New answers tagged python
0
I don't use Eclipse for Ghidra myself, but as far as I just checked it should also support this. I can confirm that this approach (remote debugging plus Python stubs) works well with PyCharm.
Remote Debugging with pydevd
The basic idea is to use remote debugging with pydevd or similar. https://stackoverflow.com/a/41492711/13220684 explains the basic usage.
...
2
If you change your process startup to
p = process(["strace", "-o", "strace.out", "./bof"])
and check the resulting strace.out file, you will see:
close(0) = 0
open("/dev/tty", O_RDWR|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC) = 0
execve("/bin/sh", NULL, NULL) = 0
...
...
0
On GNU/Linux, system passes any arguments to /bin/sh -c "<command>". Any shell metacharacters (e.g. &, |, `, $, ; etc.) in the command will be interpreted. So, commands can be run using `command` or $(command) to use a subshell, or with other logic.
If a file has those characters, commands could be run:
$ ls itworks
$ touch '$(touch ...
0
For anyone else this happens to... Ensure you use the same Python version as the original author.
That is, I originally created the ELF with Python 3.7. But I tried the reversing process on a different machine - with Python 3.8. Learn from my mistake!
3
I'm starting in RE too (since beggining of 2020), and I thought I could put here what I've learned so far. Maybe it might be of help.
So first of all, you need Assembly knowledges. You asked if it's still worth to learn x86 because there is x64 now. Well, that's a thing I learned too. x64 is just an extension of x86. The real name for x64 is actually x86_64. ...
Top 50 recent answers are included
