0

I'm trying to use immunity debugger to step through a confusing binary. When I open it in IDA Pro, I see certain addresses next to the instructions:

.text:01001392                 inc     eax

When I execute the binary, it simply executes and produces no output. So, I want to put a breakpoint at that line to step through.

But Immunity says:

No memory on the specified address

When I search that specific address. How do I add a breakpoint in immunity to the this line in IDA?

1

This could be ASLR (Address Space Layout Randomization). It randomly changes the base address for binaries so people cannot rely on fixed addresses if they try to write an exploit.

There are a few ways to disable it, some global, some for specific executables.

The easiest way to disable it for a single executable is opening it in a PE editor and removing/renaming the .reloc section - it is required to move the code around and if it isn't present, the base address from the header will be honored by the loader.

Or to disable it for the whole system, use regedit to add this value:

“MoveImages”=dword:00000000

under this key:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management]

and then reboot.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.