Skip to content

Instantly share code, notes, and snippets.

@themson
Last active August 29, 2015 14:17
Show Gist options
  • Save themson/87b41268ae8b54130ba1 to your computer and use it in GitHub Desktop.
Save themson/87b41268ae8b54130ba1 to your computer and use it in GitHub Desktop.
Immunity Debugger Endian Swap PyCommand
"""
Immunity Debugger Endian Swap
themson mester
endianswap.py simple script to swap byte order of addresses
"""
__VERSION__ = '1.1'
import immlib
DESC = "Swap byte order of input address"
def usage(imm):
imm.log("!endswap <ADDRESS> [format <raw>||<py>]")
imm.log("For example: !endswap 7CA7A787")
def get_pyformat(raw_addr):
bytes = [raw_addr[x:x+2] for x in range(0, len(raw_addr), 2)]
return '{}{}'.format('\\x','\\x'.join(bytes))
def get_raw(address):
raw_addr = address.decode('hex')
raw_addr = raw_addr[::-1]
return raw_addr.encode('hex')
def main(args):
valid_formats = ('raw', 'py')
format = 'raw'
if not args:
return "Usage: !endswap <ADDRESS> [format <raw>||<py>]"
address = args[0]
if len(address) not in (8, 16):
return "Invalid Address Length: {}".format(len(address))
if len(args) == 2 and args[1] in valid_formats:
format = args[1]
try:
raw_addr = get_raw(address).upper()
except TypeError as e:
return("ERROR: {}".format(e.args))
if format == 'raw':
return '{}'.format(raw_addr)
elif format == 'py':
return "'{}'".format(get_pyformat(raw_addr))
@themson
Copy link
Author

themson commented Mar 18, 2015

Immunity Debugger PyCommand to swap endianness of an address.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment