18
votes
Accepted
Immunity Debugger on Windows 10?
I am running Windows 10 x64 and I had the same problem as you do. The problem is with the environment variables regarding your Python installation. I am using Python 2.7.11 which is the currently ...
- 1,063
10
votes
Immunity Debugger reset windows to default tiling
I'm not sure what you mean with "original tiling". As far as I know Immunity just displays the CPU window initially. All the other windows are normally closed. So I would recommend to just close all ...
- 1,257
10
votes
Accepted
When to use OllyDgb over Immunity Debugger
Immunity Debugger is forked from OllyDbg v1.10.
So you should use the latest version of OllyDbg (currently v2.01) instead of Immunity Debugger if you want any OllyDbg v2-specific features/fixes. If ...
- 20.6k
6
votes
What does this XOR do?
Loop
First of all, when you say "loop runs 18 times", it is 0x18 times (hexa), actually, so 16+8=24 times.
Xor
XOR operand1, operand2
is nothing more than a logical XOR (11=> 0, 10=> 1, 01=> 1, 00=...
- 465
6
votes
Accepted
What is the meaning of "^" in the CPU window of the Immunity debugger?
Looks like it shows the direction of the jump (backwards in this case).
- 36.2k
6
votes
Accepted
WHY and WHEN do we need SEH for buffer overflowing
First of all, read this:
https://www.blackhat.com/presentations/bh-asia-03/bh-asia-03-litchfield.pdf
That's pretty much how all this started.
A SEH buffer overflow is a specific stack overflow that ...
- 684
5
votes
Accepted
Changing the font in immunity debugger?
Trying to figure out the problem I came with the following solution:
Open Immunity Debugger as an Administrator
Go to Options >> Appearance >> Fonts
Rename one of the fonts to whatever ...
- 8,909
5
votes
Reversing Self-Modifying Malware
Start by placing a breakpoint on the entrypoint itself, which is probably not in the .text section at all, but in another section entirely. You will see that the program resolves its own imports ...
- 4,701
4
votes
ollydbg ASLR and DEP bypass without mona
After figuring out that ASLR (Dynamic base) and DEP (NX compatible) flags in PE header can be inspect using dumpbin.exe /headers, I found out that the same PE header mapping is available in Ollydbg. (...
- 173
4
votes
Immunity Debugger reset windows to default tiling
The default is CPU main thread which has four panels, three of which may become hidden if you have closed it or clicked on additional windows. To get back the initial layout, close all windows, reopen ...
- 41
4
votes
Immunity Debugger - Memory Breakpoint
Yes
For a memory access breakpoint1, just right click the desired address > Breakpoint > Memory, on access:
The same applies to values in the hex dump:
1: A breakpoint on access will break whenver ...
- 458
4
votes
How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?
using ollgdbgv2's debug child processes feature
Instead of using Immunity Debugger (which is a forked from OllyDbg1.10), you might want to consider using OllyDbg2.0.
One of the new features in ollydbg ...
- 11.7k
3
votes
Accepted
Immunity Debugger - !mona suggest
mona.py only supports automatically generating Metasplpoit modules. You can't get it to output the exploitation code in any other form.
pvefindaddr already suggested a payload layout based on that ...
- 11.7k
3
votes
Is it possible to name mona output files?
Since Mona's source is available on Github you can easily modify the code to fit your needs.
The code that responsible to save the files can be found (currently) in line 2477 inside the class MnLog....
- 8,909
3
votes
Accepted
how to find memory objects using immunity debugger
Put a INT3 (F2) breakpoint on the recv function (To jump to that function, hit CTRL+G then type recv to the textbox which just appeared, and then hit enter) within Immunity Debugger, and observe the ...
- 2,038
3
votes
Finding some specific adresses in an exe file
It's a bit hard to help and correct what you did wrong as you are not showing any indications why you think specific function are what you think they are but let's try (I'll do this purely via static ...
- 4,752
2
votes
Fixing import table of unpacked DLL with ImpREC : ImpRec throws "invalid OEP!" error
I think this is too late but let's reply though.
By default ImpREC has "Use PE Header From Disk" enabled. Which means it will NOT use the relocated DLL imagebase. 2 options :
1 - Untick it in options ...
- 21
2
votes
Accepted
Immunity Debugger PyPlugin
Going over
ImmunityDbg presentation - page 26,
v1.73 dir - dir structure
ImmDbg help file - "PyHooks ... they look exactly as a python plugin, only that they are placed inside PyHooks directory."
...
- 3,002
2
votes
Immunity crashes on start
I ran into the exact same issue but my case was a little bit different. I had Python 3.5 installed on my Windows 7 laptop. Immunity would open and then immediately close. I installed Python 2.7 and,...
- 121
2
votes
Accepted
Reversing Self-Modifying Malware
Thanks everyone who responded. The IAT was the problem. The OEP I found was the real OEP pointing to the unpacked code. But the dumped executable was not runnable because IAT was corrupt. After Fixing ...
- 395
1
vote
Changing the font in immunity debugger?
I solved it like this:
after loading a program the panes are filled with data
right-click in the top left pane and a menu will appear
from this menu choose appearence --> font(all) --> the font you ...
1
vote
Accepted
Immunity debugger anti anti debug
You can try ScyllaHide. There is no plugin for Immunity Debugger, but there is one for OllyDbg and that should make it trivial to port. Alternatively you can see this answer on how to hide any process ...
- 1,652
1
vote
IDA pro: jump back to previous instruction
As for the first point, in order to go back to instruction that was already executed (under the debugger), one needs to use a feature called reverse debugging (or Time Travel Debugging). As far as I ...
- 4,752
1
vote
Loading a .sys file into Immunity Debugger
.sys extension is usually used for drivers. While they are the same PE executables, they run in kernel mode and thus use kernel-mode APIs exposed by the kernel executive itself (ntoskrnl.exe) or ...
- 36.2k
1
vote
Accepted
Hooking in Immunity - LogBpHook not working
In the heat of the moment I didn't start Immunity as an Administrator.
So missing privileges have caused this behaviour during the debugging process.
- 1,257
1
vote
Unpacking and dumping executable from DLL
I would recommend using the starting address of the lpbuffer from
WriteProcessMemory function and than setting OllyDump to that address (3rd option below Module) :
After that if needed you can fix ...
- 712
1
vote
Immnunity Debugger Python API Incorrect code execution order
It looks like "Breakpoint at" means "the breakpoint was hit", not "breakpoint was set".
The breakpoint can be only triggered once the program is running. Since you call log() before run(), the log ...
- 36.2k
1
vote
Modifying PPID to avoid anti-debugging measure
So after going through the existing immunity scripts and mona.py, I found out that you also need to unpack the readMemory return values. Working code:
class Process32NextWHook(LogBpHook):
def ...
- 219
1
vote
ollydbg ASLR and DEP bypass without mona
you can use [OllySEH plugin][1] by Zer0Flag, OllySEH is a little plugin for OllyDbg 2.01 which should help exploit developers to find Modules which they can use to bypass different anti-bof techniques....
- 134
1
vote
Access violation error only when stepping after breakpoint in Immunity
As @guntram-blohm suggested, "Used jmp esp instead of pop esp; retn" is likely a problem.
pop esp; retn effectively does the following, which is very different from jmp esp:
mov esp, dword ptr [esp]
...
- 20.6k
Only top scored, non community-wiki answers of a minimum length are eligible