immunity debugger script

Found an Immunity Debugger script on pastebin! FTW.

Posted by Anonymous on Fri 17 Jul 23:09

1. #!/usr/bin/env python
2.  
3. __VERSION__ = '0.1'
4.  
5. import immlib
6. import getopt
7.  
8. from immlib import MemoryProtection
9. from immutils import prettyhexprint
10.  
11. DESC= "Immunity PyCommand isexec"
12. USAGE = "!isexec address"
13.  
14. def usage(imm):
15.     imm.Log("!isexec")
16.     imm.Log(USAGE, focus=1)
17.  
18. def main(args):
19.     imm = immlib.Debugger()
20.    
21.     imm.Log(' '.join(["###", DESC, "###"]))
22.     if len(args) == 0:    
23.         imm.Log(USAGE, focus=1)    
24.         return USAGE
25.  
26.     addr = int(args[0], 16)
27.     imm.Log("Retrieving page information for %x" % addr)
28.     page = imm.getMemoryPagebyAddress(addr)
29.  
30.     if page == None:
31.         return "Invalid address: %x" % addr
32.  
33.     execute = False;
34.    
35.     for acc in [MemoryProtection["PAGE_EXECUTE"],
36.                 MemoryProtection["PAGE_EXECUTE_READ"],
37.                 MemoryProtection["PAGE_EXECUTE_READWRITE"],
38.                 MemoryProtection["PAGE_EXECUTE_WRITECOPY"]]:
39.         if acc == page.access:
40.             execute = True;
41.    
42.     if execute:
43.         imm.Log("Address %x, in page %x, is executable"% (addr, page.getBaseAddress()))
44.         return "%x is executable" % addr
45.     else:
46.         imm.Log("Address %x, in page %x, is not executable" % (addr, page.getBaseAddress()))
47.         return "%x is not executable" % addr
48.  
49. =========================
50.  
51. 0BADF00D  ### Immunity PyCommand isexec ###
52. 0BADF00D  Retrieving page information for 12ffd0
53. 0BADF00D  Address 12ffd0, in page 126000, is not executable
54.  
55. 0BADF00D  ### Immunity PyCommand isexec ###
56. 0BADF00D  Retrieving page information for 40133a
57. 0BADF00D  Address 40133a, in page 401000, is marked as executable

The pastebin: http://python.pastebin.com/mb25963a

Bookmark this post with:

• 
• 
• 
• 
• 
• 
• 
• 
•