Unpacking script

Question

As malware are often packed, I'm looking to automate some of the unpacking tasks when that's possible.

In order to do that, I thought that OllyScript was an interesting way to write unpacking script for each packer that I have to deal with. But the first packer example for which I would like to write such script brings a "Bad or unknown format of 32 bits executable" error in Ollydbg/ImmunityDbg.

As there is not that problem in OllyDbg2 I thought that OllyScript+OllyDbg2 will be perfect, but OllyScript doesn't seems to have a version for OllyDbg2...

What kind of "scripting engine" do you suggest me in order to write unpacking scripts ?

Answer 1

Well, if you are using ImmunityDbg, have a look at using Python to write your unpacking scripts. With ImmunityDbg, Python scripting support is built-in.

An additional benefit of focusing on Python (instead of OllyScript) is that if you begin using a IDA Pro with IDAPython, your scripts will convert much more easily.

If you are not familiar with how to write an unpacker in Python, have a look at Gray Hat Python. The book doesn't show you exactly how to write an unpacker, but demonstrates how to work with (from Python) PE files, call into the Windows API, write a debugger, and other related tasks.

Immunity Debugger's Python API includes many useful utilities and functions. Your scripts can be as integrated into the debugger as the native code. This means your code can create custom tables, graphs, and interfaces of all sorts that remain within the Immunity Debugger user experience. For example, when the Immunity SafeSEH script runs, it outputs the results into a table within the Immunity Debugger window.