidra.program.util import DefinedDataIterator from ghidra.app.util import XReferenceUtil for string in DefinedDataIterator.definedStrings(currentProgram): for ref in XReferenceUtil.getXRefList(string): print(string, ref) There are alternative definedStrings iterators and other ways to use XReferenceUtil in the docs.


2

find the library.zip inside the lib folder included extract EXENAME__main__.pyc (EXENAME is the name of the exe) run pip install decompyle3 run decompyle3 EXENAME__main__.pyc and the source will be printed onto the screen


2

This could prove to be much harder than converting pyc to equivalent python code According to python docs Yes, .pyd files are dll’s, but there are a few differences. If you have a DLL named foo.pyd, then it must have a function PyInit_foo(). You can then write Python “import foo”, and Python will search for foo.pyd (as well as foo.py, foo.pyc) and if it ...


2

If you change your process startup to p = process(["strace", "-o", "strace.out", "./bof"]) and check the resulting strace.out file, you will see: close(0) = 0 open("/dev/tty", O_RDWR|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC) = 0 execve("/bin/sh", NULL, NULL) = 0 ... ...


2

Today, several years after the original post and answers - There's another noteworthy package for generating machine code from assembly- Keystone. Keystone is written in C++ but has binding for many languages (Python included), and supports multiple architectures (including x86, amd64 and ARM) so it's a perfect fit! Quoting the website's highlighted features:...


2

You're on the right track with replacing exec with print, you just didn't go deep enough. The file you posted is, effectively, 7 python commands each wrapped up in a bunch of obfuscation (not including the initial import statement). If you deobfuscate each command by printing the result, the first one results in an import statement and a set of 4 more ...


2

As Paweł Łukasik point out, it looks like RC4 indeed. That's especially true for the KSA that you can immediately recognize: local_14 = 0; while (local_14 < 0x100) { local_12c[local_14] = (byte)local_14; local_14 = local_14 + 1; } If you rename the variables by keeping in mind that this is a Key-Scheduling Algorithm, you end up with the ...


1

This is not really a re related question. But you can do something like this: python3 -c 'import string;print(string.ascii_letters)'


1

I don't use Eclipse for Ghidra myself, but as far as I just checked it should also support this. I can confirm that this approach (remote debugging plus Python stubs) works well with PyCharm. Remote Debugging with pydevd The basic idea is to use remote debugging with pydevd or similar. https://stackoverflow.com/a/41492711/13220684 explains the basic usage. ...


1

Here is a small angr script that can do so: proj = angr.Project('...path...') state = proj.factory.blank_state(addr=0x0804EA9E) simulation = proj.factory.simgr(state) ret = simulation.explore(find=0x0804EAA3) print(ret.found[0].regs.ecx) Between the addresses 0x0804EA9E to 0x0804EAA3 I've got mov ecx, 0Ah so I get: <BV32 0xa> from the print. I know ...


1

It’s not gibberish, the code is simply using non-ASCII variable names which is perfectly fine in Python.


1

The autor started with 5009 bytes ("TRUN /.:/" + 5000 * 'A') so later when the actual shell code was added to the payload, the code ((5009 - len(payload)) * "C") is added to maintain the original length of the payload that caused the crash. If it works without - great, but why add additional variable/unknown to the pwning equation if you ...


Only top voted, non community-wiki answers of a minimum length are eligible