Axel Tillequin

https://github.com/bdcht/amoco

Amoco is a python package dedicated to the (static) analysis of binaries.
It features:
- a generic framework for decoding instructions, developed to reduce the time needed to implement support for new architectures.
- a symbolic algebra module which allows to describe the semantics of every instructions and compute a functional representation of instruction blocks.
- a generic execution model wich provides an abstract memory model to deal with concrete or symbolic values transparently, and other system-dependent features.
- various classes implementing usual disassembly techniques like linear sweep, recursive traversal, or more elaborated techniques like path-predicate which relies on SAT/SMT solvers to proceed with discovering the control flow graph or even to implement techniques like DARE (Directed Automated Random Exploration).
- various generic "helpers" and arch-dependent pretty printers to allow custom look-and-feel configurations (think AT&T vs. Intel syntax, absolute vs. relative offsets, decimal or hex immediates, etc).

AmocoPlugin
look_for_gadgets_with_equations.py

???

Anthony Desnos (@adesnos)

https://github.com/androguard/androguard

Description : Androguard is mainly a tool written in python to play with Android :
- Dex (Dalvik virtual machine) (.dex), and ODex (disassemble, decompilation),
- APK (Android application) (.apk),
- Android's binary xml (.xml).

maldrolyzer
Lobotomy
StaDynA
Thug
Hooker
ADVDroid
AndroBugs Framework

Documentation
Androguard: A simple step by step guide

Mario Vilas (@Mario_Vilas)

http://pypi.python.org/pypi/BeaEnginePython/

BeaEngine (http://www.beaengine.org/)

BeaEngine disassembler bindings for Python.

RopMount
simple-x86-decompiler

Installers for BeaEnginePython, Pymsasid and PyDasm

NGUYEN Anh Quynh

http://www.capstone-engine.org/index.html

Capstone

Capstone is a lightweight multi-platform, multi-architecture disassembly framework.

archinfo
binch
unicorn-decoder
MemoryPatchDetector
mpesm
Angr
decompiler
GEF
reverse
ARMSCGen
BARF
pyreil
ARM Roper
Qiew
MyRop
fREedom

Showcase

Jurriaan Bremer (@skier_t)

https://github.com/jbremer/darm

Darm

A light-weight and efficient disassembler written in C for the ARMv7 instruction set.

Durmu
sefi
freezing-bear

Description

distorm, Gil Dabah (arkon@ragestorm.net)

https://pypi.python.org/pypi/distorm3

diStorm3 binary stream disassembler library project.

Wadi
FastIR Collector
sefi
Ocean

API Hooking in Python

Pierre-Marie de Rodat

https://bitbucket.org/pmderodat/frasm

The need of an assembler for a special architecture is not so unusual. When reverse-engineering some random machine or software, one often need to write an assembler: this enables one to produce bytecodes in order to test a virtual machine, or the behavior of some architecture.
FrASM aims to simplify and speed up the conception of simple assemblers: one need only to provide a description of the instruction set and their operands, maybe to write some hooks and to give opcode and binary format output code; FrASM takes care of lexing, parsing, sections sorting, symbols resolution and final binary output.

???

???

Vincent Bénony

http://www.hopperapp.com/

Hopper

Script engine for Hopper Disassembler.

Python Scripts for use with Hopper Disassembler

Hopper Script Reference

Gergely Erdelyi (http://gergelyerdelyi.com/)

Elias Bachaalany (@0xeb)

https://github.com/idapython/src/

IDA Pro (from 5.1)

IDAPython is an IDA Pro plugin that integrates the Python programming language, allowing scripts to run in IDA Pro. These programs have access to IDA Plugin API, IDC and all modules available for Python. The power of IDA Pro and Python provides a platform for easy prototyping of reverse engineering and other research tools.

IDA Toolbag
mynav
Dr. Gadget
rtti-helper-scripts
msdn-plugin-ida
ida2sql-plugin-ida
IDA file Patcher
Idagrapher
py-com-tools
Optimice
ida-decompiler
ida-images
Labeless
Stingray
FCatalog
dumpDex
radare2ida
depgraph
DIE
Sark
IdaRef
JARVIS
ScratchABit
binida
Frida PluginFor Ida Pro
Diaphora
DumpVTable
An IDA Pro Plugin for embedding an IPython Kernel
rizzo
Hex-Rays Decompiler Enhanced View (HRDEV)
ADB Qt Super version
slid
IDA Splode
BinSourcerer
IDASimulator
Thug
https://github.com/titze/apparecium
ida-efitools
IDASynergy
BinDiffFilter
CODEMAP
syms2elf
IDA Autoruns
Enoki
ret-sync
ida2neo

official documentation
IDAPython: User Scripting for a Complex Application
TOOLSMITHING AN IDA BRIDGE: A TOOL BUILDING CASE STUDY
blog entries about IDAPython
"Reverse Engineer's Cookbook" presentation
"Introduction to IDAPython" from OpenRCE
How to debug IDAPython scripts with PyCharm

Immunity, Inc.

http://www.immunityinc.com/products-immdbg.shtml

ImmunityDebugger

Immunity Debugger's Python API includes many useful utilities and functions. Your scripts can be as integrated into the debugger as the native code. This means your code can create custom tables, graphs, and interfaces of all sorts that remain within the Immunity Debugger user experience.

pvefindaddr
mona
call_reg_tracer

official documentation
presentation
cheatsheet by Corelan
forum

Immunity Inc., atlas (atlas@r4780y.com)

Matthew Carpenter (mcarpenter@intelguardians.com)

http://www.immunitysec.com/resources-freesoftware.shtml

Libdisassembly is simply a python library for disassembling x86 opcodes. It has been made for Immunity's PDB Project (a vulnerability development focused debugger), and is partially based on mammon libdisasm opcode list. There is still a lot of work to do with the Metadata, but the library tries to return as much information it can get off of an opcode.

???

???

University of Illinois/NCSA

http://lldb.llvm.org/

LLDB

lldb also has a built-in Python interpreter, which is accessible by the "script" command. All the functionality of the debugger is available as classes in the Python interpreter, so the more complex commands that in gdb you would introduce with the "define" command can be done by writing Python functions using the lldb-Python library, then loading the scripts into your running session and accessing them with the "script" command.

Example
LLDB python scripts

API
"LLDB Modular Debugging Infrastructure" presentation
LLDB — Python Reference
LLDB Scripting for Remote iOS Debugging

Serpilliere (serpilliere@droids-corp.org)

https://github.com/cea-sec/miasm

Miasm is a a free and open source reverse engineering framework. Miasm aims at analyzing/modifying/generating binary programs. Miasm embed its own disassembler, intermediate language and instruction semantic. To emulate code, it uses libtcc to jit C code generate from intermediate representation. It can emulate shellcodes, parts of binaries. Python callback can be executed to emulate library functions.

smiasm
depgraph
symbol_exec
Sibyl

Miasm (incomprehensible documentation)
Rebuilding a cleaned & working binary (Re150 part 2)
Dynamic shellcode analysis

???

https://github.com/cantora/py-eresi

ERESI

Python bindings for the eresi library.
The ERESI Reverse Engineering Software Interface is a multi-architecture binary analysis framework with a domain-specific language tailored to reverse engineering and program manipulation.

???

???

Sebastian Muniz ‏(@_topo)

Fernando Russ

https://github.com/Groundworkstech/pybfd

A Python interface to the GNU Binary File Descriptor (BFD) library.
It's a complete (or at least tries to be) wrapper around the low level functionality provided by GNU Binutils libopcodes and libbfd. This allows the user to manipulate all the supported architectures and file formats that Binutils tools does.

Reimplementation of objdump in python
BARF

???

Ero Carrera (@erocarrera)

http://dkbza.org/pydasm.html

libdasm

pydasm is a python wrapper for libdasm. It attempts to capture all the functionality of libdasm and bring its versatility to Python.

PaiMei
PyPEELF
pynary

precompiled Windows binaries
"Win32 Static Analysis in Python" presentation
"4 x 5: Reverse Engineering Automation with Python" presentation

Francois Lalande

Francois-Xavier Oxeda

Edouard Fajnzilberg

Kevin Szkudlapski

https://github.com/wisk/medusa

Medusa (http://eip.epitech.eu/2012/medusa/)

Medusa is an interractive disassembler available on multiple operating systems (MS Windows, GNU/Linux, *BSD, etc). It is a free software. Medusa permit to convert machine code into human readable entities, to apply heuristics in order to improve code clearness and to handle these heuristics to apply its own code analysis. Its modular design permit to handle
different executable file formats (PE, ELF, RAW, etc) and different architectures (Intel, ARM, etc) by the means of plugins. Differents views are usable in the graphical user interface. The views permit to see the character strings in the executable file, the list of imported and exported functions, etc. One example of a view, the control flow graph, allows for better viewing of the different parts of the execution flow and therefore to undertand more quickly the internal mechanism of the executable file.

???

How to emulate executable with Medusa and python (part 0)

Joxean Piti

https://github.com/joxeankoret/pyew

Pyew is a (command line) python tool like radare and *iew oriented, mainly, to analyze malware. It does have support for hexadecimal viewing, disassembly (Intel 16, 32 and 64 bits), PE and ELF file formats (it does code analysis the right way), following direct call/jmp instructions, OLE2 format, PDF format (limited) and more. It also supports plugins to add more features to the tool.

???

entries in blog about usage pyew

Elias Bachaalany (@0xeb)

http://code.google.com/p/pyhiew/

HIEW

PyHiew is a Hiew External Module that allows users to write Python scripts that interface with Hiew.

???

entries in blog about usage pyHIEW

Matthieu Kaczmarek (tecamac@gmail.com)

Daniel Reynaud (reynaud.daniel@gmail.com)

http://code.google.com/p/pymsasid/

Pym's is a pure python disassembly library. It is merely a port of udis86 to python.

???

online disassemble
project with setup

inaz2 (@inaz2)

https://github.com/inaz2/roputils

A Return-oriented Programming toolkit.

???

???

???

https://github.com/huku-/pyxed

pyxed is a Python extension that uses Intel's XED2 library to decode x86 instructions. It is designed to be a wrapper around XED's C API and, as such, it doesn't provide any high level abstractions.

XDE

???