Jonas Zaddach

Luca Bruno

http://www.s3.eurecom.fr/tools/avatar/

S²E

Avatar is an event-based arbitration framework that orchestrates the communication between an emulator and a target physical device. Avatar's goal is to enable complex dynamic analysis of embedded firmware in order to assist in a wide range of security-related activities including (but not limited to) reverse engineering, malware analysis, vulnerability discovery, vulnerability assessment, backtrace acquisition and root-cause analysis of known test cases.

???

???

Ero Carrera (@erocarrera)

https://github.com/zynamics/bochs-python-instrumentation

Bochs (2.4.5 and 2.4.6)

This patch for Bochs provides a Python interpreter instead of Bochs' own debugger, yet still providing the debugger functionality. It also allows to interact with the instrumentation interface on-demand, by dynamically associating Python methods to handle instrumentation events.

???

wiki
presentation

Grugq (@thegrugq)

https://github.com/grugq/Buggery

WinDbg

Python wrapper for DbgEng.

SWFRETools

example

SkyLined

https://github.com/SkyLined/BugId

BugId is a python script that runs an application in cdb.exe, a command-line debugger that is part of Microsoft's Debugging Tools for Windows. It interacts with cdb.exe to detect any potential bugs in the application, and analyzes them. When a bug is detected, detailed information is collected and an id is generated that should be unique and consistent for that particular bug. In other words, if you run the same application twice and trigger the same bug, the bug id should be the same.

The bug id can be useful when trying to determine whether two crashes have the same bug as their root cause. It is used in automated fuzzing frameworks to allow "bucketizing" crashes to skip known bugs and focus on bugs that have not been found before.

A human-readable report containing information collected about the bug is available in HTML format, for use when manually analyzing bugs. The code attempts to determine the security risk of the bug it detected, so even novice users may be able to determine whether or not a particular bug is likely to be a security vulnerability.

BugId can be used as a command-line utility through BugId.py and integrated into your own Python project using cBugId.py.

???

???

Simon Free

https://github.com/sipefree/d00ks

An ARM Assembler and Simulator/Debugger.

???

???

Gergely Erdelyi (http://gergelyerdelyi.com/)

Elias Bachaalany (@0xeb)

https://github.com/idapython/src/

IDA Pro (from 5.1)

IDAPython is an IDA Pro plugin that integrates the Python programming language, allowing scripts to run in IDA Pro. These programs have access to IDA Plugin API, IDC and all modules available for Python. The power of IDA Pro and Python provides a platform for easy prototyping of reverse engineering and other research tools.

IDA Toolbag
mynav
Dr. Gadget
rtti-helper-scripts
msdn-plugin-ida
ida2sql-plugin-ida
IDA file Patcher
Idagrapher
py-com-tools
Optimice
ida-decompiler
ida-images
Labeless
Stingray
FCatalog
dumpDex
radare2ida
depgraph
DIE
Sark
IdaRef
JARVIS
ScratchABit
binida
Frida PluginFor Ida Pro
Diaphora
DumpVTable
An IDA Pro Plugin for embedding an IPython Kernel
rizzo
Hex-Rays Decompiler Enhanced View (HRDEV)
ADB Qt Super version
slid
IDA Splode
BinSourcerer
IDASimulator
Thug
https://github.com/titze/apparecium
ida-efitools
IDASynergy
BinDiffFilter
CODEMAP
syms2elf
IDA Autoruns
Enoki
ret-sync
ida2neo

official documentation
IDAPython: User Scripting for a Complex Application
TOOLSMITHING AN IDA BRIDGE: A TOOL BUILDING CASE STUDY
blog entries about IDAPython
"Reverse Engineer's Cookbook" presentation
"Introduction to IDAPython" from OpenRCE
How to debug IDAPython scripts with PyCharm

Immunity, Inc.

http://www.immunityinc.com/products-immdbg.shtml

ImmunityDebugger

Immunity Debugger's Python API includes many useful utilities and functions. Your scripts can be as integrated into the debugger as the native code. This means your code can create custom tables, graphs, and interfaces of all sorts that remain within the Immunity Debugger user experience.

pvefindaddr
mona
call_reg_tracer

official documentation
presentation
cheatsheet by Corelan
forum

Samuel Chevet

Clement Rouault

https://github.com/sogeti-esec-lab/LKD

Local Kernel Debugger (LKD) is a python wrapper around dbgengine.dll

???

Slides

University of Illinois/NCSA

http://lldb.llvm.org/

LLDB

lldb also has a built-in Python interpreter, which is accessible by the "script" command. All the functionality of the debugger is available as classes in the Python interpreter, so the more complex commands that in gdb you would introduce with the "define" command can be done by writing Python functions using the lldb-Python library, then loading the scripts into your running session and accessing them with the "script" command.

Example
LLDB python scripts

API
"LLDB Modular Debugging Infrastructure" presentation
LLDB — Python Reference
LLDB Scripting for Remote iOS Debugging

blankwall

https://github.com/blankwall/MacDBG

Mac Debugger was created with the focus on giving the programmer a powerful framework to programatically create scripts to debug programs on Mac OSX not found in other products for the platform.

The core of macdbg, written in C, is kept as minimal as possible to provide enough basic interaction between the kernel and userland to create powerful features. Higher level functionality is left to the Python implementation such as stack tracing, dissasembly, watchpoints, thread state, and more. A wrapper class is provided for the programmer to create a scripting program.

???

OSX VULNERABILITY RESEARCH AND WHY WE WROTE OUR OWN DEBUGGER

Assaf Nativ

https://github.com/assafnativ/NativDebugging

Debugging tools wrapped in Python enviourment.

???

???

0vercl0k

https://github.com/0vercl0k

OllyDbg2

Scripting OllyDBG2 using Python.

???

???

Scott Knight (knightsc@gmail.com)

http://code.google.com/p/ollypython/

OllyDbg

OllyPython is an OllyDbg plugin that integrates the Python programming language, allowing scripts to run in OllyDbg.

???

sample of use in entry blog

Chema Garcia

https://github.com/sch3m4/pyadb

ADB

Simple python module to interact with the ADB tool

???

Example

Doug Shikashio

https://github.com/dshikashio/Pybag

CPython module for Windbg's dbgeng plus additional wrappers. Pybag combines MS DebugEngine bindings with additional helper functions for a powerful Windows debugging module.

???

???

Rocky Bernstein

http://bashdb.sourceforge.net/pydb/

gdb

pydb is an expanded version of the Python debugger loosely based on the gdb command set and the stock Python debugger. It also has all of the features found in an earlier version of pydb.py that was distributed with the debugger GUI ddd.

???

official documentation

Pedram Amini (@pedramamini)

https://github.com/OpenRCE/pydbg (part of PaiMei)

PyDbg exposes most of the expected debugger functionality and then some. Hardware / software / memory breakpoints, process / module / thread enumeration and instrumentation, system DLL tracking, memory reading/writing and intelligent dereferencing, stack and SEH unwinding, exception and event handling, endian manipulation routines, memory snapshot
and restore functionality, disassembly (libdasm) engine. The abstracted interface allows for painless development of custom debugger scripts.

PaiMei
In Memory Fuzzing
Blocks
Pydbg64
egurra
PyMal

official documentation
Hacking Leopard: Tools and Techniques for Attacking
Install PaiMei on Snow Leopard
How to use PyDbg as a powerful multitasking debugger
PaiMei on python25 (video)
Paimei From Svn, Idapython 0.8.0/Ida4.9Free, And Python 2.7.1 (video)

Botten, Michael Eddington (http://phed.org/)

Peter Silberman (@petersilberman)

http://sourceforge.net/projects/pydbgeng/

WinDdg

PyDbgEng is a Python Wrapper For Microsoft Debug Engine. Its features include: user mode debugging, kernel mode debugging, soft and hw breakpoints, symbol server and etc.

PyDbgExt
KStalker

usage examples
series of records in blog

Rocky Bernstein

https://github.com/rocky/python2-trepan

gdb

A rewrite of pydb from the ground up.

???

Installing and Using pydbgr

Michael Eddington (mike@phed.org)

Frank Laub (frank.laub@gmail.com)

http://code.google.com/p/pygdb/

gdb

This is a simple python wrapper around GDB. pygdb is a pygtk interface to gdb. It offers two terminal windows, one for gdb, one for the process to be debugged. On the top it has standard buttons like run, continue, step in, step over, step out and quit. On a second window you can add watches and breakpoints. Furthermore, you can inspect the backtrace and launch gvim on the current executed line by pressing a button. pygdb stays synchronized with gvim (by using gvim --servername calls).

???

???

Antonio Cuni

https://bitbucket.org/antocuni/pygdb2/

Gdb

pygdb2 is a python module which allows you to send commands to the underlying gdb process. For example, it can be used to automatically and programmatically add breakpoints and watchpoints.

???

???

Team (http://pykd.codeplex.com/team/view)

http://pykd.codeplex.com/

WinDBG

Python extension for WinDbg. pykd not repeat functional from Debug Engine, and implements the API, convenient for daily work in WinDbg.

shadow
ALF
pyInspector
vtfinder
heap_trace
uni-trace

Official documentation
Blog about pykd (RU)
Soft Function Hooking with windbg and pykd

Rich Smith (mynameismeerkat@gmail.com)

https://github.com/MyNameIsMeerkat/pyREtic

pyREtic and the REpdb debugger allow easier access to obtaining source from closed source Python applications. In a nutshell it allows you to take a object in memory back to source code, without needing access to the bytecode directly on disk. This can be useful if the applictions pyc's on disk are obfuscated in one of many ways.

???

whitepaper
slides from BlackHat/Defcon 2010

AmrThabet

https://github.com/AmrThabet/pySRDF

The Security Research and Development Framework

This Project is a the python implementation for The Security Research and Development Framework
This Project includes:
1. PE Parser
2. Process analyzer, DLL Injector
3. Debugger
4. x86 Emulator for binary files and shellcodes

???

Examples

Ryan Brady

https://github.com/rbrady/python-adb

python-adb is an MIT-licensed, open source python library to integrate some features from the Android Debug Bridge.

???

???

Victor Stinner (@victor_stinner)

http://pypi.python.org/pypi/python-ptrace

python-ptrace is a debugger using ptrace (Linux, BSD and Darwin system call to trace processes) written in Python.

Fuzil

wiki

???

http://sourceware.org/gdb/wiki/PythonGdb (In gdb 7 it is already included)

Gdb

Integrate Python scripting into Gdb.

gdbxx
gdb-heap
runFuzzer
tmalloc_gdb
GDB-Python-Utils
GDB dashboard
unmask_jemalloc
Libheap
PEDA
P3DA
sb-gdb-extensions.py
pygdbdis

official tutorial
API
entry in blog
presentation from PyCON US 2011
In-memory-fuzzing in Linux (with GDB and Python)
Debugging C/C++ and CPython using GDB 7?s new Python extension support
overview of the Python API accessible from GDB
PythonGDB tutorial for reverse engineering - part 1
Debugging with GDB: How to create GDB Commands in Python
Hi gdb, this is python : break a VM crackme with class!
Breakpoint callbacks in LLDB Python scripts
S2 Dynamic tracer and decompiler for gdb

Rocky Bernstein (rocky@gnu.org)

http://code.google.com/p/pytracer/

A more flexible interface to sys.settrace allowing, for example, chained trace hooks. We allow several trace hooks to get registered and unregistered and allow tracing to be turned on and off temporarily without losing the trace hooks. You can also indicate filters on events for which trace hooks should fire and mark methods that should automatically be ignored.

???

???

Doug Shikashio

https://github.com/dshikashio/pywindbg

Pywindbg is a Windbg extension that embeds a Python interpreter into the Windbg console. Currently does not interact with the debugging session. Requires dbgeng bindings available separately.

???

???

invisigoth kenshoto (@invisig0th)

http://visi.kenshoto.com/viki/MainPage

vtrace is a cross-platform debugging api written in python. Each supported platform has it's own support module.

vdebug
Nightmare

entry in blog
vtrace script examples
MindshaRE: Another Approach To Tracking ReadFile
Listing an executable's IAT with VDB

Mario Vilas (@Mario_Vilas)

https://github.com/MarioVilas/winappdbg

The WinAppDbg python module allows developers to quickly code instrumentation scripts in Python under a Windows environment.

Tools
PyPEELF
memfuzzing
Wadi
NaFl
MemoryPatchDetector
PyKit
HWP Document Fuzzer
simple-x86-decompiler
spooky-hook
unpacker
RPCSniffer

programming guide

x64dbg

https://github.com/x64dbg/x64dbg-python

Automating x64dbg using Python.

???

???