3

How to check if DEP, ASLR and SafeSEH defense mechanism are enabled or not in a program using immlib library of Python in Immunity Debugger ?

Actually I am looking for small code snippet for each.

5

You need to check the PE headers of the modules, the offset is dependent on the OS version (the settings can be different for the executable and each loaded DLL). You can look at the mona.py script for examples on how to do that. The script is very large but you should find what you are looking for in the class MnModule, for example the flag for ALSR is checked at line 1726. (Note: in this script dbglib is an abstraction class to support both Immunity Debugger and WinDBG, it maps directly to immlib).

Script source : http://redmine.corelan.be/projects/mona/repository/entry/mona.py

| improve this answer | |
  • Good answer but i want a script that i can understand( i am a newbie ) . U can use pefile library also if you want. – in3o Jul 21 '13 at 6:26
2

If you are under GNU/Linux, you may want to look at checksec.sh. If you are under Windows, you could take at look at it; maybe you'll find some interesting stuff that you could backport in Python.

| improve this answer | |
2

To add to @jvoisin's answer, you can have a look at checksec - python implementation of checksec.sh

Both these scripts are simple (compared to mona.py) and should help you get started.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.