Flag: Tornado! Hurricane!

 Forums >>  Debuggers  >>  Immunity Debugger / intermodular call logging without dbg symbols

Topic created on: October 22, 2011 05:50 CDT by enodr .

Hi,

I am using Immunity Debugger to do API (intermodullar) calls logging using code similar to this:
*** Immunity Debugger Python Shell v0.1 ***
Immlib instanciated as 'imm' PyObject
READY.
>>>stacks = imm.callStack()
>>>main_call = False
>>>for i in stacks:
>>> if i.getProcedure().startswith(" ") == False:
>>> if main_call == True:
>>> break
>>> else:
>>> main_call = True
>>> print "Main Call %s" % i.getProcedure()
>>> else:
>>> print "Argument: %s" % i.getProcedure()
>>>
Main Call kernel32.CreateFileA
Argument:   FileName = "C:\WINDOWS\System32\drivers\etc\services"
Argument:   Access = GENERIC_READ
Argument:   ShareMode = FILE_SHARE_READ|FILE_SHARE_WRITE
Argument:   pSecurity = 0345EFC4
Argument:   Mode = OPEN_EXISTING
Argument:   Attributes = NORMAL
Argument:   hTemplateFile = NULL
>>>


Of course with this example kernel32.dll has full debug symbols so the result displays correctly the parameters names and content.

How would it be possible to do the same display formating with dlls which don't have debug symblos, but for which you know the function parameters names and type?

I guess I could make some kind of file with function prototypes but then I don't know how to deal with the python script and callstack.getProcedure or such.

Thanks.

No posts found under this topic.
Note: Registration is required to post to the forums.

There are 30,620 total registered users.


Recently Created Topics
IDA PRO Struct Point...
Apr/15
problems with pseudo...
Apr/04
Problem with ollydbg
Mar/22
Should binaries be n...
Mar/22
Ida pro on infineon ...
Mar/10
need help about an D...
Feb/25
Stop a VB6 Applicati...
Feb/13
Add one new segment,...
Jan/23
64bit calc.exe Stack...
Jan/19
Finding the procedur...
Jan/19


Recent Forum Posts
Should binaries be n...
Kolisar
Problem with ollydbg
nullx42
!findtrampoline Immu...
skycrack
looking for a softwa...
raxen
Documenting reversed...
raxen
.orpc section what's...
mbin
Pydbg load() issue
phreak
Pydbg load() issue
netw0rm
How would you interp...
mbin
Pydbg load() issue
phreak


Recent Blog Entries
gareebnavas
Jan/21
Android Malware Analysis

oleavr
Dec/21
frida.github.io: scriptable...

chr1x
Nov/05
!apilookup - Win32 API Func...

hasherezade
Aug/24
Andromeda (W32/Kryptik.AX!t...

MalwareAnalyzer
Aug/06
Malware-Analyzer

More ...


Recent Blog Comments
pedram on:
Dec/21
frida.github.io: scriptable...

cin100dy on:
Dec/16
Devil May Cry Cosplay Costu...

NeOXQuiCk on:
Nov/26
DONGLE

maharlee on:
Nov/21
Cheap Nike Shoes NZ,Nike Sh...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit