18 votes
Accepted

Immunity Debugger on Windows 10?

I am running Windows 10 x64 and I had the same problem as you do. The problem is with the environment variables regarding your Python installation. I am using Python 2.7.11 which is the currently ...
ubnix's user avatar
  • 1,073
10 votes

Immunity Debugger reset windows to default tiling

I'm not sure what you mean with "original tiling". As far as I know Immunity just displays the CPU window initially. All the other windows are normally closed. So I would recommend to just close all ...
knx's user avatar
  • 1,257
6 votes
Accepted

What is the meaning of "^" in the CPU window of the Immunity debugger?

Looks like it shows the direction of the jump (backwards in this case).
Igor Skochinsky's user avatar
  • 36.6k
6 votes
Accepted

WHY and WHEN do we need SEH for buffer overflowing

First of all, read this: https://www.blackhat.com/presentations/bh-asia-03/bh-asia-03-litchfield.pdf That's pretty much how all this started. A SEH buffer overflow is a specific stack overflow that ...
Abigail's user avatar
  • 684
5 votes
Accepted

Changing the font in immunity debugger?

Trying to figure out the problem I came with the following solution: Open Immunity Debugger as an Administrator Go to Options >> Appearance >> Fonts Rename one of the fonts to whatever ...
Megabeets's user avatar
  • 8,989
5 votes

Reversing Self-Modifying Malware

Start by placing a breakpoint on the entrypoint itself, which is probably not in the .text section at all, but in another section entirely. You will see that the program resolves its own imports ...
peter ferrie's user avatar
  • 4,709
4 votes

ollydbg ASLR and DEP bypass without mona

After figuring out that ASLR (Dynamic base) and DEP (NX compatible) flags in PE header can be inspect using dumpbin.exe /headers, I found out that the same PE header mapping is available in Ollydbg. (...
xyz's user avatar
  • 173
4 votes

Immunity Debugger - Memory Breakpoint

Yes For a memory access breakpoint1, just right click the desired address > Breakpoint > Memory, on access: The same applies to values in the hex dump: 1: A breakpoint on access will break whenver ...
Martin's user avatar
  • 468
4 votes

How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?

using ollgdbgv2's debug child processes feature Instead of using Immunity Debugger (which is a forked from OllyDbg1.10), you might want to consider using OllyDbg2.0. One of the new features in ollydbg ...
NirIzr's user avatar
  • 11.8k
4 votes

Immunity Debugger reset windows to default tiling

The default is CPU main thread which has four panels, three of which may become hidden if you have closed it or clicked on additional windows. To get back the initial layout, close all windows, reopen ...
izzie's user avatar
  • 41
3 votes

Is it possible to name mona output files?

Since Mona's source is available on Github you can easily modify the code to fit your needs. The code that responsible to save the files can be found (currently) in line 2477 inside the class MnLog....
Megabeets's user avatar
  • 8,989
3 votes
Accepted

how to find memory objects using immunity debugger

Put a INT3 (F2) breakpoint on the recv function (To jump to that function, hit CTRL+G then type recv to the textbox which just appeared, and then hit enter) within Immunity Debugger, and observe the ...
Dominik Antal's user avatar
3 votes
Accepted

Immunity Debugger - !mona suggest

mona.py only supports automatically generating Metasplpoit modules. You can't get it to output the exploitation code in any other form. pvefindaddr already suggested a payload layout based on that ...
NirIzr's user avatar
  • 11.8k
3 votes

Finding some specific adresses in an exe file

It's a bit hard to help and correct what you did wrong as you are not showing any indications why you think specific function are what you think they are but let's try (I'll do this purely via static ...
Paweł Łukasik's user avatar
2 votes

Fixing import table of unpacked DLL with ImpREC : ImpRec throws "invalid OEP!" error

I think this is too late but let's reply though. By default ImpREC has "Use PE Header From Disk" enabled. Which means it will NOT use the relocated DLL imagebase. 2 options : 1 - Untick it in options ...
Dessloch's user avatar
2 votes
Accepted

Immunity Debugger PyPlugin

Going over ImmunityDbg presentation - page 26, v1.73 dir - dir structure ImmDbg help file - "PyHooks ... they look exactly as a python plugin, only that they are placed inside PyHooks directory." ...
PhoeniX's user avatar
  • 3,052
2 votes

Immunity crashes on start

I ran into the exact same issue but my case was a little bit different. I had Python 3.5 installed on my Windows 7 laptop. Immunity would open and then immediately close. I installed Python 2.7 and,...
jkovba's user avatar
  • 121
2 votes
Accepted

Reversing Self-Modifying Malware

Thanks everyone who responded. The IAT was the problem. The OEP I found was the real OEP pointing to the unpacked code. But the dumped executable was not runnable because IAT was corrupt. After Fixing ...
rustam Shirinov's user avatar
1 vote
Accepted

what means "ilegal use of registers"?

As you can see here, 0xFF is a “jump far indirect” opcode and this version of jump requires operand to be a memory address. While using this type of jump, you cannot use register as an operand and ...
bart1e's user avatar
  • 3,389
1 vote

IDA Pro Address doesn't correlate to Immunity Debugger address

This could be ASLR (Address Space Layout Randomization). It randomly changes the base address for binaries so people cannot rely on fixed addresses if they try to write an exploit. There are a few ...
Johann Aydinbas's user avatar
1 vote

Changing the font in immunity debugger?

I solved it like this: after loading a program the panes are filled with data right-click in the top left pane and a menu will appear from this menu choose appearence --> font(all) --> the font you ...
Aleksander Ring's user avatar
1 vote
Accepted

Immunity debugger anti anti debug

You can try ScyllaHide. There is no plugin for Immunity Debugger, but there is one for OllyDbg and that should make it trivial to port. Alternatively you can see this answer on how to hide any process ...
mrexodia's user avatar
  • 1,652
1 vote

IDA pro: jump back to previous instruction

As for the first point, in order to go back to instruction that was already executed (under the debugger), one needs to use a feature called reverse debugging (or Time Travel Debugging). As far as I ...
Paweł Łukasik's user avatar
1 vote

Loading a .sys file into Immunity Debugger

.sys extension is usually used for drivers. While they are the same PE executables, they run in kernel mode and thus use kernel-mode APIs exposed by the kernel executive itself (ntoskrnl.exe) or ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote
Accepted

Hooking in Immunity - LogBpHook not working

In the heat of the moment I didn't start Immunity as an Administrator. So missing privileges have caused this behaviour during the debugging process.
knx's user avatar
  • 1,257
1 vote

Unpacking and dumping executable from DLL

I would recommend using the starting address of the lpbuffer from WriteProcessMemory function and than setting OllyDump to that address (3rd option below Module) : After that if needed you can fix ...
GelosSnake's user avatar
1 vote

Immnunity Debugger Python API Incorrect code execution order

It looks like "Breakpoint at" means "the breakpoint was hit", not "breakpoint was set". The breakpoint can be only triggered once the program is running. Since you call log() before run(), the log ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote

Modifying PPID to avoid anti-debugging measure

So after going through the existing immunity scripts and mona.py, I found out that you also need to unpack the readMemory return values. Working code: class Process32NextWHook(LogBpHook): def ...
JeffreyZ's user avatar
  • 219
1 vote

ollydbg ASLR and DEP bypass without mona

you can use [OllySEH plugin][1] by Zer0Flag, OllySEH is a little plugin for OllyDbg 2.01 which should help exploit developers to find Modules which they can use to bypass different anti-bof techniques....
adrián's user avatar
  • 134
1 vote

Access violation error only when stepping after breakpoint in Immunity

As @guntram-blohm suggested, "Used jmp esp instead of pop esp; retn" is likely a problem. pop esp; retn effectively does the following, which is very different from jmp esp: mov esp, dword ptr [esp] ...
Jason Geffner's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible