Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [immunity-debugger]

An OllyDbg 1.1 derivative made by Immunity Inc., that internally supports python scripting and shipped with many scripts to ease vulnerability and exploitation research.

1
vote
0answers
28 views

How to reverse engineer SearchUI.exe?

I would like to find out several things regarding Cortana and they way it works. For that, I tried to reverse engineer SearchUI.exe using Visual Studio 2017 with Microsoft Symbols Server, yet I only ...
7
votes
1answer
180 views

WHY and WHEN do we need SEH for buffer overflowing

In our course in university, we recently moved on from standard buffer-overflows to SEH based ones. My exploit is already ready and working thanks to some nice tutorials, although I am still not sure ...
1
vote
0answers
80 views

Immunity error BB010002

I am trying to make this exploit work and having some difficulty. So I skipped to a 'fixed' version of it from here and the only thing I changed was the shell code: https://github.com/cokebottle/oscp-...
0
votes
1answer
201 views

IDA Pro Address doesn't correlate to Immunity Debugger address

I'm trying to use immunity debugger to step through a confusing binary. When I open it in IDA Pro, I see certain addresses next to the instructions: .text:01001392 inc eax When I ...
0
votes
1answer
93 views

Empty Parameter an MessagerBox

I am trying to learn to reverse Engineering , i am very new and my English is very Poor... .I wanting to make this exercise , but can't it , because not receive the hWnd identified from the MessageBox ...
1
vote
1answer
368 views

how to find memory objects using immunity debugger

I am trying to exploit a program where I have to reuse a socket. recv looks like this: int recv( _In_ SOCKET s, // socket ID _Out_ char *buf, _In_ int len, _In_ int flags ); I want to ...
5
votes
2answers
505 views

Reversing Self-Modifying Malware

recently i got my hands on one sample that self-modifies its .text section. So, I placed a breakpoint on .text section on write operation and then continued. I found out that it zeroes out the .text ...
3
votes
1answer
67 views

Is it possible to name mona output files?

Is it possible to have mona.py save the output from a specific command to a specific file. So for example if I wanted to run multiple compare commands could I have them all saved to different output ...
4
votes
2answers
1k views

Changing the font in immunity debugger?

Does anyone know how to change the font size in immunity debugger? The font option under Options -> Appearance -> Font doesn't seem to change anything and just resets whenever you restart the program.
2
votes
2answers
2k views

Immunity debugger anti anti debug

I using Windows, and I was wondering what is the best anti anti debug plugin that exist, I tried to use hidedebug by Bob -> Team PEiD, but unfortunately it catch only the regular ways, I know that ...
2
votes
2answers
789 views

IDA pro: jump back to previous instruction

I'm new with IDA pro and currently running with debugger, I have few questions: How can I jump on previous instruction? Undo the latest instruction ? Is it possible in IDA to examine memory of an ...
0
votes
1answer
529 views

Can't debug a service

I am working on Lab11-03 in "Practical Malware Analysis" book. The malware I am analyzing trojanized the file cisvc.exe which is the indexing service in Windows XP. After that the malware start the ...
1
vote
1answer
674 views

Loading a .sys file into Immunity Debugger

Can somebody tell me how to load a .sys file into Immunity Debugger correctly ? Because when I load a driver into Imm. Debugger then I get the message that HAL.dll could not be found and that Imm. ...
3
votes
1answer
3k views

Immunity Debugger - Memory Breakpoint

Is there a way to stop execution each time some memory address is accessed?
1
vote
1answer
2k views

How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?

When I analyzed this malware sample it was invoking api's related to creating additional processes. With the process explorer I saw the debugged process is creating a new process. Please suggest any ...
2
votes
1answer
865 views

Immunity Debugger - !mona suggest

I have been going through some tutorials for exploit development that use the !pvefindaddr command to help with creating unique patterns and discovering the offset. I know that mona has replaced ...
1
vote
0answers
650 views

Immunity Debugger Unable to set Breakpoint

I have recently installed Immunity Debugger in order to do some dynamic analysis on some Malware however am getting the same 2 errors no matter what i try. The first error is that Immunity is 'Unable ...
1
vote
0answers
346 views

OllyDbg step over command not behaving exactly as the Immunity Debugger

I am taking Lena Reverse Engineering Tutorial and it uses OllyDbg debugger for its teaching. In the first chapter, he shows the file in OllyDbg debugger and steps over through it "step by step" until ...
6
votes
2answers
5k views

Immunity Debugger reset windows to default tiling

I have changed the windows from the original tiling layout in Immunity Debugger. I would like to restore the original tiling. I have tried restarting the program but the modified tiling remains. Is ...
0
votes
1answer
1k views

Unpacking and dumping executable from DLL

I'm trying to unpack and dump executable from a DLL packed file, I've loaded the DLL to Immunity Debugger using LOADDLL.exe. I think I've reached the OEP 0x3DADDD (the memory location of the unpacked ...
2
votes
1answer
38 views

Immnunity Debugger Python API Incorrect code execution order

PyCommand import immlib def main(args): imm = immlib.Debugger() imm.setBreakpoint(0x411077) imm.setReg("EAX",0x0) imm.log("EAX: {}".format(imm.getRegs()['EAX'])...
4
votes
1answer
462 views

Modifying PPID to avoid anti-debugging measure

I'm trying to debug an application that reads the Parent Process Id(PPID), to check if the application is being debugged. It expects the PPID to be the PID of explorer.exe, if it isn't, it quits. To ...
5
votes
1answer
226 views

What is the meaning of “^” in the CPU window of the Immunity debugger?

I can't figure out the meaning of ^ in the CPU window of the immunity debugger. What does it mean?
2
votes
1answer
211 views

Hooking in Immunity - LogBpHook not working

I try to use a simple hook on different memory allocation functions in Immunity. But the hook doesn't react at all (no logging). First of all my hook class: class AllocHook(LogBpHook): def ...
1
vote
1answer
1k views

Immunity crashes on start

First off, I hope this is the right place to ask this question, if not please let me know where I should ask it. I have a Windows XP sp2 VM (fresh install with no updates), with Python and immunity ...
2
votes
2answers
2k views

ollydbg ASLR and DEP bypass without mona

In case Immunity Debugger (and hence mona) doesn't work for me, is there a quick way for me to check loaded image for DEP, SafeSEH and ASLR using OllyDbg alone? Manual inspection is acceptable too. I'...
1
vote
1answer
1k views

Access violation error only when stepping after breakpoint in Immunity

Following a tutorial at http://www.fuzzysecurity.com/tutorials/expDev/2.html, regarding buffer overflows. I am able to execute the shellcode successfully. Used 'jmp esp' instead of 'pop esp; retn' as ...
7
votes
1answer
10k views

Immunity Debugger on Windows 10?

Has anybody gotten Immunity Debugger to work on windows 10 yet? I downloaded it on Windows 10, launch it as administrator, and the GUI opens for about half a second and then it exits, no errors or ...
1
vote
0answers
237 views

immunity debugger MSVCR90.dll R6034

I'm new to the science of reverse engineering. I recently downloaded immunity debugger 1.85 32bit Assembler-Level Debugger. My host machine is Windows 7 64 bit. I have python 2.7 installed as 32 bit ...
3
votes
1answer
7k views

When to use OllyDgb over Immunity Debugger

I have always been curious when I should use OllyDbg over Immunity Debugger. Immunity Debugger has inherited code from OllyDbg and can perform scripted debugging with Python. Interestingly enough, ...
6
votes
2answers
593 views

Saving labels and comments in Immunity Debugger

I am using Immunity Dbg v1.85 (the latest version to date). I spent about an hour analyzing a piece of malware, while making comments and relabeling functions from something like X.00402AC0 to ...
1
vote
2answers
2k views

What does this XOR do?

I'm trying to understand exactly what is happening in the below loop. I've commented in what I believe is happening. I came to these conclusions by googling every op code and trying to understand what ...
1
vote
0answers
442 views

Opening program via Ollydbg/Immunity in Win7 causes exception unless in XP Compatibility Mode

When opening the reverseme included with Lena's tutorials for debugging in either Immunity or Ollydbg an exception is produced within ntdll that results in termination of the process with code ...
5
votes
1answer
3k views

Finding address from function name

By checking the human-readable strings in my target application, I found several interesting function names: ... DataIntegrityError GetObjectIdsOfDuplicateLinksErrors GetInvalidClusterIdsExists Main ...
2
votes
2answers
714 views

How can I extend a memory of an analysed executable in IDA Pro?

I'm analysing some malware executable with ImmDBG and IDA Pro. The executable calls the kernel32.VirtualAlloc() at runtime with an argument lpAddress=NULL what means that an operating system decides ...
5
votes
1answer
1k views

Load IE symbols in Immunity Debugger

I know Immdbg already recognizes Windows internals function names, like kernel32.dll and user32.dll What I want is to load Internet Explorer symbols the same way WinDbg does. Does someone knows it is ...
0
votes
1answer
1k views

Windows debugger with ltrace functionality

I recently found the program: ltrace. And was wondering if it's possible to achieve the same using one of the gui debuggers for windows: ida, immunity, etc. The only thing I've found is a port of the ...
3
votes
2answers
3k views

Fixing import table of unpacked DLL with ImpREC : ImpRec throws “invalid OEP!” error

I am trying to unpack a DLL and fix the import tables with ImpRec. However, I am stuck with this error. Following is what I have tried. Modified the flag in its PE header so that windows loads the ...
1
vote
1answer
620 views

How to efficiently debug Loops with OllyDbg/Immunity?

I'm currently reversing a function which looks like the following .text:0040383F 8D 04 BF lea eax, [edi+edi*4] .text:00403842 6A 14 push 20 .text:00403844 C1 E0 03 ...
1
vote
1answer
644 views

Cannot call function (properly) in C++

I am developing a DLL for the purpose of injecting it into a running process for a game. I've found the memory addresses to some key functions(via Immunity Debugger) and I am trying to call those ...
6
votes
1answer
522 views

Immunity Debugger PyPlugin

Immunity Debugger offers a feature called PyPlugin. However there is not enough documentation on it. The help for immdbg says this : PyPlugins are python scripts located at PyPlugins\ directory, ...
3
votes
2answers
683 views

Manipulate EIP in Immunity Debugger

I just was playing around with Windbg, debugging some application. At some point I had to manipulate EIP which was pretty easy in Windbg. But then once I switched back to Immunity, I could not figure ...
2
votes
3answers
967 views

Find the instruction matching an opcode

I have two bytes '\x74\x06' and I want a list of all instructions that start with this opcode. What tools would you use for this? I am trying to do it with Immunity Debugger but so far no luck. The ...
1
vote
2answers
371 views

Passing an environment to debugged program in Olly/Immunity

I am debugging a program that reads an environment variable. So far, I could not find how to launch it in Immunity/Olly with a custom environment. Anybody know how this can be done?
9
votes
2answers
3k views

Where is ntdll.dll?

I am trying to get the base address of ntdll.dll over the PEB. So, what I did was to dump the PEB (d fs:[30]). Then, I tried to get to PEB_LDR_DATA over the offset 0xC. Over the offset 0x1C of ...
3
votes
2answers
2k views

Dump TEB/PEB in immunitydbg

I am trying to learn actually how to get to the PEB inside of TEB. I have tried this with windbg but could not manage to dump the PEB with stuff like: !peb or dt nt!_PEB_LDR_DATA And others. But, ...
3
votes
1answer
1k views

How to search for intermodular calls in WinDBG

In Olly/Immunity Debugger, I can search for "All intermodular calls". Is there a way to do this using WinDBG? Thanks
2
votes
1answer
1k views

Runtime memory reading with injection

I'm reversing an application written in C. I have a certain function that I want to log runtime, without pausing/stopping the application. My desired values of that function are: [ESP + 4] which ...
4
votes
0answers
381 views

Shotcuts in immunity debugger

Recently I started using Immunity Debugger instead of Olly where I got really got used to my custom keybidings. I could not seem to find an option to configure shortcuts/keybindings in immunity ...
4
votes
1answer
2k views

How do I trace instructions in an Immunity Debugger PyCommand?

This sounds like a very simple thing to accomplish but I can't seem to get it working. I'd like to run a part of a program in ImmDbg instruction by instruction and keep track of some actions that it ...