How to check if DEP, ASLR and SafeSEH defense mechanism are enabled or not in a program using immlib library of Python in Immunity Debugger ?
Actually I am looking for small code snippet for each.
Add a comment
|
3 Answers
You need to check the PE headers of the modules, the offset is dependent on the OS version (the settings can be different for the executable and each loaded DLL). You can look at the mona.py script for examples on how to do that. The script is very large but you should find what you are looking for in the class MnModule, for example the flag for ALSR is checked at line 1726. (Note: in this script dbglib is an abstraction class to support both Immunity Debugger and WinDBG, it maps directly to immlib).
Script source : http://redmine.corelan.be/projects/mona/repository/entry/mona.py
-
Good answer but i want a script that i can understand( i am a newbie ) . U can use pefile library also if you want.– in3oJul 21, 2013 at 6:26
-
-
If you are under GNU/Linux, you may want to look at checksec.sh. If you are under Windows, you could take at look at it; maybe you'll find some interesting stuff that you could backport in Python.
To add to @jvoisin's answer, you can have a look at checksec - python implementation of checksec.sh
Both these scripts are simple (compared to mona.py) and should help you get started.
