Let's suppose an obfuscated binary program.

This programs loads a payload in memory. This payload contains encrypted instructions. The program decrypts this payload and jumps to it.

I want to break the program in immunity debugger when the CPU runs a NOP instruction (this is an example).

I can do it manually by running the program step by step and see if EIP points on a 0x90 byte. But I want to automate this task. Is there a way to do that in immunity debugger ?

Thanks a lot

1 Answer 1


​ ​​Hi, this task can be automated and achieved using the Trace function of Immunity dbg, although this can also be done using Immunity Debugger PyCommands however for now trace over or trace in function will do.


To break on mov ecx, 0x11 in a binary we can always set the condition(s) in Debug>Set Condition or Ctrl+T then input Command is one of as in screenshot below.

Trace condition

set condition

Then simply hit Trace over from Debug or Ctrl+F12, this will break at the above instruction and also set trace logs for further analysis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.