alexander-hanel

test.py

with open("test.txt", "w") as outfile:
  outfile.write("Hello!")

IDAPYTHON script Example

C:\Users\this\Desktop>"C:\Program Files\IDA 7.1\idat.exe" -Stest.py test.idb

alexander-hanel

import os
import subprocess
import glob
import pefile 

IMAGE_FILE_MACHINE_I386 = 0x014c
IMAGE_FILE_MACHINE_AMD64 = 0x8664

paths = glob.glob("*")
ida_path = os.path.join(r'C:\Program Files\IDA 7.0',"idat.exe")

alexander-hanel

import datetime
import glob
import hashlib
import os
import pefile
import sys

def rename_timestamp(file_path):
    try:
        data = open(file_path, "rb").read()

alexander-hanel

import idautils
func_dict = {} 
XOR_COUNT = 2
FUNC_LEN = 35
for func in idautils.Functions():
    flags = idc.get_func_attr(func, FUNCATTR_FLAGS) 
    if flags & FUNC_LIB or flags & FUNC_THUNK:
    	continue
    dism_addr = list(idautils.FuncItems(func)) 
    for line in dism_addr:

alexander-hanel

import pefile
import sys
import datetime
import zlib

"""
    Author:     Alexander Hanel
    Summary:    Most common pefile usage examples
    Date:       20181226
"""

alexander-hanel

from PyQt5 import QtWidgets, QtGui

class ListViewDemoDialog(QtWidgets.QDialog):
    def __init__(self):
        super(ListViewDemoDialog, self).__init__()
       
        # create a layout to place controllers (called widgets) on
        layout = QtWidgets.QVBoxLayout()

alexander-hanel

import base64
import sys
import re
import gzip
import StringIO
import hexdump as h
from capstone import *

# old code from https://bitbucket.org/snippets/Alexander_Hanel/onboA/p0wnedshell-shellcode-extractor

alexander-hanel

import yara
import operator
import idautils

SEARCH_CASE = 4
SEARCH_REGEX = 8
SEARCH_NOBRK = 16
SEARCH_NOSHOW = 32
SEARCH_UNICODE = 64
SEARCH_IDENT = 128

alexander-hanel

import ida_yara
import idautils


def is_lib(ea):
    flags = idc.get_func_attr(ea, FUNCATTR_FLAGS)
    if flags & FUNC_LIB:
        return True
    else:
        return False

alexander-hanel

import sys
import re
import pefile
import string
import struct
from capstool import CapsTool
from capstone import *
from capstone.x86 import *

BCC = ["je", "jne", "js", "jns", "jp", "jnp", "jo", "jno", "jl", "jle", "jg",