2

As malware are often packed, I'm looking to automate some of the unpacking tasks when that's possible.

In order to do that, I thought that OllyScript was an interesting way to write unpacking script for each packer that I have to deal with. But the first packer example for which I would like to write such script brings a "Bad or unknown format of 32 bits executable" error in Ollydbg/ImmunityDbg.

As there is not that problem in OllyDbg2 I thought that OllyScript+OllyDbg2 will be perfect, but OllyScript doesn't seems to have a version for OllyDbg2...

What kind of "scripting engine" do you suggest me in order to write unpacking scripts ?

  • 1
    FYI You usually can fix these incompatibility problems of OllyDbg 1 by using the OllyAdvanced plugin. – Ange Nov 11 '13 at 11:17
  • I known that an OllyDbg plugin was fixing some bugs, but I wasn't able to remember its name. Thanks – Steeve Nov 11 '13 at 11:32
3

Well, if you are using ImmunityDbg, have a look at using Python to write your unpacking scripts. With ImmunityDbg, Python scripting support is built-in.

An additional benefit of focusing on Python (instead of OllyScript) is that if you begin using a IDA Pro with IDAPython, your scripts will convert much more easily.

If you are not familiar with how to write an unpacker in Python, have a look at Gray Hat Python. The book doesn't show you exactly how to write an unpacker, but demonstrates how to work with (from Python) PE files, call into the Windows API, write a debugger, and other related tasks.

Immunity Debugger's Python API includes many useful utilities and functions. Your scripts can be as integrated into the debugger as the native code. This means your code can create custom tables, graphs, and interfaces of all sorts that remain within the Immunity Debugger user experience. For example, when the Immunity SafeSEH script runs, it outputs the results into a table within the Immunity Debugger window.

enter image description here

  • 1
    I agree that ImmDbg is quite interesting for its Python API but it suffer to similar problems than OllyDBG (some troubles to load some "malformed" PE files) – Steeve Nov 12 '13 at 18:35
  • @Steeve, good point. IMO, the alternative is to use IDA Pro (or maybe Hopper...not sure), and write unpacking scripts using their Python support – Mick Nov 14 '13 at 19:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.