I try to use a simple hook on different memory allocation functions in Immunity. But the hook doesn't react at all (no logging).
First of all my hook class:
class AllocHook(LogBpHook): def __init__(self): LogBpHook.__init__(self) def run(self, regs): imm = immlib.Debugger() imm.log(" ++++++++++++++++++ HOOOKED") imm.log(str(regs)) imm.log(" ++++++++++++++++++ HOOOKED")
The function to init and add the hook.
def hookAlloc(imm): global vAllocHo # Retrieve address of Allocs # Create hook object and add hook va1 = imm.getAddress("kernel32.LocalAlloc") vAllocHo = AllocHook() vAllocHo.add("va alloc",va1) vAllocHo.enable()
log appears in the breakpoint window, but the
run() function actually never gets called.
Breakpoints, item 26 Address=76C91668 kernel32.LocalAlloc Module=kernel32 Active=Log Disassembly=MOV EDI,EDI
The log messages of the breakpoints are at least disappearing when the hook is activated. For example, after activating the hook, the following logging messages are not displayed anymore:
Log data, item 40 Address=76C91668 Message=[19:12:51] Breakpoint at kernel32.LocalAlloc
Are there special settings in the options left, which I have to consider first?