Reversing engineering, programming and what not…
Introduction If you use IDAPython a lot, I am sure you started reading its source code or felt the need to add missing functionality. In this article, we will show you how to build IDAPython on Windows. On Linux/macOS, the process is straightforward as per the BUILDING.txt. In this article: Setting up VS 2019 Setting Continue reading Building IDAPython on Windows
Introduction A few weeks ago, I proposed an IDA features to improve the CLI and add macros support. After a few email exchanges with Arnaud from Hex-Rays, we could not agree on how to best do it and still accommodate to everyone s needs. Finally, Arnaud kindly wrote a quick IDAPython script to show me how Continue reading climacros IDA productivity tool
Just a quick post to introduce QScripts. QScripts is a productivity tool that helps IDA users speed up their scripts development. The idea for QScripts sprang from my autox script that I wrote for the Batchography book. With QScripts, you will be able to develop your scripts in your favorite text editor, save the script Continue reading QScripts IDA Scripting productivity tool
Ghidra has only been released for a short while and the RCE community started adopting it (scripts, tutorials, articles, etc.) really quick. Since Ghidra is free and open-source (coming soon™), I expect a torrent of contributions in the form of tools, plugins and scripts. I think it is important not to create a schism between Continue reading Daenerys: IDA Pro and Ghidra interoperability framework
Ghidra, is a software reverse engineering (SRE) suite of tools developed by NSA s Research Directorate in support of the Cybersecurity mission. It was released recently and I became curious about it and wanted to check it out. I have not researched to see if someone else did a similar overview article or not, however, I Continue reading Ghidra: A quick overview for the curious
I have been meaning to learn about SMT based program analysis for a long time and recently I started learning about the topic. There are so many frameworks, articles and tutorials out there that I shall explore as time goes by. Since I am still learning, I do not claim that the following material is Continue reading Using Z3 with IDA to simplify arithmetic operations in functions
Often times, when I stumble upon IDAPython scripts, I notice that they are using inefficient / incorrect IDAPython APIs to disassemble or decode instructions (for instance using idc.GetMnem() or idc.GetDisasm()). Therefore, in this blog post, I am going to illustrate how to use IDA s instruction decoding functions from IDAPython in order to write a very Continue reading Writing a simple x86…
The Lichking challenge I created this challenge for the Blizzard 2017 CTF competition that took place on 11/05/2017 in the eSports Arena in Santa Ana, Orange County, CA. (https://ctftime.org/event/487). After the CTF event was over, I decided to release it to public and see who can crack it. This challenge is inspired by the picture Continue reading Blizzard CTF 2017 The LichKing Reverse…
Today I present my talk at REcon Brussels. It was about a problem I had to solve at work. Basically, the classic StarCraft 1.16.1 had a buffer overflow that was exploited to create impressive maps well beyond the original game programming. In this talk, I explained how I tackled the problem and emulated the buffer Continue reading StarCraft: Emulating a buffer overflow for fun and profit REcon…
Hello, Today I release the first Alpha version of Ganxo (pronounced as Gun Show or Gan Chou ), an open source API hooking framework. In Catalan, Ganxo means hook , thus the framework s name. Writing an API hooking framework was always on my to do list. I started developing Ganxo back in April 2016 and after two weeks Continue reading Introducing Ganxo v0.1 Alpha An open source API hooking…