Mirror for BoB’s Immunity Debugger projects

This page serves as a mirror for 2 Immunity Debugger related projects, written by BoB.

Unofficial PDK v1.03 for Immunity Debugger

Original project page : http://bob.droppages.com/Projects/Immunity+Debugger/PDK

Long ago in November 2008 I created an unofficial Immunity Debugger PDK, and I have now updated it in 2011 for the Immunity Debugger v1.8x plugin format changes.

Plugins created with this PDK are compatible with old and new Immunity debugger, and also OllyDbg v1.10 and it’s many variants (OllySND, OllyDRX, CiM’s Olly, OllyShadow etc)

No modification (like my FixPlugins tool) is needed for this compatibility, just copy to the plugins path for the debugger and it will be in the list. A simple plugin is included – WinMax – which you can use to test in your debugger versions. As always, full source is included for the PDK and example plugins.

If anybody wants to convert the PDK into another language then please do, but please send to me for inclusion in the distribution.

Technical details: The PDK contains initialization code that will alter the Exports in memory to suit the debugger that is loading the Plugin. The debugger is first detected using a simple test. The usual implicit Imports are instead dynamically resolved during initialization, which allows the use of any name for the debugger exe – useful if some program is looking for default debugger process names.

Download

WinMax_ImmDbg_Plugin.RAR

 

 

Immunity Debugger Plugin Fixer Tool v1.01

Original project page : http://bob.droppages.com/Projects/Immunity+Debugger/FixPlugins

This is a small tool to convert old Immunity Debugger plugins to be compatible with the Immunity Debugger v1.8x changes. The tool also works with OllyDbg plugins, and comes with full source.

Simply drop old plugin(s) onto the FixPlugins.EXE and a new file will be generated which will have Imports and Exports fixed to be compatible.

Technical details: The imports are first converted to ordinal values, and then mapped to the new ordinal order using a simple table. For OllyDbg also the module name is changed to be “ImmunityDebugger.exe”. The exports are simply incremented (skipping the old underscore) for Immunity Debugger, and in the case of OllyDbg Plugin then the prefix is rewritten to be “IMMDBG_”.

NOTE: This tool makes modifications to the PE headers of the file, thus it will not work with compressed plugins!

NOTE2: Not all OllyDbg plugins will work, specifically the ones that patch OllyDbg – obviously because it will patch the bytes of Immunity Debugger instead of OllyDbg!

 

Download

ImmDbg_Plugin_Fixer.RAR

 


Tx BoB for allowing me to mirror these 2 projects !


Corelan Live training

Since 2011, Corelan GCV has been teaching live win32 exploit dev classes at various security cons and private companies & organizations.

You can read more about the training and schedules here

Demand Global Change

The world needs your help !

Please take a few moments to read the "Demand Global Change Call For Action" document at
http://bit.ly/demandglobalchange
Read the full document at
http://bit.ly/demandglobalchange_full and share the message with as many people as possible.

Like the Facebook page, and SHARE it with everyone you know.



Donate

Want to support the Corelan Team community ? Click here to go to our donations page.

Want to donate BTC to Corelan Team?



Your donation will help funding server hosting.

Protected by Copyscape Web Plagiarism Tool

Corelan Team Merchandise

You can support Corelan Team by donating or purchasing items from the official Corelan Team merchandising store.

Corelan on IRC

You can chat with us and our friends on #corelan (freenode IRC)

Categories