17 votes
Accepted

Immunity Debugger on Windows 10?

I am running Windows 10 x64 and I had the same problem as you do. The problem is with the environment variables regarding your Python installation. I am using Python 2.7.11 which is the currently ...
  • 1,043
10 votes

Immunity Debugger reset windows to default tiling

I'm not sure what you mean with "original tiling". As far as I know Immunity just displays the CPU window initially. All the other windows are normally closed. So I would recommend to just close all ...
  • 1,227
9 votes
Accepted

When to use OllyDgb over Immunity Debugger

Immunity Debugger is forked from OllyDbg v1.10. So you should use the latest version of OllyDbg (currently v2.01) instead of Immunity Debugger if you want any OllyDbg v2-specific features/fixes. If ...
8 votes

Finding address from function name

Ollydbg if you want to search references for intermodular functions (calls to dll libraries) , go to : searche for -> All intermodular calls. if you want to search for all readable labels (including ...
  • 304
6 votes
Accepted

What is the meaning of "^" in the CPU window of the Immunity debugger?

Looks like it shows the direction of the jump (backwards in this case).
  • 35.1k
6 votes

What does this XOR do?

Loop First of all, when you say "loop runs 18 times", it is 0x18 times (hexa), actually, so 16+8=24 times. Xor XOR operand1, operand2 is nothing more than a logical XOR (11=> 0, 10=> 1, 01=> 1, 00=...
  • 455
6 votes
Accepted

Load IE symbols in Immunity Debugger

Immunity Debugger 1.60 and above supports loading of PDB Symbol files both locally or from a symbol server. In order to enable it. Go to Debug menu -> Debugging Symbol Options. Provide the local ...
  • 5,890
6 votes
Accepted

WHY and WHEN do we need SEH for buffer overflowing

First of all, read this: https://www.blackhat.com/presentations/bh-asia-03/bh-asia-03-litchfield.pdf That's pretty much how all this started. A SEH buffer overflow is a specific stack overflow that ...
  • 664
5 votes

Reversing Self-Modifying Malware

Start by placing a breakpoint on the entrypoint itself, which is probably not in the .text section at all, but in another section entirely. You will see that the program resolves its own imports ...
  • 4,511
4 votes

ollydbg ASLR and DEP bypass without mona

After figuring out that ASLR (Dynamic base) and DEP (NX compatible) flags in PE header can be inspect using dumpbin.exe /headers, I found out that the same PE header mapping is available in Ollydbg. (...
  • 173
4 votes

Immunity Debugger reset windows to default tiling

The default is CPU main thread which has four panels, three of which may become hidden if you have closed it or clicked on additional windows. To get back the initial layout, close all windows, reopen ...
  • 41
4 votes

Immunity Debugger - Memory Breakpoint

Yes For a memory access breakpoint1, just right click the desired address > Breakpoint > Memory, on access: The same applies to values in the hex dump: 1: A breakpoint on access will break whenver ...
  • 448
4 votes

How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?

using ollgdbgv2's debug child processes feature Instead of using Immunity Debugger (which is a forked from OllyDbg1.10), you might want to consider using OllyDbg2.0. One of the new features in ollydbg ...
  • 11.4k
4 votes
Accepted

Changing the font in immunity debugger?

Trying to figure out the problem I came with the following solution: Open Immunity Debugger as an Administrator Go to Options >> Appearance >> Fonts Rename one of the fonts to whatever ...
  • 8,689
3 votes
Accepted

Immunity Debugger - !mona suggest

mona.py only supports automatically generating Metasplpoit modules. You can't get it to output the exploitation code in any other form. pvefindaddr already suggested a payload layout based on that ...
  • 11.4k
3 votes

How can I extend a memory of an analysed executable in IDA Pro?

The most reliable solution I've found is to add a new section to the PE file and force the process to write the unpacked code into that new section in memory. I wrote up a blog post a few years ago ...
3 votes

Is it possible to name mona output files?

Since Mona's source is available on Github you can easily modify the code to fit your needs. The code that responsible to save the files can be found (currently) in line 2477 inside the class MnLog....
  • 8,689
3 votes
Accepted

how to find memory objects using immunity debugger

Put a INT3 (F2) breakpoint on the recv function (To jump to that function, hit CTRL+G then type recv to the textbox which just appeared, and then hit enter) within Immunity Debugger, and observe the ...
2 votes
Accepted

How to efficiently debug Loops with OllyDbg/Immunity?

No scripting required. In OllyDbg's disassembly window, left-click on line .text:00403855 32 C3 xor al, bl to select the line, then right-click on the selected line and choose ...
2 votes

Cannot call function (properly) in C++

At one particular instance it showed a debug error saying: "The process was not able to resume execution because the ESP value was changed", or something similar. ... typedef void(__cdecl* ...
2 votes
Accepted

Immunity Debugger PyPlugin

Going over ImmunityDbg presentation - page 26, v1.73 dir - dir structure ImmDbg help file - "PyHooks ... they look exactly as a python plugin, only that they are placed inside PyHooks directory." ...
  • 2,862
2 votes

Manipulate EIP in Immunity Debugger

Alternatively, you can select an address and press ctrl + * (use the * at the right pad)
  • 478
2 votes
Accepted

Windows debugger with ltrace functionality

ollydbg -> search for all intermodular calls -> in the new window -> set log break point radio button pause to never , log function argument to always ok you should see all the lib functions ...
  • 15.2k
2 votes

Fixing import table of unpacked DLL with ImpREC : ImpRec throws "invalid OEP!" error

I think this is too late but let's reply though. By default ImpREC has "Use PE Header From Disk" enabled. Which means it will NOT use the relocated DLL imagebase. 2 options : 1 - Untick it in options ...
2 votes

Immunity crashes on start

I ran into the exact same issue but my case was a little bit different. I had Python 3.5 installed on my Windows 7 laptop. Immunity would open and then immediately close. I installed Python 2.7 and,...
  • 121
2 votes
Accepted

Reversing Self-Modifying Malware

Thanks everyone who responded. The IAT was the problem. The OEP I found was the real OEP pointing to the unpacked code. But the dumped executable was not runnable because IAT was corrupt. After Fixing ...
1 vote

Loading a .sys file into Immunity Debugger

.sys extension is usually used for drivers. While they are the same PE executables, they run in kernel mode and thus use kernel-mode APIs exposed by the kernel executive itself (ntoskrnl.exe) or ...
  • 35.1k
1 vote

Unpacking and dumping executable from DLL

I would recommend using the starting address of the lpbuffer from WriteProcessMemory function and than setting OllyDump to that address (3rd option below Module) : After that if needed you can fix ...
1 vote

Immnunity Debugger Python API Incorrect code execution order

It looks like "Breakpoint at" means "the breakpoint was hit", not "breakpoint was set". The breakpoint can be only triggered once the program is running. Since you call log() before run(), the log ...
  • 35.1k
1 vote

Modifying PPID to avoid anti-debugging measure

So after going through the existing immunity scripts and mona.py, I found out that you also need to unpack the readMemory return values. Working code: class Process32NextWHook(LogBpHook): def ...
  • 219

Only top scored, non community-wiki answers of a minimum length are eligible