OpenRCE: Blog

i started working on Ubuntu

Tue, 16 Jun 2009 08:56:01 -0500

I started working on Ubuntu. and currently i'm not using WIndows.
I use VMWare to run Windows.
of couse, It works very very slowly. it takes about 3minuts to open IDA pro.

and so,
Are there ways that disassembling PE file on Linux?
Does gdb has options to disassemble PE file?
running OllyDbg/ImmuniryDebugger on WINE makes hang-up.

I whish I could disas PE files on Linux naturally.

it's hard for me... orz

Sat, 29 Mar 2008 10:00:16 -0500

I'm trying to find vulnerablities by using IDA pro or ImmDbg and so on...
but, 6 months has passed... and nothing found. orz.
at first. I list functions which is like fopen, and trace the use of FD returned.
and investigate functions which is like memmove, memcpy, and memory copy operations.
but, all softwares which i debugged use these securely.
this method is not efficient?

Thre result i found is that,
the world is quite secure than i thought.

don't work...

Sun, 16 Dec 2007 09:06:46 -0600

I wrote immdbg python script as follows.

#-----------------------------------------
# hooktest.py
class TestHook( libhook.LogBpHook ):
    def __init__( self ):
libhook.LogBpHook.__init__( self );
    def run( self, regs ):
ImmDbgr = immlib.Debugger();
ImmDbgr.Log( "Test" );

def main(args):
    T = TestHook();
    T.add( "TestHook", int( args[0], 16 ) );
    return "set hook";
#----------------------------------

copied it to PyCommand,
and, invoked at commandline as "!hooktest 0x412120"
0x412120 is the head address of function that I wanted to hook.
finally i ran the immdbg.

when the above script invoked, it output "Test" in Log window,
and hang up...
what's wrong with me...orz

ImmunityDebugger

Wed, 17 Oct 2007 12:46:13 -0500

I want to use graphclass to illustrate code coverage.
but,
there are no example codes!.
Please tell me how to use it?