Burt Triplett (burt@pbjtriplett.org)

Josh Triplett (josh@joshtriplett.org)

http://biosbits.org/

The Intel BIOS Implementation Test Suite (BITS) provides a bootable pre-OS environment for testing BIOSes and in particular their initialization of Intel processors, hardware, and technologies. BITS can verify your BIOS against many Intel recommendations. In addition, BITS includes Intel's official reference code as provided to BIOS, which you can use to override your BIOS's hardware initialization with a known-good configuration, and then boot an OS.

BITS supports scripting via Python, and includes Python APIs to access various low-level functionality of the hardware platform, including ACPI, CPU and chipset registers, PCI, and PCI Express. You can write scripts to explore and test platform functionality, using the full power of Python in 32-bit ring 0, without an OS in the way, and without recompiling BITS or writing custom C code.

???

Scripting Guide

Grugq (@thegrugq)

https://github.com/grugq/Buggery

WinDbg

Python wrapper for DbgEng.

SWFRETools

example

Ole André Vadla Ravnås (@oleavr)

http://frida.github.io/

Frida IRE (Interactive Reverse-engineering Environment) is an open source reversing tool focusing on scriptable dynamic instrumentation in userland.

cryptoshark
Lobotomy
Frida PluginFor Ida Pro
frida-tracer
frida-cfg-hook

Video from talks about Frida (1)
Video from talks about Frida (2)
Instrumenting Android Applications with Frida
Hooking Firefox with Frida
Objective-C Instrumentation with Frida

Vincent Bénony

http://www.hopperapp.com/

Hopper

Script engine for Hopper Disassembler.

Python Scripts for use with Hopper Disassembler

Hopper Script Reference

Gergely Erdelyi (http://gergelyerdelyi.com/)

Elias Bachaalany (@0xeb)

https://github.com/idapython/src/

IDA Pro (from 5.1)

IDAPython is an IDA Pro plugin that integrates the Python programming language, allowing scripts to run in IDA Pro. These programs have access to IDA Plugin API, IDC and all modules available for Python. The power of IDA Pro and Python provides a platform for easy prototyping of reverse engineering and other research tools.

IDA Toolbag
mynav
Dr. Gadget
rtti-helper-scripts
msdn-plugin-ida
ida2sql-plugin-ida
IDA file Patcher
Idagrapher
py-com-tools
Optimice
ida-decompiler
ida-images
Labeless
Stingray
FCatalog
dumpDex
radare2ida
depgraph
DIE
Sark
IdaRef
JARVIS
ScratchABit
binida
Frida PluginFor Ida Pro
Diaphora
DumpVTable
An IDA Pro Plugin for embedding an IPython Kernel
rizzo
Hex-Rays Decompiler Enhanced View (HRDEV)
ADB Qt Super version
slid
IDA Splode
BinSourcerer
IDASimulator
Thug
https://github.com/titze/apparecium
ida-efitools
IDASynergy
BinDiffFilter
CODEMAP
syms2elf
IDA Autoruns
Enoki
ret-sync
ida2neo

official documentation
IDAPython: User Scripting for a Complex Application
TOOLSMITHING AN IDA BRIDGE: A TOOL BUILDING CASE STUDY
blog entries about IDAPython
"Reverse Engineer's Cookbook" presentation
"Introduction to IDAPython" from OpenRCE
How to debug IDAPython scripts with PyCharm

Immunity, Inc.

http://www.immunityinc.com/products-immdbg.shtml

ImmunityDebugger

Immunity Debugger's Python API includes many useful utilities and functions. Your scripts can be as integrated into the debugger as the native code. This means your code can create custom tables, graphs, and interfaces of all sorts that remain within the Immunity Debugger user experience.

pvefindaddr
mona
call_reg_tracer

official documentation
presentation
cheatsheet by Corelan
forum

contact@kplugs.org

http://www.kplugs.org/

KPlugs is a Linux kernel module which provides an interface for dynamically executing scripts inside the Linux kernel. KPlugs uses a simple bytecode interpreter (the KPlugs Virtual Machine), and an interface that allows a user to dynamically load scripts into the kernel and execute them directly from user space. Because the interface is dynamic, it's easy to implement a user-mode library that wraps anything in the kernel!

KPlugs comes with a Python library that compiles a subset of the Python language to the KPlugs bytecode, and lets you easily load and execute your "kernel Python script".

The Python compiler is very basic and was made to fit our own purposes, but if it's not exactly what you are looking for, you can modify it to create your own subset.

???

Examples

University of Illinois/NCSA

http://lldb.llvm.org/

LLDB

lldb also has a built-in Python interpreter, which is accessible by the "script" command. All the functionality of the debugger is available as classes in the Python interpreter, so the more complex commands that in gdb you would introduce with the "define" command can be done by writing Python functions using the lldb-Python library, then loading the scripts into your running session and accessing them with the "script" command.

Example
LLDB python scripts

API
"LLDB Modular Debugging Infrastructure" presentation
LLDB — Python Reference
LLDB Scripting for Remote iOS Debugging

0vercl0k

https://github.com/0vercl0k

OllyDbg2

Scripting OllyDBG2 using Python.

???

???

Scott Knight (knightsc@gmail.com)

http://code.google.com/p/ollypython/

OllyDbg

OllyPython is an OllyDbg plugin that integrates the Python programming language, allowing scripts to run in OllyDbg.

???

sample of use in entry blog

Roberto Paleari (@rpaleari)

Lorenzo Martignoni (@martignlo)

Lorenzo Cavallaro (http://www.few.vu.nl/~sullivan/)

http://code.google.com/p/processtap/

PinTool, (Valgrind, QEMU, DinamoRIO)

ProcessTap is a dynamic tracing framework for analyzing closed sourceapplications. ProcessTap is inspired by DTrace and SystemTap, but it is specific for analyzing closed-source user-space applications. ProcessTap leverages dynamic binary instrumentation to intercept the events of interest (e.g., function calls, system call, memory accesses, and conditional control transfers). Although the current implementation relies on PinTool, alternative back-ends for instrumentation (e.g., Valgrind, Qemu, or DynamoRIO) can be used. The language used in ProcessTap for writing scripts to instrument applications is Python.

???

examples

???

https://github.com/cantora/py-eresi

ERESI

Python bindings for the eresi library.
The ERESI Reverse Engineering Software Interface is a multi-architecture binary analysis framework with a domain-specific language tailored to reverse engineering and program manipulation.

???

???

Rocky Bernstein

http://bashdb.sourceforge.net/pydb/

gdb

pydb is an expanded version of the Python debugger loosely based on the gdb command set and the stock Python debugger. It also has all of the features found in an earlier version of pydb.py that was distributed with the debugger GUI ddd.

???

official documentation

Botten, Michael Eddington (http://phed.org/)

Peter Silberman (@petersilberman)

http://sourceforge.net/projects/pydbgeng/

WinDdg

PyDbgEng is a Python Wrapper For Microsoft Debug Engine. Its features include: user mode debugging, kernel mode debugging, soft and hw breakpoints, symbol server and etc.

PyDbgExt
KStalker

usage examples
series of records in blog

Michael Eddington (mike@phed.org)

Frank Laub (frank.laub@gmail.com)

http://code.google.com/p/pygdb/

gdb

This is a simple python wrapper around GDB. pygdb is a pygtk interface to gdb. It offers two terminal windows, one for gdb, one for the process to be debugged. On the top it has standard buttons like run, continue, step in, step over, step out and quit. On a second window you can add watches and breakpoints. Furthermore, you can inspect the backtrace and launch gvim on the current executed line by pressing a button. pygdb stays synchronized with gvim (by using gvim --servername calls).

???

???

Elias Bachaalany (@0xeb)

http://code.google.com/p/pyhiew/

HIEW

PyHiew is a Hiew External Module that allows users to write Python scripts that interface with Hiew.

???

entries in blog about usage pyHIEW

ReWolf

http://dirty-joe.com/

dirtyJOE

dirtyJOE - Java Overall Editor is a complex editor and viewer for compiled java binaries (.class files).
dirtyJOE is using Python library as a script engine.

???

???

Team (http://pykd.codeplex.com/team/view)

http://pykd.codeplex.com/

WinDBG

Python extension for WinDbg. pykd not repeat functional from Debug Engine, and implements the API, convenient for daily work in WinDbg.

shadow
ALF
pyInspector
vtfinder
heap_trace
uni-trace

Official documentation
Blog about pykd (RU)
Soft Function Hooking with windbg and pykd

???

http://sourceware.org/gdb/wiki/PythonGdb (In gdb 7 it is already included)

Gdb

Integrate Python scripting into Gdb.

gdbxx
gdb-heap
runFuzzer
tmalloc_gdb
GDB-Python-Utils
GDB dashboard
unmask_jemalloc
Libheap
PEDA
P3DA
sb-gdb-extensions.py
pygdbdis

official tutorial
API
entry in blog
presentation from PyCON US 2011
In-memory-fuzzing in Linux (with GDB and Python)
Debugging C/C++ and CPython using GDB 7?s new Python extension support
overview of the Python API accessible from GDB
PythonGDB tutorial for reverse engineering - part 1
Debugging with GDB: How to create GDB Commands in Python
Hi gdb, this is python : break a VM crackme with class!
Breakpoint callbacks in LLDB Python scripts
S2 Dynamic tracer and decompiler for gdb

pancake (http://nopcode.org)

nibble.ds

earada (@earada)

https://github.com/radare/radare2-bindings

radare2

The second scripting language implemented in radare was 'python'. The python interface for C is not as nice as the LUA one, and it is obviously not as optimal as LUA, but it gives a very handy syntax and provides a full-featured list of libraries and modules to extend your script.

radare2ida
GEF
Collection of scripts for radare2

radare official site