williballenthin

radare2

load without any analysis (file header at offset 0x0): r2 -n /path/to/file

• analyze all: aa
• show sections: iS
• list functions: afl
• list imports: ii
• list entrypoints: ie
• seek to function: s sym.main

williballenthin

import re
from collections import namedtuple


ASCII_BYTE = " !\"#\$%&\'\(\)\*\+,-\./0123456789:;<=>\?@ABCDEFGHIJKLMNOPQRSTUVWXYZ\[\]\^_`abcdefghijklmnopqrstuvwxyz\{\|\}\\\~\t"


String = namedtuple("String", ["s", "offset"])

williballenthin

digraph structs {
 node [shape=plaintext, style="rounded", fontname="courier"] 

 struct1 [label=< <TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0"> <TR><TD>left</TD><TD PORT="f1">mid dle</TD><TD PORT="f2">right</TD></TR> </TABLE>>]; 
 struct2 [label=< <TABLE BORDER="0" CELLBORDER="1" CELLSPACING="0"> <TR><TD PORT="f0">one</TD><TD>two</TD></TR> </TABLE>>];


 struct3 [label=<
<TABLE BORDER="1" CELLBORDER="0"> 

williballenthin

#!/usr/bin/env python
'''
some documentation

author: Willi Ballenthin
email: willi.ballenthin@gmail.com
website: https://gist.github.com/williballenthin/f88c5c95f3e41157de3806dfbeef4bd4
'''
import sys
import logging

williballenthin

Keybase proof

I hereby claim:

• I am williballenthin on github.
• I am williballenthin (https://keybase.io/williballenthin) on keybase.
• I have a public key whose fingerprint is 5EE1 D88E 60EA 91EF B8B1 906D 017C BAD6 4143 BB1D

To claim this, I am signing this object:

williballenthin

'''
IDAPython plugin that adds the contents of a file as a new segment in an existing idb.
Prompts the user for:
  - file path
  - segment name
  - segment starting offset
  
Useful for reversing engineering packed software and shellcode.

Author: Willi Ballenthin <william.ballenthin@fireeye.com>

williballenthin

import sys
import logging
from collections import namedtuple

import requests
import bs4
from bs4 import BeautifulSoup


logger = logging.getLogger(__name__)

williballenthin

'''
IDAPython script that generates a YARA rule to match against the
basic blocks of the current function. It masks out relocation bytes
and ignores jump instructions (given that we're already trying to
match compiler-specific bytes, this is of arguable benefit).

If python-yara is installed, the IDAPython script also validates that
the generated rule matches at least one segment in the current file.

author: Willi Ballenthin <william.ballenthin@fireeye.com>

williballenthin

williballenthin