lcat
My personal /var/log
  • Home
  • Contact
  • HackMe!

Simple Python byte pattern finder

I initially wanted to bypass Flutter's SSL pinning using [this script](https://github.com/NVISOsecurity/disable-flutter-tls-verification/tree/main). It works by scanning the memory at runtime to find `libflutter.so` and the possible location of `ssl_verify_peer_cert` using byte pattern. The script didn't work because my target hates memory scanning :'). So I created this Python script to simply do the same thing and obtain the offsets I needed.

```python
import re

# we have plenty of memory, so..

with open("../libflutter.so", "rb") as f:
    data = f.read().hex()

# Thanks to https://github.com/NVISOsecurity/disable-flutter-tls-verification
patterns = [
    "F? 0F 1C F8 F? 5? 01 A9 F? 5? 02 A9 F? ?? 03 A9 ?? ?? ?? ?? 68 1A 40 F9",
    "F? 43 01 D1 FE 67 01 A9 F8 5F 02 A9 F6 57 03 A9 F4 4F 04 A9 13 00 40 F9 F4 03 00 AA 68 1A 40 F9",
    "FF 43 01 D1 FE 67 01 A9 ?? ?? 06 94 ?? 7? 06 94 68 1A 40 F9 15 15 41 F9 B5 00 00 B4 B6 4A 40 F9",
]

for p in patterns:
    p = p.lower().replace("?", "[a-f0-9]").replace(" ", "")
    for match in re.finditer(p, data):
        start, end = match.span()
        print(f"Found match! 0x{start // 2:x} - 0x{end // 2:x}: {data[start:end]}")
```

I don't know why but the file offset is different than the program offset in Ghidra (loaded address is +0x1000), so I still need to use Ghidra's instruction pattern finder to locate the function address offset in memory. I think it's because the file is not loaded "as is" to the memory.. maybe, need to revisit ELF docs.
Created: 2025-05-24 18:00:44, Updated: 2025-05-24 18:00:44, ID: 46d2fb91-25e4-4356-98ea-6e2772b5781a