Back to list
Immunity Debugger v1.5
Mar 27 2008 10:25PM
Nicolas Waisman (nicolas immunityinc com)
-----BEGIN PGP SIGNED MESSAGE-----
Immunity team is proud to present: Immunity Debugger 1.5
This new Immunity Debugger release provides a lot of new scripts and
important fixes. New scripts to improve your debugging experience
include: gflags, hookssl, and hookndr.
The API has been reinforced with new functionality which allows you to
gather more information from the remote process, such as Threads,
findRetValue. This release also includes some important fixes such as
correct Memory Page protection flags, which are also available via the
Check the Changelog below for the details of this exciting release.
As usual, you can discuss your scripts, request new features or just hang
out at our forum: http://forum.immunityinc.com. We would like to thank
Teddy Roggers from tuts4you for maintaining a list of Immunity Debugger
ported plug-ins that can be found at
Do you want to hire a hacker? Are you looking for job? Immunity has
extended the Immunity Debugger Advertisment service to hackers, reverse
engineers and debugger freaks and it is now free for job seekers!
Job seekers can place ads at
Happy debugging (and job hunting)!
P.S.: If you want to request a feature, show off your script or just
chat about Immunity Debugger, Justin Seitz from the Immunity Debugger
team will be at CanSecWest for the next three days.
1.50 Build 0
- - Debugger:
o Added "Servers" folder with specific PyCommand listeners - for
example, hookssl.py will send all the data back to a XML-RPC service
using ssl_listener.py, which then has the option to change it and send
- - Memory Pages:
o Working on Windows Vista. Now correct on Windows XP, 2000, 2003.
Immunity Debugger API:
o Added imm.vmQuery() wrapper [Query Virtual Memory pages]
o The MemoryPage class has been improved.
- Protect and Allocation Protect Flags are queried in real-time
- You can get a human readable flag passing human = 1 to
page.getAccess() and page.getInitAccess()
These methods will search in any memory page with access = any
to receive an extra flag parameter to specify memory protection type
o Added imm.isAdmin() : is ID running as admin?
o Added Thread class to debugtypes.py
o Added imm.getAllThreads() method
o librecognition.py : Improved REGEXP support for the indexed register
o Added Function.findRetValue Find all the possible values on a Function
o GFlags class Handle Windows Global Flags.
o gflags.py: Enable/Disable Windows Global Flags
o recognize.py: Backward compatability
o Added hookssl.py
o Added ssl_listener.py to Servers directory
o Added hookndr.py: Hooks the NDR unmarshalling routines and prints them
out so you can see which ones worked
o Added nohooks.py : removes all hooks from memory
- - Debugger Core
o The memory page protect information is correctly displayed now.
o Fixed Second Analysis pass repeated entries bug.
o Fixed thread state swap issue which was leading to a memory leak.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
-----END PGP SIGNATURE-----
[ reply ]
Copyright 2010, SecurityFocus