3

How to check if DEP, ASLR and SafeSEH defense mechanism are enabled or not in a program using immlib library of Python in Immunity Debugger ?

Actually I am looking for small code snippet for each.

3 Answers 3

5

You need to check the PE headers of the modules, the offset is dependent on the OS version (the settings can be different for the executable and each loaded DLL). You can look at the mona.py script for examples on how to do that. The script is very large but you should find what you are looking for in the class MnModule, for example the flag for ALSR is checked at line 1726. (Note: in this script dbglib is an abstraction class to support both Immunity Debugger and WinDBG, it maps directly to immlib).

Script source : http://redmine.corelan.be/projects/mona/repository/entry/mona.py

3
  • Good answer but i want a script that i can understand( i am a newbie ) . U can use pefile library also if you want.
    – in3o
    Jul 21, 2013 at 6:26
  • Link is currently dead Jan 5, 2021 at 2:28
  • mona is now hosted on github, github.com/corelan/mona
    – ekse
    Jan 6, 2021 at 3:14
2

If you are under GNU/Linux, you may want to look at checksec.sh. If you are under Windows, you could take at look at it; maybe you'll find some interesting stuff that you could backport in Python.

2

To add to @jvoisin's answer, you can have a look at checksec - python implementation of checksec.sh

Both these scripts are simple (compared to mona.py) and should help you get started.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.