As malware are often packed, I'm looking to automate some of the unpacking tasks when that's possible.

In order to do that, I thought that OllyScript was an interesting way to write unpacking script for each packer that I have to deal with. But the first packer example for which I would like to write such script brings a "Bad or unknown format of 32 bits executable" error in Ollydbg/ImmunityDbg.

As there is not that problem in OllyDbg2 I thought that OllyScript+OllyDbg2 will be perfect, but OllyScript doesn't seems to have a version for OllyDbg2...

What kind of "scripting engine" do you suggest me in order to write unpacking scripts ?

  • 1
    FYI You usually can fix these incompatibility problems of OllyDbg 1 by using the OllyAdvanced plugin.
    – Ange
    Commented Nov 11, 2013 at 11:17
  • I known that an OllyDbg plugin was fixing some bugs, but I wasn't able to remember its name. Thanks
    – Steeve
    Commented Nov 11, 2013 at 11:32

1 Answer 1


Well, if you are using ImmunityDbg, have a look at using Python to write your unpacking scripts. With ImmunityDbg, Python scripting support is built-in.

An additional benefit of focusing on Python (instead of OllyScript) is that if you begin using a IDA Pro with IDAPython, your scripts will convert much more easily.

If you are not familiar with how to write an unpacker in Python, have a look at Gray Hat Python. The book doesn't show you exactly how to write an unpacker, but demonstrates how to work with (from Python) PE files, call into the Windows API, write a debugger, and other related tasks.

Immunity Debugger's Python API includes many useful utilities and functions. Your scripts can be as integrated into the debugger as the native code. This means your code can create custom tables, graphs, and interfaces of all sorts that remain within the Immunity Debugger user experience. For example, when the Immunity SafeSEH script runs, it outputs the results into a table within the Immunity Debugger window.

enter image description here

  • 1
    I agree that ImmDbg is quite interesting for its Python API but it suffer to similar problems than OllyDBG (some troubles to load some "malformed" PE files)
    – Steeve
    Commented Nov 12, 2013 at 18:35
  • @Steeve, good point. IMO, the alternative is to use IDA Pro (or maybe Hopper...not sure), and write unpacking scripts using their Python support
    – Mick
    Commented Nov 14, 2013 at 19:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.