http://www.openrce.org/rss/feeds/blog OpenRCE: The Open Reverse Code Engineering Community Fri, 24 Aug 2012 10:48:48 -0500 https://www.openrce.org/blog/view/2373/New_version_of_Ollydbg! inwk <email-suppressed@example.com> The new version of Olly is <b>OllyDbg 2.01 beta 2</b>, more info <a href="http://www.ollydbg.de/version2.html">here</a>. Wed, 15 Aug 2012 08:34:01 -0500 https://www.openrce.org/blog/view/2324/Immunity_debugger_-_default_PyCommands inwk <email-suppressed@example.com> This blog entry is just quick note. I am new user of immdbg and it's nice to have short list of commands :)<br /> <br /> Activex:<br /> - activex - This is script that will resolve exposed COM functions to their relative address.<br /> <br /> Logging:<br /> - apitrace - Hooks all intermodular function calls and logs them<br /> - sqlhooker - logs SQL queries<br /> - getevent - Get a log of current debugevent<br /> <br /> Heap:<br /> - chunkanalyzehook - Analize a Specific Chunk at a specific moment. Gets address as a value of EIP and expression to calculate the chunk address<br /> - funsniff - Analize the heap pattern of a executed function<br /> - heap - Immunity Heap Dump and analyzing tool<br /> - hippie - Heap logging function<br /> - hookheap - Hook on RtlAllocateHeap/RtlFreeHeap and display information<br /> - horse - Low Fragmentation Heap Viewer<br /> - lookaside - Shows the Lookaside of the Heap structure<br /> <br /> Exploiting:<br /> - acrocache - Dumps Acrobat Reader Cache state<br /> - duality - Looks for mapped address that can be 'transformed' into opcodes<br /> - findantidep - Find address to bypass software DEP<br /> - safeseh - Looks for exception handlers registered with SafeSEH<br /> - vcthook - This hook is used to check if the arguments of VariantChangeType are pointers to the same object. There might be vulnerabilities in code that call this function in such a manner.<br /> <br /> Searching and comparing:<br /> - cmpmem - Compare memory with a file<br /> - mark - Static Analysis: Mark the tiny ones. Search and mark given function.<br /> -search - simple script that lets you quickie search for regexp<br /> - searchcode - Search code in memory<br /> - searchcrypt - Search a defined memory range looking for cryptographic routines<br /> - searchheap - Search the heap for specific chunks<br /> - searchspray - Script to search all occurences of a string in memory and display them on a table<br /> - shellcodediff - Check for badchars<br /> <br /> Analyzing:<br /> - bpxep - Finds entry point...<br /> - dependencies - Find a exported function on the loaded dll<br /> - finddatatype - Attempts to find the type of the data spanning<br /> - findloop - Find natural loops given a function start address<br /> - findpacker - Find a Packer/Cryptor on a Module<br /> - getrpc - Get the RPC information of a loaded dll<br /> - hookndr - Hooks the NDR unmarshalling routines and prints them out so you can see which ones worked<br /> - recognize - Function Recognizing using heuristic patterns<br /> - scanpe - Detect a Packer/Cryptor of Main Module, also scan just EntryPoint. Calculates the entropy of a chunk of data.<br /> - stackvars - set comments around the code to follow stack variables size and content<br /> - syscall - discover system calls<br /> - treedll - Creates imported dll tree<br /> <br /> Network:<br /> - hookssl - Creates a table that displays packets received on the network<br /> - mike - Attempts to automate tracing the lifecycle of a network packet's contents.<br /> - packets - Creates a table that displays packets received on the network<br /> <br /> Misc:<br /> - gflags - Global flags management tools<br /> - hidedebug - Patches lots of anti-debug protection<br /> - list - List all pycommands in log window<br /> - modptr - Patch all Function Pointers and detect when they triggered<br /> - nohooks - Clean all hooks from memory<br /> - openfile - Opens a File<br /> - pyexec - Non interactive python shell [immlib already imported]<br /> - template - Immunity PyCommand Template<br /> - traceargs - Find User supplied arguments into a given function<br /> - usage - Return the usage information for a python command<br /> <br /> It's all. Any mistakes?