I'm starting in RE too (since beggining of 2020), and I thought I could put here what I've learned so far. Maybe it might be of help.
So first of all, you need Assembly knowledges. You asked if it's still worth to learn x86 because there is x64 now. Well, that's a thing I learned too. x64 is just an extension of x86. The real name for x64 is actually x86_64. ...
You are already passing 1000 to a decompileFunction so according to the documentation an exception should be thrown if it takes more time than that. Though, the timeout is in seconds and you set it to pretty high value - probably assuming it's in ms. Change to 1 and check if it will be cancelled with an exception if the time has passed.
Alternatively, you ...
You can use the zcu module to do this.
python examples/encode.py config.bin.xml out.bin --key 'GrWM2Hz<vz&f^5' --signature 'ZXHN H108N V2.5'
Full disclosure: I wrote the zcu module. It's based off of this pastebin.
[Disclaimer: I'm the author of PyInstaller Extractor].
PyInstaller Extractor has been updated to v2.0 which includes supports for Python 3.7 and 3.8. Moreover it automatically fixes the header of extracted pyc's, manual fixing of the header is not needed anymore.
The answer below no longer applies if you use the latest version of the tool.
The cause of ...
It's possible that the pyc file is obfuscated/malformed in a way that it trips uncompyle6. Rather than decompiling you can try disassembling the file instead.
The dis module can disassemble Python bytecode. You can use it as follows.
import marshal, dis
f = open("flag.pyc", "rb")
f.seek(16) # Skip 16 byte header (for Python 3.8)
co = marshal.load(f)
This is one method to do it.
from ghidra.program.util import DefinedDataIterator
from ghidra.app.util import XReferenceUtil
for string in DefinedDataIterator.definedStrings(currentProgram):
for ref in XReferenceUtil.getXRefList(string):
There are alternative definedStrings iterators and other ways to use XReferenceUtil in the docs.
find the library.zip inside the lib folder included
extract EXENAME__main__.pyc (EXENAME is the name of the exe)
run pip install decompyle3
run decompyle3 EXENAME__main__.pyc and the source will be printed onto the screen
If you change your process startup to
p = process(["strace", "-o", "strace.out", "./bof"])
and check the resulting strace.out file, you will see:
close(0) = 0
open("/dev/tty", O_RDWR|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC) = 0
execve("/bin/sh", NULL, NULL) = 0
You can do something like:
# get all functions
functions = program.getFunctionManager().getFunctions(True)
for function in functions:
cur = function.getEntryPoint()
inst = getInstructionAt(cur)
# add similar check for call instruction
if "RET" in inst.getMnemonicString():
This could prove to be much harder than converting pyc to equivalent python code
According to python docs
Yes, .pyd files are dll’s, but there are a few differences. If you have a DLL named foo.pyd, then it must have a function PyInit_foo(). You can then write Python “import foo”, and Python will search for foo.pyd (as well as foo.py, foo.pyc) and if it ...
I don't use Eclipse for Ghidra myself, but as far as I just checked it should also support this. I can confirm that this approach (remote debugging plus Python stubs) works well with PyCharm.
Remote Debugging with pydevd
The basic idea is to use remote debugging with pydevd or similar. https://stackoverflow.com/a/41492711/13220684 explains the basic usage.
Here is a small angr script that can do so:
proj = angr.Project('...path...')
state = proj.factory.blank_state(addr=0x0804EA9E)
simulation = proj.factory.simgr(state)
ret = simulation.explore(find=0x0804EAA3)
Between the addresses 0x0804EA9E to 0x0804EAA3 I've got mov ecx, 0Ah so I get: <BV32 0xa> from the print.
I know ...
The autor started with 5009 bytes ("TRUN /.:/" + 5000 * 'A') so later when the actual shell code was added to the payload, the code ((5009 - len(payload)) * "C") is added to maintain the original length of the payload that caused the crash.
If it works without - great, but why add additional variable/unknown to the pwning equation if you ...
I don't know how any examples how you could get the line like Ghidra would render it, but as a start you can look at https://github.com/schlafwandler/ghidra_ExportToX64dbg.
The basic idea is to walk the C-AST and extract the ClangStatements that have a corresponding RVA.
This has limitations, namely:
At the moment the source code export is limited to ...
getReferencesTo takes an address
toAddr() converts a string to Address you can combine both
From: 14095680c To: 1401b33c0 Type: DATA Op: 0 IMPORTED,
From: 140a22fbd To: 1401b33c0 Type: DATA Op: 0 DEFAULT,
From: Entry Point To: 1401b33c0 Type: ...
I don't think there is a method that filters functions by name, but you can write the above a bit more concise with lambdas and a bit more functional approach.
fm = currentProgram.getFunctionManager()
funcs = fm.getFunctions(True)
filtered_funcs = filter(lambda f: f.getName() == '<your function name>', funcs)
x_refs = map(lambda f: getReferencesTo(f....
The following script shows hows to create a structure and set its field to Big Endian byte order using the Ghidra Python API.
from ghidra.program.model.data import DataTypeConflictHandler
from ghidra.program.model.data import EndianSettingsDefinition
from ghidra.app.util.cparser.C import CParser
mystruct_txt = """
From the “frozen” text in the stack trace, it was probably processed with cx_Freeze or a similar tool. Usually they put the compiled Python files into a zip file embedded into the executable, so try looking for one (e.g. with binwalk)
Run this .idc script to export all user-defined functions name. Script tested on IDA 7.0.
For IDA < 7.0: please use function hasUserName(addr) instead of has_user_name(addr)
auto ea, str, count, ref;
ea = start;
while( ea != BADADDR )
str = ...
Today, several years after the original post and answers - There's another noteworthy package for generating machine code from assembly- Keystone.
Keystone is written in C++ but has binding for many languages (Python included), and supports multiple architectures (including x86, amd64 and ARM) so it's a perfect fit!
Quoting the website's highlighted features:...