Questions tagged [immunity-debugger]
An OllyDbg 1.1 derivative made by Immunity Inc., that internally supports python scripting and shipped with many scripts to ease vulnerability and exploitation research.
66
questions
11
votes
3
answers
15k
views
How can I prevent Immunity Debugger / OllyDbg from breaking on attach?
When I attach OllyDbg or ImmunityDebugger to a process, it automatically breaks execution. I'm attaching to a user-mode service running as SYSTEM and only need to catch exceptions, so this is not ...
- 1,252
11
votes
2
answers
16k
views
Immunity Debugger reset windows to default tiling
I have changed the windows from the original tiling layout in Immunity Debugger. I would like to restore the original tiling. I have tried restarting the program but the modified tiling remains. Is ...
- 111
9
votes
1
answer
19k
views
Immunity Debugger on Windows 10?
Has anybody gotten Immunity Debugger to work on windows 10 yet? I downloaded it on Windows 10, launch it as administrator, and the GUI opens for about half a second and then it exits, no errors or ...
- 345
9
votes
2
answers
5k
views
Where is ntdll.dll?
I am trying to get the base address of ntdll.dll over the PEB. So, what I did was to dump the PEB (d fs:[30]). Then, I tried to get to PEB_LDR_DATA over the offset 0xC. Over the offset 0x1C of ...
- 443
8
votes
1
answer
1k
views
Reversing Patches (Binary Diffing)
Does any of you know of a recent tool to bindiff using ImmunityDebugger?
I know about BinDiff by Zynamics and PatchDiff for IDA. But I really want a tool like this in ImmDBG. I also know about Radare'...
- 2,321
7
votes
1
answer
11k
views
When to use OllyDgb over Immunity Debugger
I have always been curious when I should use OllyDbg over Immunity Debugger.
Immunity Debugger has inherited code from OllyDbg and can perform scripted debugging with Python.
Interestingly enough, ...
- 440
7
votes
1
answer
1k
views
WHY and WHEN do we need SEH for buffer overflowing
In our course in university, we recently moved on from standard buffer-overflows to SEH based ones.
My exploit is already ready and working thanks to some nice tutorials, although I am still not sure ...
- 173
6
votes
1
answer
7k
views
Finding address from function name
By checking the human-readable strings in my target application, I found several interesting function names:
...
DataIntegrityError
GetObjectIdsOfDuplicateLinksErrors
GetInvalidClusterIdsExists
Main
...
- 275
6
votes
2
answers
932
views
Saving labels and comments in Immunity Debugger
I am using Immunity Dbg v1.85 (the latest version to date). I spent about an hour analyzing a piece of malware, while making comments and relabeling functions from something like X.00402AC0 to ...
- 61
6
votes
1
answer
1k
views
Immunity Debugger PyPlugin
Immunity Debugger offers a feature called PyPlugin. However there is not enough documentation on it. The help for immdbg says this :
PyPlugins are python scripts located at PyPlugins\ directory,
...
- 6,040
6
votes
0
answers
696
views
Shotcuts in immunity debugger
Recently I started using Immunity Debugger instead of Olly where I got really got used to my custom keybidings. I could not seem to find an option to configure shortcuts/keybindings in immunity ...
- 2,038
5
votes
1
answer
2k
views
Load IE symbols in Immunity Debugger
I know Immdbg already recognizes Windows internals function names, like kernel32.dll and user32.dll
What I want is to load Internet Explorer symbols the same way WinDbg does. Does someone knows it is ...
- 498
5
votes
1
answer
2k
views
How to use fastloghook in immunity debugger
How does fastloghook work in immunity debugger pycommand section? i cant figure it out. Everything i try does not work and i know this code is a mess. I seriously dont understand fastloghook which ...
- 126
5
votes
1
answer
8k
views
Immunity Debugger - Memory Breakpoint
Is there a way to stop execution each time some memory address is accessed?
- 151
4
votes
2
answers
2k
views
Manipulate EIP in Immunity Debugger
I just was playing around with Windbg, debugging some application.
At some point I had to manipulate EIP which was pretty easy in Windbg. But then once I switched back to Immunity, I could not figure ...
- 443
4
votes
2
answers
1k
views
Reversing Self-Modifying Malware
recently i got my hands on one sample that self-modifies its .text section. So, I placed a breakpoint on .text section on write operation and then continued. I found out that it zeroes out the .text ...
- 395
4
votes
2
answers
5k
views
Changing the font in immunity debugger?
Does anyone know how to change the font size in immunity debugger? The font option under Options -> Appearance -> Font doesn't seem to change anything and just resets whenever you restart the program.
- 43
4
votes
1
answer
286
views
What is the meaning of "^" in the CPU window of the Immunity debugger?
I can't figure out the meaning of ^ in the CPU window of the immunity debugger. What does it mean?
- 1,257
4
votes
1
answer
1k
views
Runtime memory reading with injection
I'm reversing an application written in C. I have a certain function that I want to log runtime, without pausing/stopping the application.
My desired values of that function are:
[ESP + 4] which ...
- 2,038
4
votes
1
answer
2k
views
How do I trace instructions in an Immunity Debugger PyCommand?
This sounds like a very simple thing to accomplish but I can't seem to get it working.
I'd like to run a part of a program in ImmDbg instruction by instruction and keep track of some actions that it ...
- 41
4
votes
0
answers
263
views
Comparison of Windows Debuggers
I have some experience reverse engineering ELF files using tools like GDB, radare2, and Ghidra, but I am new to Windows debugging. There are quite a few different debuggers out there for Windows and ...
- 151
3
votes
3
answers
6k
views
Check DEP , ASLR and SafeSEH enabled or not , immlib
How to check if DEP, ASLR and SafeSEH defense mechanism are enabled or not in a program using immlib library of Python in Immunity Debugger ?
Actually I am looking for small code snippet for each.
- 265
3
votes
2
answers
3k
views
Dump TEB/PEB in immunitydbg
I am trying to learn actually how to get to the PEB inside of TEB. I have tried this with windbg but could not manage to dump the PEB with stuff like:
!peb
or
dt nt!_PEB_LDR_DATA
And others. But, ...
- 443
3
votes
1
answer
267
views
Is it possible to name mona output files?
Is it possible to have mona.py save the output from a specific command to a specific file. So for example if I wanted to run multiple compare commands could I have them all saved to different output ...
- 31
3
votes
2
answers
5k
views
Fixing import table of unpacked DLL with ImpREC : ImpRec throws "invalid OEP!" error
I am trying to unpack a DLL and fix the import tables with ImpRec. However, I am stuck with this error. Following is what I have tried.
Modified the flag in its PE header so that windows loads the ...
- 303
3
votes
1
answer
1k
views
Loading a Driver in Immunity
It sounds strange and I realize that you usually use WinDbg to debug drivers, but I was reading up on Gray Hat Python and it states:
To test this out, try loading the driver C:\WINDOWS\System32\...
- 131
3
votes
1
answer
576
views
Modifying PPID to avoid anti-debugging measure
I'm trying to debug an application that reads the Parent Process Id(PPID), to check if the application is being debugged. It expects the PPID to be the PID of explorer.exe, if it isn't, it quits.
To ...
- 219
3
votes
1
answer
1k
views
How to search for intermodular calls in WinDBG
In Olly/Immunity Debugger, I can search for "All intermodular calls". Is there a way to do this using WinDBG?
Thanks
- 31
3
votes
0
answers
37
views
Can I get thread counts remotely with Immunity Debugger
I am debugging a program on a Windows server with Immunity debugger.
Immunity debugger offers a remote command line client. I can do basic tasks through this command line.
But is there a way to get ...
- 797
2
votes
1
answer
294
views
Server-side bind() function, immlib
How do I get IP address and port number out of bind function in Server application. Can it be achieved with hooks like bphook in immunity debugger?
My problem is that I don't know how to unpack ...
- 126
2
votes
2
answers
4k
views
ollydbg ASLR and DEP bypass without mona
In case Immunity Debugger (and hence mona) doesn't work for me, is there a quick way for me to check loaded image for DEP, SafeSEH and ASLR using OllyDbg alone? Manual inspection is acceptable too.
I'...
- 173
2
votes
1
answer
2k
views
how to find memory objects using immunity debugger
I am trying to exploit a program where I have to reuse a socket.
recv looks like this:
int recv(
_In_ SOCKET s, // socket ID
_Out_ char *buf,
_In_ int len,
_In_ int flags
);
I want to ...
- 123
2
votes
1
answer
2k
views
Immunity Debugger - !mona suggest
I have been going through some tutorials for exploit development that use the !pvefindaddr command to help with creating unique patterns and discovering the offset.
I know that mona has replaced ...
- 23
2
votes
2
answers
2k
views
How can I extend a memory of an analysed executable in IDA Pro?
I'm analysing some malware executable with ImmDBG and IDA Pro.
The executable calls the kernel32.VirtualAlloc() at runtime with an argument lpAddress=NULL what means that an operating system decides ...
- 426
2
votes
3
answers
2k
views
Find the instruction matching an opcode
I have two bytes '\x74\x06' and I want a list of all instructions that start with this opcode.
What tools would you use for this? I am trying to do it with Immunity Debugger but so far no luck. The ...
- 71
2
votes
1
answer
778
views
Use of FastLogHook function in immlib?
I am a newbie in python programming for Debugging . I wrote a code for using the function FastLogHook() in immlib but i am not able to figure out the exact problem with my code as it is not working :(
...
- 265
2
votes
2
answers
3k
views
Immunity debugger anti anti debug
I using Windows, and I was wondering what is the best anti anti debug plugin that exist,
I tried to use hidedebug by Bob -> Team PEiD, but unfortunately it catch only the regular ways, I know that ...
- 23
2
votes
2
answers
2k
views
IDA pro: jump back to previous instruction
I'm new with IDA pro and currently running with debugger, I have few questions:
How can I jump on previous instruction? Undo the latest instruction ?
Is it possible in IDA to examine memory of an ...
- 129
2
votes
1
answer
74
views
Immnunity Debugger Python API Incorrect code execution order
PyCommand
import immlib
def main(args):
imm = immlib.Debugger()
imm.setBreakpoint(0x411077)
imm.setReg("EAX",0x0)
imm.log("EAX: {}".format(imm.getRegs()['EAX'])...
- 21
2
votes
1
answer
350
views
Hooking in Immunity - LogBpHook not working
I try to use a simple hook on different memory allocation functions in Immunity. But the hook doesn't react at all (no logging).
First of all my hook class:
class AllocHook(LogBpHook):
def ...
- 1,257
2
votes
0
answers
110
views
Move focus to Immunity Debugger command line
As the title says, I want to know if there is a keyboard shortcut that upon pressing will allow me to write in the Immunity command line?
- 21
1
vote
2
answers
2k
views
What does this XOR do?
I'm trying to understand exactly what is happening in the below loop. I've commented in what I believe is happening. I came to these conclusions by googling every op code and trying to understand what ...
user2981
1
vote
1
answer
4k
views
How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?
When I analyzed this malware sample it was invoking api's related to creating additional processes. With the process explorer I saw the debugged process is creating a new process. Please suggest any ...
1
vote
1
answer
3k
views
Immunity crashes on start
First off, I hope this is the right place to ask this question, if not please let me know where I should ask it.
I have a Windows XP sp2 VM (fresh install with no updates), with Python and immunity ...
- 111
1
vote
1
answer
2k
views
Windows debugger with ltrace functionality
I recently found the program: ltrace. And was wondering if it's possible to achieve the same using one of the gui debuggers for windows: ida, immunity, etc. The only thing I've found is a port of the ...
- 13
1
vote
1
answer
968
views
How to efficiently debug Loops with OllyDbg/Immunity?
I'm currently reversing a function which looks like the following
.text:0040383F 8D 04 BF lea eax, [edi+edi*4]
.text:00403842 6A 14 push 20
.text:00403844 C1 E0 03 ...
- 155
1
vote
1
answer
870
views
Cannot call function (properly) in C++
I am developing a DLL for the purpose of injecting it into a running process for a game. I've found the memory addresses to some key functions(via Immunity Debugger) and I am trying to call those ...
- 11
1
vote
2
answers
509
views
Passing an environment to debugged program in Olly/Immunity
I am debugging a program that reads an environment variable. So far, I could not find how to launch it in Immunity/Olly with a custom environment.
Anybody know how this can be done?
- 71
1
vote
1
answer
57
views
Add a "dynamic breakpoint" in immunity debugger
Let's suppose an obfuscated binary program.
This programs loads a payload in memory.
This payload contains encrypted instructions.
The program decrypts this payload and jumps to it.
I want to break ...
- 797
1
vote
1
answer
141
views
Immunity Debugger showing path instead of argv[1]
I'm trying to learn Buffer Overflow
Here is the vulnerable code
#include <stdio.h>
#include <string.h>
int main(int argc, char const *argv[])
{
char buffer[64];
if(argc < 2){
...
- 13