How to check if DEP, ASLR and SafeSEH defense mechanism are enabled or not in a program using
immlib library of Python in Immunity Debugger ?
Actually I am looking for small code snippet for each.
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
You need to check the PE headers of the modules, the offset is dependent on the OS version (the settings can be different for the executable and each loaded DLL). You can look at the mona.py script for examples on how to do that. The script is very large but you should find what you are looking for in the class MnModule, for example the flag for ALSR is checked at line 1726. (Note: in this script dbglib is an abstraction class to support both Immunity Debugger and WinDBG, it maps directly to immlib).
Script source : http://redmine.corelan.be/projects/mona/repository/entry/mona.py
If you are under GNU/Linux, you may want to look at checksec.sh. If you are under Windows, you could take at look at it; maybe you'll find some interesting stuff that you could backport in Python.
To add to @jvoisin's answer, you can have a look at checksec - python implementation of checksec.sh
Both these scripts are simple (compared to mona.py) and should help you get started.