17 votes
Accepted

Immunity Debugger on Windows 10?

I am running Windows 10 x64 and I had the same problem as you do. The problem is with the environment variables regarding your Python installation. I am using Python 2.7.11 which is the currently ...
user avatar
  • 1,043
12 votes
Accepted

Where is ntdll.dll?

The code below will set EAX to the image base address of ntdll.dll: MOV EAX, DWORD PTR FS:[30] ; EAX = PEB MOV EAX, DWORD PTR DS:[EAX+0C] ; EAX = PEB->Ldr MOV EAX, DWORD PTR DS:[EAX+1C] ; EAX =...
user avatar
10 votes

Immunity Debugger reset windows to default tiling

I'm not sure what you mean with "original tiling". As far as I know Immunity just displays the CPU window initially. All the other windows are normally closed. So I would recommend to just close all ...
user avatar
  • 1,227
9 votes
Accepted

When to use OllyDgb over Immunity Debugger

Immunity Debugger is forked from OllyDbg v1.10. So you should use the latest version of OllyDbg (currently v2.01) instead of Immunity Debugger if you want any OllyDbg v2-specific features/fixes. If ...
user avatar
8 votes

Finding address from function name

Ollydbg if you want to search references for intermodular functions (calls to dll libraries) , go to : searche for -> All intermodular calls. if you want to search for all readable labels (including ...
user avatar
  • 304
6 votes
Accepted

Load IE symbols in Immunity Debugger

Immunity Debugger 1.60 and above supports loading of PDB Symbol files both locally or from a symbol server. In order to enable it. Go to Debug menu -> Debugging Symbol Options. Provide the local ...
user avatar
  • 5,850
6 votes
Accepted

Manipulate EIP in Immunity Debugger

Right click the code, select 'New Origin here' done
user avatar
  • 2,265
6 votes

What does this XOR do?

Loop First of all, when you say "loop runs 18 times", it is 0x18 times (hexa), actually, so 16+8=24 times. Xor XOR operand1, operand2 is nothing more than a logical XOR (11=> 0, 10=> 1, 01=> 1, 00=...
user avatar
  • 455
6 votes
Accepted

What is the meaning of "^" in the CPU window of the Immunity debugger?

Looks like it shows the direction of the jump (backwards in this case).
user avatar
  • 34.6k
6 votes
Accepted

WHY and WHEN do we need SEH for buffer overflowing

First of all, read this: https://www.blackhat.com/presentations/bh-asia-03/bh-asia-03-litchfield.pdf That's pretty much how all this started. A SEH buffer overflow is a specific stack overflow that ...
user avatar
  • 664
5 votes

Reversing Self-Modifying Malware

Start by placing a breakpoint on the entrypoint itself, which is probably not in the .text section at all, but in another section entirely. You will see that the program resolves its own imports ...
user avatar
  • 4,511
4 votes

ollydbg ASLR and DEP bypass without mona

After figuring out that ASLR (Dynamic base) and DEP (NX compatible) flags in PE header can be inspect using dumpbin.exe /headers, I found out that the same PE header mapping is available in Ollydbg. (...
user avatar
  • 173
4 votes

Where is ntdll.dll?

Assuming you want to see it in Windbg. You can follow this walk through for each pointer points to successive LDR_DATA_TABLE_ENTRY the output is from calc.exe. 0:000> dt ntdll!...
user avatar
  • 14.8k
4 votes

Immunity Debugger reset windows to default tiling

The default is CPU main thread which has four panels, three of which may become hidden if you have closed it or clicked on additional windows. To get back the initial layout, close all windows, reopen ...
user avatar
  • 41
4 votes

How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?

using ollgdbgv2's debug child processes feature Instead of using Immunity Debugger (which is a forked from OllyDbg1.10), you might want to consider using OllyDbg2.0. One of the new features in ollydbg ...
user avatar
  • 11.3k
4 votes
Accepted

Changing the font in immunity debugger?

Trying to figure out the problem I came with the following solution: Open Immunity Debugger as an Administrator Go to Options >> Appearance >> Fonts Rename one of the fonts to whatever ...
user avatar
  • 8,579
3 votes

How can I extend a memory of an analysed executable in IDA Pro?

The most reliable solution I've found is to add a new section to the PE file and force the process to write the unpacked code into that new section in memory. I wrote up a blog post a few years ago ...
user avatar
3 votes

Dump TEB/PEB in immunitydbg

alt + f1 d fs:[30] ollydbg 1.10 raw peb with stolly plugin for 1.10 select the first byte in dump->right click->sructure select _peb from drop down box for decoded peb . al+g fs:[30] in ...
user avatar
  • 14.8k
3 votes
Accepted

Dump TEB/PEB in immunitydbg

Open the Memory Map window in OllyDbg/ImmunityDbg, scroll down to the bottom, and double click on the entry that contains Process Environment Block. This will open a dump of the PEB in OllyDbg/...
user avatar
3 votes
Accepted

Immunity Debugger - !mona suggest

mona.py only supports automatically generating Metasplpoit modules. You can't get it to output the exploitation code in any other form. pvefindaddr already suggested a payload layout based on that ...
user avatar
  • 11.3k
3 votes

Immunity Debugger - Memory Breakpoint

Yes For a memory access breakpoint1, just right click the desired address > Breakpoint > Memory, on access: The same applies to values in the hex dump: 1: A breakpoint on access will break whenver ...
user avatar
  • 428
3 votes

Is it possible to name mona output files?

Since Mona's source is available on Github you can easily modify the code to fit your needs. The code that responsible to save the files can be found (currently) in line 2477 inside the class MnLog....
user avatar
  • 8,579
3 votes
Accepted

how to find memory objects using immunity debugger

Put a INT3 (F2) breakpoint on the recv function (To jump to that function, hit CTRL+G then type recv to the textbox which just appeared, and then hit enter) within Immunity Debugger, and observe the ...
user avatar
2 votes

Find the instruction matching an opcode

Here is a way to do this with radare2 program rasm2 rasm2 -a x86 -b 32 -d 7406 je 0x8 This has obviously already been established as je from the other answers. But for arguments sake, say you ...
user avatar
  • 403
2 votes
Accepted

How to efficiently debug Loops with OllyDbg/Immunity?

No scripting required. In OllyDbg's disassembly window, left-click on line .text:00403855 32 C3 xor al, bl to select the line, then right-click on the selected line and choose ...
user avatar
2 votes

Cannot call function (properly) in C++

At one particular instance it showed a debug error saying: "The process was not able to resume execution because the ESP value was changed", or something similar. ... typedef void(__cdecl* ...
user avatar
2 votes
Accepted

Immunity Debugger PyPlugin

Going over ImmunityDbg presentation - page 26, v1.73 dir - dir structure ImmDbg help file - "PyHooks ... they look exactly as a python plugin, only that they are placed inside PyHooks directory." ...
user avatar
  • 2,832
2 votes

Manipulate EIP in Immunity Debugger

Alternatively, you can select an address and press ctrl + * (use the * at the right pad)
user avatar
  • 478
2 votes
Accepted

Windows debugger with ltrace functionality

ollydbg -> search for all intermodular calls -> in the new window -> set log break point radio button pause to never , log function argument to always ok you should see all the lib functions ...
user avatar
  • 14.8k
2 votes

Fixing import table of unpacked DLL with ImpREC : ImpRec throws "invalid OEP!" error

I think this is too late but let's reply though. By default ImpREC has "Use PE Header From Disk" enabled. Which means it will NOT use the relocated DLL imagebase. 2 options : 1 - Untick it in options ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible