Add a "dynamic breakpoint" in immunity debugger

Question

Let's suppose an obfuscated binary program.

This programs loads a payload in memory. This payload contains encrypted instructions. The program decrypts this payload and jumps to it.

I want to break the program in immunity debugger when the CPU runs a NOP instruction (this is an example).

I can do it manually by running the program step by step and see if EIP points on a 0x90 byte. But I want to automate this task. Is there a way to do that in immunity debugger ?

Thanks a lot

Answer 1

​ ​​Hi, this task can be automated and achieved using the Trace function of Immunity dbg, although this can also be done using Immunity Debugger PyCommands however for now trace over or trace in function will do.

Example:

To break on mov ecx, 0x11 in a binary we can always set the condition(s) in Debug>Set Condition or Ctrl+T then input Command is one of as in screenshot below.

Then simply hit Trace over from Debug or Ctrl+F12, this will break at the above instruction and also set trace logs for further analysis.