Posts Tagged ‘immlib’
Starting to write Immunity Debugger PyCommands : my cheatsheet
Author: Peter Van Eeckhoutte
Add this post to Your Favorite Posts
When I started Win32 exploit development many years ago, my preferred debugger at the time was WinDbg (and some Olly). While Windbg is a great and fast debugger, I quickly figured out that some additional/external tools were required to improve my exploit development experience. Despite the fact that the command line oriented approach in windbg has many advantages, it appeared not the best tool to search for good jump addresses, or to list non-safeseh compiled / non-aslr aware modules, etc…. Ok, looking for a simple “jmp esp” is trivial, but what if you are looking for all pop pop ret combinations in non-safeseh compiled modules… Not an easy task. It is perfectly possible to build plugins for Windbg, but the ones that I have found (MSEC, byakugan (Metasploit)) don’t always work the way I want them …
Posted in 001_Security, Development, Exploit Writing Tutorials, Scripts | 
Tags: api, assemble, cheatsheet, debugger, disassemble, immlib, immunity, immunity debugger, module, plugin, pycommand, python, readmemory, script | 
5 Comments »
- Lincoln on CORELAN-10-060 – 123 Flash Chat ver 7.8 August 16, 2010
- Sud0 on CORELAN-10-059 – Sopcast Unicode BOF Remote Exploit August 10, 2010
- MaRkO T. on CORELAN-10-058 – ActiTime2 0MA CSRF July 11, 2010
- MaRkO T. on CORELAN-10-057 – Oracle BPM Process Administrator 5.7-6.0-10.3 MPs XSS July 11, 2010
- chap0 on CORELAN-10-056 - Hero DVD Remote Buffer Overflow Exploit July 7, 2010
- MaRkO T. on CORELAN-10-055 – MemDb (Multiple Remote Dos) June 28, 2010
- chap0 on CORELAN-10-054 - GSM sms Utility SEH Buffer Overflow June 28, 2010
- TecR0c on CORELAN-10-053 – FieldNotes 32 v5.00 SEH exploit June 25, 2010
- sinn3r on CORELAN-10-052 – NO-IP Domain Update Client (DUC) "Request" Insecure Encoding Algorithm June 24, 2010
- chap0 on CORELAN-10-051 - Vocoo CP3 Studio PC Version 2.0 Dos June 12, 2010