Hooking in Immunity - LogBpHook not working

Question

I try to use a simple hook on different memory allocation functions in Immunity. But the hook doesn't react at all (no logging).

First of all my hook class:

class AllocHook(LogBpHook):
    def __init__(self):
        LogBpHook.__init__(self)

    def run(self, regs):
        imm = immlib.Debugger()
        imm.log("     ++++++++++++++++++ HOOOKED")
        imm.log(str(regs))
        imm.log("     ++++++++++++++++++ HOOOKED")

The function to init and add the hook.

def hookAlloc(imm):
    global vAllocHo
    # Retrieve address of Allocs
    # Create hook object and add hook
    va1 = imm.getAddress("kernel32.LocalAlloc")
    vAllocHo = AllocHook()
    vAllocHo.add("va alloc",va1)
    vAllocHo.enable()

So the log appears in the breakpoint window, but the run() function actually never gets called.

Breakpoints, item 26
Address=76C91668 kernel32.LocalAlloc
Module=kernel32
Active=Log
Disassembly=MOV EDI,EDI

The log messages of the breakpoints are at least disappearing when the hook is activated. For example, after activating the hook, the following logging messages are not displayed anymore:

Log data, item 40
Address=76C91668 
Message=[19:12:51] Breakpoint at kernel32.LocalAlloc

Are there special settings in the options left, which I have to consider first?

Answer 1

In the heat of the moment I didn't start Immunity as an Administrator. So missing privileges have caused this behaviour during the debugging process.