Showing posts with label automation. Show all posts
Showing posts with label automation. Show all posts

Thursday, June 18, 2015

run idascript script to batch files

Problem


I had idapython script for extracting some data from file. And a lot of files, where from needed to extract these data.

Code


"C:\Program Files (x86)\IDA 6.8\idaw.exe" -Lfilename.log -A -S_try_script.py filename

it will open 'filename' in console ida and run script '_try_script.py'. In this script 'main' must be like that:

if __name__ == '__main__':
    idaapi.autoWait()
    my_analyze_func()
    Exit(0)


it waits to complete autoanalysis, executes script and exit. Ida console log will be in 'filename.log'.
So, you can use it from batch handling of the files.

self-unpacking archives from cmd

Problem


Recently I've needed to pack several files (exe+dll) into one executable, which after unpacking of content will run one of unpacked files. And do this with several bunches of files - so, console commands needed - not gui. It's some constant executable need to test with different dll


Tools

  • 7z
  • 7zS.sfx (I've found it in something like 7z-extra-922.7z)
  • Python


Action


First of all - you need to make file config.txt where you write program name, which must be run after unpacking (in my case I've needed to make dll think it's in IE, so my program name is 'iexplore.exe', but it's just executable, which loads 'current.dll' and waits)

;!@Install@!UTF-8!
Title="7-Zip 4.00"
Directory=""
RunProgram="%%T\\iexplore.exe"
;!@InstallEnd@!


it must be in UTF-8, so you can save it in UTF-8 from notepad.exe, for example.

and here are python script, where you can find all necessary tools & keys:

import shutil    # copy2
import os

filenames = [
'dll_00.dll',
'dll_01.dll',
'dll_02.dll',
]

def run():
    for filename in filenames:
        shutil.copy2(filename, './current.dll')
        os.system('"C:\\Program Files\\7-Zip\\7z.exe" a archive.7z ./iexplore.exe ./current.dll')
       
        destination = open(filename+'.sfx.exe', 'wb')
        shutil.copyfileobj(open(r"D:\tools\7z-extra-920\7zS.sfx", 'rb'), destination)
        shutil.copyfileobj(open(r"config.txt", 'rb'), destination)
        shutil.copyfileobj(open(r"archive.7z", 'rb'), destination)
        destination.close()
       
        os.system('sfx_handler '+filename+'.sfx.exe')
        os.remove('archive.7z')
        os.remove('current.dll')

if __name__ == '__main__':
    run()