Simple Python byte pattern finder
I initially wanted to bypass Flutter's SSL pinning using [this script](https://github.com/NVISOsecurity/disable-flutter-tls-verification/tree/main). It works by scanning the memory at runtime to find `libflutter.so` and the possible location of `ssl_verify_peer_cert` using byte pattern. The script didn't work because my target hates memory scanning :'). So I created this Python script to simply do the same thing and obtain the offsets I needed. ```python import re # we have plenty of memory, so.. with open("../libflutter.so", "rb") as f: data = f.read().hex() # Thanks to https://github.com/NVISOsecurity/disable-flutter-tls-verification patterns = [ "F? 0F 1C F8 F? 5? 01 A9 F? 5? 02 A9 F? ?? 03 A9 ?? ?? ?? ?? 68 1A 40 F9", "F? 43 01 D1 FE 67 01 A9 F8 5F 02 A9 F6 57 03 A9 F4 4F 04 A9 13 00 40 F9 F4 03 00 AA 68 1A 40 F9", "FF 43 01 D1 FE 67 01 A9 ?? ?? 06 94 ?? 7? 06 94 68 1A 40 F9 15 15 41 F9 B5 00 00 B4 B6 4A 40 F9", ] for p in patterns: p = p.lower().replace("?", "[a-f0-9]").replace(" ", "") for match in re.finditer(p, data): start, end = match.span() print(f"Found match! 0x{start // 2:x} - 0x{end // 2:x}: {data[start:end]}") ``` I don't know why but the file offset is different than the program offset in Ghidra (loaded address is +0x1000), so I still need to use Ghidra's instruction pattern finder to locate the function address offset in memory. I think it's because the file is not loaded "as is" to the memory.. maybe, need to revisit ELF docs.Created: 2025-05-24 18:00:44, Updated: 2025-05-24 18:00:44, ID: 46d2fb91-25e4-4356-98ea-6e2772b5781a