Python3 Tips For Reverse Engineers

Five tips to level up your reverse engineering with Python 3. Expand for more...

-----
OALABS DISCORD

OALABS PATREON

OALABS TIP JAR

OALABS GITHUB

UNPACME - AUTOMATED MALWARE UNPACKING

-----
Chapters:
0:44 Tip 1. Use Jupyter Notebooks and Github
5:16 Tip 2. Remember Byte Strings Are Not Strings
8:46 Tip 3. Hex Encode Binary Data For Easy Copying Between Tools
12:02 Tip 4. Use Struct To Extract Types From Binary Data
16:28 Tip 5. Use Custom Struct Classes To Parse Binary Streams

Automated unpacking:

OALabs Jupyter Notebooks:

Feedback, questions, and suggestions are always welcome : )

#ReverseEngineering #Python #HowTo

[jeremyng]

For tip 2, and this has happened to me before, a better encoding is latin-1 bcus it allows encoding of byte from 0x00 to 0xff.

it is encoding bcus the human readable character is encoded into different byte results depending on the encoding type (i.e., ascii vs unicode where unicode, if im not mistaken, takes 4 bytes)

based on the byte-strings u have, u decode it so that it decodes into a human readable format, depending what type u are using

back to why i think using latin-1 is better is because it doesnt screws up with the encoding.
from experience, i was trying to reverse a ransomware and this encoding decoding with utf-8 screwed up my file and i ended up spending 3 days trying to figure out why. turns out latin-1 is the superior choice. :')

EDIT: made a small mistake on encoding explanation

[cybercdh]

great tips - loved Tip1, I've never used Jupyter but this makes me want to get organised!

[yhmark]

Excellent tips there I am sure to organize all my snippets of Python scripts into Jyptyer! This will improve my workflow! Thank you for all the details in there!

[amanda_bynes]

holy shit dude you are going hard in the paint at it here i'm overwhelmed but now if you stop imma be sad af

[CucamongaGuy]

I love me some markdown, awesome tips!

[awesomesauce]

Hi @OALabs. I have a general question that I thought you or a viewer can help answer for me. A lot of my work lately has been reverse engineering. NET assemblies. One thing I have learned ( the hard way I think ), is that it's usually better to approach a .NET assembly by decompiling it and then patching instead of trying to make changes dynamically while the program is running. My question to you is the following; how should I approach writing a patch for a .NET assembly. I have seen helper libraries based on dnlib like dnpatch and while that looks exciting I have a strong opinion that it's important to learn the foundation before using a utility like dnpatch. Is there a correct and industry standard approach to patching? I think what I may be asking is, "what is the best way to assemble"? Thanks in advance for anyone who has the time to answer.

[FreeDomSy-nkue]

28:12 LOL xD
That was helpful. Even though I've never worked with python 2.7

[Hacker-at-Large]

Tip #4 improved: ```value, = struct.unpack_from(“!L”, bytestring)```

[ElliyahuRosha]

I use pwntools for binary exploitation, it has great features.
Once u do that, u never go back to "struct" again ;)

[TheConstitutionalGuardian]

strings to bytes seems non trivial in regards to encoding; otherwise, great content.

[romanemul]

Im desperately waiting for youtube to implement zoom function.

[danzosow]

We can't see the text it's great articles

[spaderkungskuk]

Zoom in to the 25% of screen used please

[sakari_n]

Programming languages without static type system are unholy abominations and crime against engineering. Also UTF-8 BOM is a thing, not a smart nor always used thing, but it is still a thing.