16

Explanation The break on attach is due to the ntdll DbgUiRemoteBreakin and DbgBreakPoint functions being called. If you check the kernel32 DebugActiveProcess function called by the debugger, OllyDbg or ImmunityDebugger, you will see a call to the CreateRemoteThread, CreateRemoteThreadEx, or ZwCreateThreadEx function depending on your OS. So, i guess one ...


15

I am running Windows 10 x64 and I had the same problem as you do. The problem is with the environment variables regarding your Python installation. I am using Python 2.7.11 which is the currently latest release for the 2.x series. So, to make Immunity Debugger work on Windows 10 modify(and ADD if necessary) the following environment variables(assuming ...


10

The code below will set EAX to the image base address of ntdll.dll: MOV EAX, DWORD PTR FS:[30] ; EAX = PEB MOV EAX, DWORD PTR DS:[EAX+0C] ; EAX = PEB->Ldr MOV EAX, DWORD PTR DS:[EAX+1C] ; EAX = PEB->Ldr.InInitializationOrderModuleList.Flink MOV EAX, DWORD PTR DS:[EAX+8] ; EAX = image base of ntdll (LDR_MODULE's BaseAddress) Based on your ...


8

One way to do this is to have an OllyDbg plug-in that performs a WriteProcessMemory(hDebuggee, GetProcAddress(GetModuleHandle("ntdll"), "DbgBreakPoint"), &mynop, 1, NULL) where hDebuggee is the handle for the process being debugged (I believe that OllyDbg has an API for retrieving this value), and mynop is a variable that holds a 0x90 byte (nop ...


8

Ollydbg if you want to search references for intermodular functions (calls to dll libraries) , go to : searche for -> All intermodular calls. if you want to search for all readable labels (including that every human readable function) go to : searche for -> Name in all modules , or current module.


8

Immunity Debugger is forked from OllyDbg v1.10. So you should use the latest version of OllyDbg (currently v2.01) instead of Immunity Debugger if you want any OllyDbg v2-specific features/fixes. If you don't need those OllyDbg v2-specific features/fixes though, then there's no benefit to using OllyDbg v1.10 over Immunity Debugger.


7

I'm not sure what you mean with "original tiling". As far as I know Immunity just displays the CPU window initially. All the other windows are normally closed. So I would recommend to just close all windows and open View>CPU. To "reset" the tiling within the CPU window. Just close all windows expect the CPU window. Minimize the CPU window manually and click ...


6

Immunity Debugger 1.60 and above supports loading of PDB Symbol files both locally or from a symbol server. In order to enable it. Go to Debug menu -> Debugging Symbol Options. Provide the local path to the symbol files or to a symbol server. UPDATE If ImmDbg successfully loaded the pdb symbol for the specified file, you would get a message in the logs ...


6

Right click the code, select 'New Origin here' done


6

FastLogHook is one of the 13 hook types that Immunity Debugger comes with. Essentially, the purpose of this type of hook is to use tiny assembly stub to transfer execution to a hook function in order to log particular registers and/or memory locations. FastLogHook is essentially an python object, which allows us to setup hard hook relatively easy. The ...


6

I don't think this is possible without doing something extremely invasive. Either patching OllyDbg to use an alternative ZwXX/NtXX function which accepts some flags or patching the kernel. The initial break is done by the operating system so that the debugger can gather information about the process it is being attached to. I haven't verified but my guess ...


6

Loop First of all, when you say "loop runs 18 times", it is 0x18 times (hexa), actually, so 16+8=24 times. Xor XOR operand1, operand2 is nothing more than a logical XOR (11=> 0, 10=> 1, 01=> 1, 00=> 0). Here it would be AL = AL XOR 01111101. A 24 bytes string is likely stored at 0x402158 and is XORed with 0x7d. I say 24 bytes because this code loops 24 ...


6

Looks like it shows the direction of the jump (backwards in this case).


6

First of all, read this: https://www.blackhat.com/presentations/bh-asia-03/bh-asia-03-litchfield.pdf That's pretty much how all this started. A SEH buffer overflow is a specific stack overflow that targets the EXCEPTION_REGISTRATION_RECORD sitting some arbitrary distance down the stack. Why does this not happen for every program then since there should ...


5

You need to check the PE headers of the modules, the offset is dependent on the OS version (the settings can be different for the executable and each loaded DLL). You can look at the mona.py script for examples on how to do that. The script is very large but you should find what you are looking for in the class MnModule, for example the flag for ALSR is ...


5

I will assume you are talking about Windows Sockets and IPv4, since you have not mentioned otherwise. sockaddr is very well described in MSDN. It is defined as for IPv4 as follows: struct sockaddr { ushort sa_family; char sa_data[14]; }; struct sockaddr_in { short sin_family; u_short sin_port; struct in_addr ...


5

Start by placing a breakpoint on the entrypoint itself, which is probably not in the .text section at all, but in another section entirely. You will see that the program resolves its own imports dynamically, probably by searching within kernel32.dll for LoadLibrary and GetProcAddress. By tracing through the top layer, you will also find when the decryption ...


4

Assuming you want to see it in Windbg. You can follow this walk through for each pointer points to successive LDR_DATA_TABLE_ENTRY the output is from calc.exe. 0:000> dt ntdll!_LDR_DATA_TABLE_ENTRY -y Full poi(poi(@$peb+c)+c) +0x024 FullDllName : _UNICODE_STRING "C:\WINDOWS\system32\calc.exe" 0:000> dt ntdll!_LDR_DATA_TABLE_ENTRY -y Full poi(poi(...


4

You can write your hooking library (DLL) which will patch the API you are targeting. This patch will just print to file/console the parameters and continue back to the original function. There will be no stops on the way. To actually hook the APIs you will need to inject the DLL into the target application. You can use Detours from Microsoft as and example ...


4

Trying to figure out the problem I came with the following solution: Open Immunity Debugger as an Administrator Go to Options >> Appearance >> Fonts Rename one of the fonts to whatever name you'd like Click on Change and set the settings you wish Go to Defaults tab and set the Default font to be the one you edited. Done. Now the configuration ...


3

alt + f1 d fs:[30] ollydbg 1.10 raw peb with stolly plugin for 1.10 select the first byte in dump->right click->sructure select _peb from drop down box for decoded peb . al+g fs:[30] in ollydbg 2.01 fully decoded _peb in dump / disasm window


3

Open the Memory Map window in OllyDbg/ImmunityDbg, scroll down to the bottom, and double click on the entry that contains Process Environment Block. This will open a dump of the PEB in OllyDbg/ImmunityDbg:


3

I also just started to learn more about this topic and managed to write down the following lines of code. I guess all my comments in the code are good enough as answer. I dont know much more then that anyway. ' #!/usr/bin/env python import immlib import struct from immlib import STDCALLFastLogHook DESC="FastLoogHook" def main(args): ...


3

edit i didn't realize you are asking for immunity the answer is for plain straight ollydbg 1.10 the concept should be similar in immunity you need to edit the IMAGE_SUBSYSTEM from IMAGE_SUBSYSTEM_NATIVE to IMAGE_SUBSYSTEM_WINDOWS_GUI or _CUI ollydbg will now be able to load the driver (imports from hal etc will not be resolved but you can see the correct ...


3

The most reliable solution I've found is to add a new section to the PE file and force the process to write the unpacked code into that new section in memory. I wrote up a blog post a few years ago with a full walk-through of this approach: http://blog.crowdstrike.com/unpacking-dynamically-allocated-code/


3

After figuring out that ASLR (Dynamic base) and DEP (NX compatible) flags in PE header can be inspect using dumpbin.exe /headers, I found out that the same PE header mapping is available in Ollydbg. (I am using Ollydbg 2). Just open the Memory Map window in Ollydbg, find the image (under Owner column) you want, look for the row with "PE header" (under ...


3

mona.py only supports automatically generating Metasplpoit modules. You can't get it to output the exploitation code in any other form. pvefindaddr already suggested a payload layout based on that information, mona takes things one step further. In fact, it will attempt to produce a full blown Metasploit module, including all necessary pointers and ...


3

Since Mona's source is available on Github you can easily modify the code to fit your needs. The code that responsible to save the files can be found (currently) in line 2477 inside the class MnLog. try: if os.path.exists(logfile): try: os.delete(logfile+".old") except: pass try: os.rename(...


3

Put a INT3 (F2) breakpoint on the recv function (To jump to that function, hit CTRL+G then type recv to the textbox which just appeared, and then hit enter) within Immunity Debugger, and observe the stack (lower right corner) for the socket ID when the breakpoint is hit.


2

The answer lays within the comments, read Binary Diffing by Nicolas A. Economou (CoreImpact) 2009 to see why. Good Binary Diffing is in fact a way harder subject that does a lot more than compare bytes or bits. Making a Binary Diff with objdump and meld is really not the way to go. Read the CoreImpact document and it will show some of the issues with ...


Only top voted, non community-wiki answers of a minimum length are eligible