Flag: Tornado! Hurricane!

 Forums >>  Debuggers  >>  Pydbg attach Vs load?

Topic created on: July 29, 2010 11:09 CDT by ResearchAviator .

I find PAIMEI and Pydbg as potentially rich framework. However almost all the examples in the PAIMEI framework uses pydbg to attach to a pid of a process that is already running and using load() does not work. Incase of malware analysis, I find this as a challenge as in most cases the malware immediately completes its actions after launching before using pydbg. I am really sure that i am missing something here as PAIMEI has been successfuly used by many researchers for four years now. Can somebody here point out what am i missing?

  aMIr     July 30, 2010 08:20.37 CDT
pydbg can load() your debuggee very well and you can do your anlysis on it. as an example I'm posting piece of code to handle this for you:

dbg = pydbg()
dbg.load("example.exe", "-u amir")
dbg.debug_event_loop() #or you can simply use it's wrapper run() instead debug_event_loop().


that's all! but yeah, long ago  I had some minor glitches in paimei when i was working with it on loading an executable directly . but by retrying worked fine.

  ResearchAviator     July 31, 2010 03:25.35 CDT
Yeah, the load() api works some time and fails sometime. I am looking to develop a simple script that can help plotting the logic of a polymorphic virus.

Note: Registration is required to post to the forums.

Active in Last 5 Minutes
waleedassar

There are 28,224 total registered users.


Recently Created Topics
Reverse Engineering ...
Jan/23
Career: DoD Agency I...
Jan/22
"Disappearing&q...
Jan/17
Career: Software Sec...
Jan/11
Where is the call st...
Jan/07
IDA Pro 6.1 Breakpoi...
Jan/01
How to create data s...
Dec/30
can i search all mod...
Dec/23
IDA symbol table exp...
Dec/20
An anti-attach trick
Dec/17


Recent Forum Posts
Reverse Engineering ...
NirIzr
"Disappearing&q...
NirIzr
Reverse Engineering ...
charlie
"Disappearing&q...
charlie
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
Looking for value in...
NirIzr


Recent Blog Entries
cmathieu
Feb/07
Hacker Carnival

waleedassar
Feb/06
OllyDbg v1.10 And Hardware ...

waleedassar
Jan/31
Yet Another Anti-Debug Trick

RolfRolles
Jan/22
Finding Bugs in VMs with a ...

waleedassar
Jan/13
An OllyDbg Bug Disables Sof...

More ...


Recent Blog Comments
waleedassar on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/05
Yet Another Anti-Debug Trick

trolotou on:
Feb/05
Doudoune Moncler -Pennies F...

waleedassar on:
Feb/01
Yet Another Anti-Debug Trick

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit