6 ms·
Python for Reverse Engineering 1: ELF Binaries
- qaq 8y agoWonder why security topics never get much interest on HN. It's a huge industry with a ton of VC funding going to security startups.
- z3phyr 8y agoBinary, firmware and hardware level security topics are academically most satisfying and fun to me. But there is a lot of mystery in these topics, given the inherent negativity and legal grey areas people have to deal with. I guess that is one of the reasons..
- daeken 8y agoEh, it depends on the topic. Binary reversing stuff rarely gets much love, but there frankly just aren't too many people doing that stuff. Web security things get lots of love, usually -- I both launched and sold a web security class via HN, very successfully -- because there are just so many people who are interested in it; it's the bread and butter of the industry nowadays. And anything privacy-oriented or seriously pwned always gets clicks and upvotes. But yeah, this stuff is good content but doesn't have much reach.
- rhexs 8y agoFor one, the article seems to be impossible to read on an iPhone via safari.
- kiddico 8y agoIt seems to break in a different way every time I reload the page.
- Icyphox 8y agoMind telling me which model? Could be my my piss poor CSS acting up at that resolution.
- xrisk 8y agoWhat's the issue? I'll message the author.
- danmg 8y agoAdd this to your iphone's rss reader: https://damng.github.io/hackernews-rss-with-inlined-content/output.rss https://damng.github.io/hackernews-rss-with-inlined-content/... Content will be made readable and inlined into the feed.
- benj111 8y agoI got here via the front page, which would seem to discredit your theory. Anyway VC funding doesn't necessarily equate to being interesting.
- dang 8y agoI'd have said it's of consistently high interest. What makes you say it isn't?
- qaq 8y agoI might be really off but it seems they rarely get more than 50 comments (unless it's some major breach).
- dang 8y agoDid you see https://news.ycombinator.com/item?id=19315273 https://news.ycombinator.com/item?id=19315273? It's just one data point but you might find it interesting. There is a pattern where highly specialized technical posts don't get as many comments, relative to votes. Possibly reverse engineering and other security-related specialties fall into this. One can see the same thing in e.g. articles about type theory: people are interested, but don't necessarily feel qualified to add to the discussion. That's probably good if it prevents the dumb sorts of comment from getting posted, but maybe the threads would be more valuable if more users would ask questions. Then the users who know could explain, and more learning would take place.
- pjc50 8y agoUpvotes and comments are very different; even commenting beyond a certain limit counts negatively towards the article's front page position. If you want a lot of comments start an argument.
- Icyphox 8y agoHi, I’m the author of this post. Feel free to ask questions, if any.
- 75dvtwin 8y agoif you could briefly outline the space/position of this framework, relative to others (eg https://github.com/cea-sec/miasm https://github.com/cea-sec/miasm ). Would very much appreciate. Also, besides security aspect (eg intrusion/virus detection), I was looking at these frameworks as a 'higher-level than assembler, and less hardware architecture dependent than LLVM IR) -- is there an angle where reverse engineering tools, have a separate live an better-than-assembler toolchain for low level programming?
- Icyphox 8y agoFor starters, the purpose of this post was never to build an entire framework, like the one you’ve linked, but rather a small set of scripts to try and understand what disassemblers do under the hood. These scripts can also be tossed into some kind of automation pipeline of sorts, something like a CI/CD perhaps. There's a lot you can (potentially) do. And your second question, I'm not sure I understand what you're attempting to convey.
- matmann2001 8y agoHey. In your C code, you write to memory beyond what you malloc'd. You malloc'd 9 bytes for 'pw', but later do "pw[9] = '\0'", which accesses the 10th byte, which doesn't belong to you.
- w0mbat 8y agoYes, that jumped off the page at me too, and distracted me from the rest of the article.
- matmann2001 8y agoEspecially given the topic, I kept jumping around to see if it was intentional. Like maybe they would use these RE tools to exploit it.
- saagarjha 8y ago> I’m not sure why it uses puts here? I might be missing something; perhaps printf calls puts. It’s because you passed a constant string to printf, so the compiler decided it was not worth making the call and used puts instead.
- Icyphox 8y agoThanks! I’d actually figured that out a little while after publishing.
- billfruit 8y agoIn general though, dealing with binary data in python isn't particularly intuitive.Also many python tutorials and books fails to mentioned how to manipulate binary data. I feel that is one of the places where the standard library is not that rich.
- civility 8y agoI disagree. The struct and array (not Numpy) modules are pretty great at cutting up binary data. You provide a format string and it just works.
- jgalt212 8y agoyour statement and his statement are both True (Python spelling variant). Of course, I don't think there are many books or tutorials geared towards beginners that deal with manipulating binary data. > Also many python tutorials and books fails to mentioned how to manipulate binary data
- vram22 8y agoMight be useful for beginners to binary file I/O in Python and reverse engineering of data formats: DBFReader.py [1], which is part of my xtopdf toolkit [2] is a program that uses struct.unpack() multiple times to decode the fields in a DBF (XBASE) file. [1] https://bitbucket.org/vasudevram/xtopdf/src/default/DBFReader.py https://bitbucket.org/vasudevram/xtopdf/src/default/DBFReade... [2] http://slides.com/vasudevram/xtopdf http://slides.com/vasudevram/xtopdf I had first written a Pascal program to read and dump DBF file data after reverse-engineering the DBF format, based on some sketchy info I had access to, years ago. Later wrote the same program in C, and later still in Python, i.e. DBFReader.py .
- billfruit 8y agoI thought, the format string is unintutive if there are nested binary structures or if there are arrays of nested binary structures.
- civility 8y ago
- monocasa 8y agoNeat! You can see some similar code I wrote in Rust here: https://github.com/monocasa/exeutils https://github.com/monocasa/exeutils
- RayDonnelly 8y agoIf you haven't seen it, also checkout Project LIEF. It is very good indeed. We use it for a lot of post-build binary verification in the conda ecosystem. Windows, macOS and Linux are all supported. https://lief.quarkslab.com/ https://lief.quarkslab.com/
- hultner 8y agoIs it just for me or is the scroll on this site horrible broken? Shame because the content looks great.
- bhargav 8y agoDefault behaviour seems to be overridden. I read the article and would recommend you look past the scrolling. If you are on an iDevixe, reader mode will help! Edit: Spelling