From Collaborative RCE Tool Library
|Tool name:||Immunity Debugger||
|Author:||Immunity Inc / Oleh Yuschuk|
|Last updated:||March 27, 2008|
|Direct D/L link:||N/A|
|Description:||Immunity Debugger is based on OllyDbg.
Immunity Debugger is a powerful new way to write exploits, analyze malware, and reverse engineer binary files. It builds on a solid user interface with function graphing, the industry's first heap analysis tool built specifically for heap creation, and a large and well supported Python API for easy extensibility.
* A debugger with functionality designed specifically for the security industry
* Cuts exploit development time by 50%
* Simple, understandable interfaces
* Robust and powerful scripting language for automating intelligent debugging
* Lightweight and fast debugging to prevent corruption during complex analysis
* Connectivity to fuzzers and exploit development tools
|Related URLs:||No related URLs have been submitted for this tool yet|
Here below you will find useful notes about this tool, left by other users.
You are welcome to add your own useful notes here, or edit any existing notes to improve or extend them.
Immunity Debugger 1.5
Immunity team is proud to present: Immunity Debugger 1.5
This new Immunity Debugger release provides a lot of new scripts and important fixes. New scripts to improve your debugging experience include: gflags, hookssl, and hookndr.
The API has been reinforced with new functionality which allows you to gather more information from the remote process, such as Threads, findRetValue. This release also includes some important fixes such as correct Memory Page protection flags, which are also available via the Python API.
Check the Changelog below for the details of this exciting release.
As usual, you can discuss your scripts, request new features or just hang out at our forum: http://forum.immunityinc.com. We would like to thank Teddy Roggers from tuts4you for maintaining a list of Immunity Debugger ported plug-ins that can be found at http://www.tuts4you.com/download.php?list.74
Do you want to hire a hacker? Are you looking for job? Immunity has extended the Immunity Debugger Advertisment service to hackers, reverse engineers and debugger freaks and it is now free for job seekers!
Job seekers can place ads at http://debugger.immunityinc.com/hireahacker.html
Happy debugging (and job hunting)!
Team Immunity P.S.: If you want to request a feature, show off your script or just chat about Immunity Debugger, Justin Seitz from the Immunity Debugger team will be at CanSecWest for the next three days.
1.50 Build 0
o Added "Servers" folder with specific PyCommand listeners - for example, hookssl.py will send all the data back to a XML-RPC service using ssl_listener.py, which then has the option to change it and send it back.
- Memory Pages:
o Working on Windows Vista. Now correct on Windows XP, 2000, 2003.
Immunity Debugger API:
o Added imm.vmQuery() wrapper [Query Virtual Memory pages] o The MemoryPage class has been improved. - Protect and Allocation Protect Flags are queried in real-time - You can get a human readable flag passing human = 1 to page.getAccess() and page.getInitAccess() o Added: - searchOnExecute() - searchOnRead() - searchOnWrite() These methods will search in any memory page with access = any
o Modified: - Search() - searchShort() - searchLong() to receive an extra flag parameter to specify memory protection type when searching. o Added imm.isAdmin() : is ID running as admin? o Added Thread class to debugtypes.py o Added imm.getAllThreads() method o librecognition.py : Improved REGEXP support for the indexed register search o Added Function.findRetValue Find all the possible values on a Function o GFlags class Handle Windows Global Flags.
o gflags.py: Enable/Disable Windows Global Flags o recognize.py: Backward compatability o Added hookssl.py o Added ssl_listener.py to Servers directory o Added hookndr.py: Hooks the NDR unmarshalling routines and prints them out so you can see which ones worked o Added nohooks.py : removes all hooks from memory
- Debugger Core
o The memory page protect information is correctly displayed now. o Fixed Second Analysis pass repeated entries bug. o Fixed thread state swap issue which was leading to a memory leak.
Immunity Debugger 1.6
Immunity, Inc. proudly presents: IMMUNITY DEBUGGER 1.6
This release we are introducing the most requested feature since the release of ID 1.0 in the form of automatic symbol downloading.
In the script department we included two awesome new scripts: tredll and findloop. Yes, you read that correctly, we have implemented dominator trees for your coverage analysis pleasure and you are now able to detect loops inside functions.
Immunity Debugger 1.6 delivers more stability and fixes a lot of known issues. For example the old AddKnowledge/PostAnalysis bug is gone and the land of hooking is all happiness. Check the Changelog below for more details.
Download it now: http://debugger.immunityinc.com/
For the next release we are working on variables and structure, so stay tuned!
The Immunity ID Team
1.60 Build 0
o Added 'Use Symbol Server' option  o Improved Getallnames o Added timestamp to log events
- Immunity Debugger API
o Added getAllSymbolsFromModule method o Added libcontrolflow.py Container for classes DominatorTree and ControlFlowAnalysis o Added Clear function to FastLogHook.
o Added findloop.py: Find natural loops given a function start. o Added treedll.py: Creates imported dll tree.
- Bug Fixes:
o Fixed POST_ANALYSIS_HOOK "FATAL ERROR" o Fixed Arguments overflow (Thanks David Wetson for reporting this one!) o Local Symbol Path issue o Analysis second pass option now works o Getallsymbols now correctly creates the PyDict [Import/Export/Library issue]
(please also edit it if you think it fits well in some additional category, since this can also be controlled)