{"id":810,"date":"2014-06-01T20:21:44","date_gmt":"2014-06-01T20:21:44","guid":{"rendered":"http:\/\/www.gironsec.com\/blog\/?p=810"},"modified":"2014-06-04T01:54:45","modified_gmt":"2014-06-04T01:54:45","slug":"joebp-immuninty-debugger-script","status":"publish","type":"post","link":"https:\/\/www.gironsec.com\/blog\/2014\/06\/joebp-immuninty-debugger-script\/","title":{"rendered":"joebp – immuninty debugger script"},"content":{"rendered":"

Howdy!<\/p>\n

I made some changes to my break point script to make it more modular and accept arguments and stuff. I normally steer clear of python due to its agonizingly strict syntax, but I suffered through it for you. I use this script every single day when I first load a piece of malware into the debugger as the breakpoints listed are the ones most commonly used by malware (or most any program really). <\/p>\n

<\/p>\n

\n
"""JoeBP"""<\/span>\r\n\r\n# -*- coding: utf-8 -*-<\/span>\r\nimport<\/span> getopt<\/span>\r\nimport<\/span> immutils<\/span>\r\nfrom<\/span> immlib<\/span> import<\/span> *<\/span>\r\n\r\nAppName =<\/span> "JoeBP"<\/span>\r\nimm =<\/span> Debugger()\r\n\r\ndef<\/span> usage<\/span>(imm):\r\n    imm.<\/span>log(" !joebp -options "<\/span>)\r\n    imm.<\/span>log(" "<\/span>)\r\n    imm.<\/span>log(" <\/span>%s<\/span> By Joe Giron >|< Gironsec.com "<\/span> %<\/span> (AppName),focus=<\/span>1<\/span>, highlight=<\/span>1<\/span>)\r\n    imm.<\/span>log(" "<\/span>)\r\n    imm.<\/span>log(" Description:"<\/span>)\r\n    imm.<\/span>log(" "<\/span>)\r\n    imm.<\/span>log(" Sets the proper common breakpoints useful for malware analysis.  "<\/span>)\r\n    imm.<\/span>log(" Breaks on file operations, registry, processes, threads, dlls, sleeping, memory manipulation, and more. "<\/span>)\r\n    imm.<\/span>log(" "<\/span>)\r\n    imm.<\/span>log(" Usage:"<\/span>)\r\n    imm.<\/span>log(" "<\/span>)\r\n    imm.<\/span>log(" -n    Set network operation breakpoints for winsock and wininet."<\/span>)\r\n    imm.<\/span>log(" "<\/span>)\r\n    imm.<\/span>log(" -f    Set file operation breakpoints."<\/span>)\r\n    imm.<\/span>log(" "<\/span>)\r\n    imm.<\/span>log(" -p    Set process creation \/ manipulation breakpoints"<\/span>)\r\n    imm.<\/span>log(" "<\/span>)\r\n    imm.<\/span>log(" -t    Set thread operation \/ creation breakpoints."<\/span>)\r\n    imm.<\/span>log(" "<\/span>)\r\n    imm.<\/span>log(" -m    Set memory allocation \/ manipulation breakpoints."<\/span>)\r\n    imm.<\/span>log(" "<\/span>)\r\n    imm.<\/span>log(" -s    Set sleep \/ timing breakpoints."<\/span>)\r\n    imm.<\/span>log(" "<\/span>)\r\n    imm.<\/span>log(" -r    Set registry operation breakpoints."<\/span>)\r\n    imm.<\/span>log(" "<\/span>)\r\n    imm.<\/span>log(" -e    Set all options."<\/span>)    \r\n    imm.<\/span>log(" "<\/span>)\r\n    imm.<\/span>log(" -h    Shows help menu(this)."<\/span>)\r\n    \r\ndef<\/span> FileBP<\/span>(imm):\r\n    imm.<\/span>setBreakpointOnName("kernel32.CreateFileA"<\/span>) #file stuff<\/span>\r\n    imm.<\/span>setBreakpointOnName("kernel32.CreateFileW"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.WriteFileEx"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.WriteFile"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.MoveFileA"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.MoveFileW"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.MoveFileExA"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.MoveFileExW"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.CopyFileA"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.CopyFileW"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.CopyFileExA"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.CopyFileExW"<\/span>)        \r\n\r\ndef<\/span> ProcBP<\/span>(imm):\r\n    imm.<\/span>setBreakpointOnName("kernel32.ExitProcess"<\/span>) #process stuff<\/span>\r\n    imm.<\/span>setBreakpointOnName("kernel32.OpenProcess"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.CreateRemoteThread"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.TerminateProcess"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.CreateProcessA"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.CreateProcessW"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("CreateProcessWithLogonA"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("CreateProcessWithLogonW"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.GetModuleHandleA"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.GetModuleHandleW"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.GetModuleFileNameA"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.GetModuleFileNameW"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.GetModuleHandleExA"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.GetModuleHandleExW"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.LoadLibraryA"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.LoadLibraryW"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.LoadLibraryExA"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.LoadLibraryExW"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.GetProcAddress"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.LoadModule"<\/span>)\r\n    if<\/span> imm.<\/span>findModuleByName("user32.dll"<\/span>):\r\n        imm.<\/span>setBreakpointOnName("user32.EndTask"<\/span>)\r\n    else<\/span>:\r\n        return<\/span> "user32.dll is not loaded and thus, BP's cannot be set on it"<\/span>\r\n\r\ndef<\/span> ThreadBP<\/span>(imm):\r\n    imm.<\/span>setBreakpointOnName("kernel32.CreateThread"<\/span>) #thread stuff<\/span>\r\n    imm.<\/span>setBreakpointOnName("kernel32.ExitThread"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.TerminateThread"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.ResumeThread"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.SuspendThread"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.GetThreadContext"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.SetThreadContext"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("ntdll.ZwResumeThread"<\/span>) \r\n    imm.<\/span>setBreakpointOnName("ntdll.ZwSuspendThread"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("ntdll.NtQueryInformationThread"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("ntdll.NtQueueApcThread"<\/span>)\r\n\r\n\r\ndef<\/span> MemBP<\/span>(imm):\r\n    imm.<\/span>setBreakpointOnName("kernel32.ReadProcessMemory"<\/span>) #memory stuff<\/span>\r\n    imm.<\/span>setBreakpointOnName("kernel32.WriteProcessMemory"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.MapViewOfFile"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.MapViewOfFileEx"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.VirtualProtect"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.VirtualProtectEx"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.VirtualQuery"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.VirtualQueryEx"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.LocalAlloc"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.HeapAlloc"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.GetProcessHeap"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("ntdll.ZwUnmapViewOfSection"<\/span>)#ntdll special<\/span>\r\n    imm.<\/span>setBreakpointOnName("ntdll.ZwMapViewOfSection"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("ntdll.ZwReadVirtualMemory"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("ntdll.NtCreateSection"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("ntdll.NtQueryInformationProcess"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("ntdll.memcpy"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("ntdll.memset"<\/span>)\r\n\r\n    \r\n\r\ndef<\/span> SleepBP<\/span>(imm):\r\n    imm.<\/span>setBreakpointOnName("kernel32.Sleep"<\/span>)  #sleep stuff<\/span>\r\n    imm.<\/span>setBreakpointOnName("kernel32.SleepEx"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.QueryPerformanceCounter"<\/span>)\r\n    imm.<\/span>setBreakpointOnName("kernel32.GetTickCount"<\/span>)\r\n    #imm.setBreakpointOnName("kernel32.GetTickCount64")    # only works on win7<\/span>\r\n\r\ndef<\/span> RegBP<\/span>(imm):\r\n    \r\n    if<\/span> imm.<\/span>findModuleByName("advapi32.dll"<\/span>):\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegDeleteValueA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegDeleteValueW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegEnumKeyA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegEnumKeyExA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegEnumKeyExW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegEnumKeyW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegEnumValueA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegEnumValueW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegOpenKeyA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegOpenKeyExA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegOpenKeyExW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegOpenKeyW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegQueryMultipleValuesA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegQueryMultipleValuesW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegQueryValueA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegQueryValueExA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegQueryValueExW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegQueryValueW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegReplaceKeyA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegReplaceKeyW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegRestoreKeyA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegRestoreKeyW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegSaveKeyA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegSaveKeyExA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegSaveKeyExW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegSaveKeyW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegSetValueA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegSetValueExA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegSetValueExW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegSetValueW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegUnLoadKeyA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("advapi32.RegUnLoadKeyW"<\/span>)\r\n    else<\/span>:\r\n        return<\/span> "advapi32.dll is not loaded, thus registry actions cannot be logged for BP's"<\/span>\r\n        \r\ndef<\/span> NetBP<\/span>(imm):\r\n    if<\/span> imm.<\/span>findModuleByName("wininet.dll"<\/span>):\r\n        imm.<\/span>setBreakpointOnName("wininet.InternetReadFile"<\/span>)# http<\/span>\r\n        imm.<\/span>setBreakpointOnName("wininet.InternetOpenUrlA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.InternetOpenUrlW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.InternetOpenA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.InternetOpenW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.InternetCrackUrlA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.InternetCrackUrlW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.InternetQueryOptionW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.InternetQueryOptionA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.InternetQueryDataAvailable"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.InternetReadFile"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.InternetReadFileEx"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.InternetSetOptionW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.InternetSetOptionA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.InternetConnectA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.InternetConnectW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.InternetCloseHandle"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.HttpSendRequestA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.HttpSendRequestW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.HttpOpenRequestA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.HttpOpenRequestW"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.HttpQueryInfoA"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("wininet.HttpQueryInfoW"<\/span>)\r\n    else<\/span>:\r\n        return<\/span> "wininet \/ winsock not loaded. Cannot set net breakpoints!"<\/span>\r\n    if<\/span> imm.<\/span>findModuleByName("ws2_32.dll"<\/span>):\r\n        imm.<\/span>setBreakpointOnName("ws2_32.WSAStartup"<\/span>) # internet<\/span>\r\n        imm.<\/span>setBreakpointOnName("ws2_32.inet_add"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("ws2_32.inet_ntoa"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("ws2_32.send"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("ws2_32.recv"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("ws2_32.WSASend"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("ws2_32.WSARecv"<\/span>)\r\n        imm.<\/span>setBreakpointOnName("ws2_32.WSACleanup"<\/span>)\r\n    else<\/span>:\r\n        return<\/span> "wininet \/ winsock not loaded. Cannot set net breakpoints!"<\/span>\r\n\r\n    \r\ndef<\/span> DoEmAll<\/span>(imm):\r\n    ProcBP(imm)\r\n    RegBP(imm)\r\n    MemBP(imm)\r\n    ThreadBP(imm)\r\n    FileBP(imm)\r\n    SleepBP(imm)\r\n    NetBP(imm)\r\n\t\r\ndef<\/span> main<\/span>(args):\r\n    if<\/span> not<\/span> args:\r\n        usage(imm)\r\n    try<\/span>:\r\n        opts, filler =<\/span> getopt.<\/span>getopt(args, "nfptmsreh:"<\/span>)\r\n        for<\/span> o,a in<\/span> opts:\r\n            if<\/span> o ==<\/span> "-n"<\/span>:\r\n                NetBP(imm)\r\n                return<\/span> "Network operation breakpoints set."<\/span>\r\n            if<\/span> o ==<\/span> "-f"<\/span>:\r\n                FileBP(imm)\r\n                return<\/span> "File Operation breakpoints set."<\/span>\r\n            if<\/span> o ==<\/span> "-p"<\/span>:\r\n                ProcBP(imm)\r\n                return<\/span> "Process creation \/ manipulation breakpoints set."<\/span>\r\n            if<\/span> o ==<\/span> "-t"<\/span>:\r\n                ThreadBP(imm)\r\n                return<\/span> "Thread creation \/ manipulation breakpoints set."<\/span>\r\n            if<\/span> o ==<\/span> "-m"<\/span>:\r\n                MemBP(imm)\r\n                return<\/span> "Memory allocation \/ manipulation breakpoints set."<\/span>\r\n            if<\/span> o ==<\/span> "-s"<\/span>:\r\n                SleepBP(imm)\r\n                return<\/span> "Timing and sleep operations will now be watched."<\/span>\r\n            if<\/span> o ==<\/span> "-r"<\/span>:\r\n                RegBP(imm)\r\n                return<\/span> "Registry accesses will now be hit."<\/span>\r\n            if<\/span> o ==<\/span> "-e"<\/span>:\r\n                DoEmAll(imm)\r\n                return<\/span> "All options set. Have a nice day!"<\/span>\r\n            if<\/span> o ==<\/span> "-h"<\/span>:\r\n                usage(imm)\r\n    except<\/span>:\r\n        usage(imm)\r\n    return<\/span> ""<\/span>\r\n<\/pre>\n<\/div>\n
Not a fan of copy \/ paste? Just download it here<\/a>.
\nUntil next time, happy hacking!
\n\"1397771687215\"<\/a><\/p>\n
One more thing – in an effort to join the 21st century, this site now has an ipv6 address – 2001:470:1f06:116::2. Join the botnet!<\/p>\n","protected":false},"excerpt":{"rendered":"
Howdy! I made some changes to my break point script to make it more modular and accept arguments and stuff. I normally steer clear of python due to its agonizingly strict syntax, but I suffered through it for you. I use this script every single day when I first load a piece of malware into […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[4],"tags":[],"_links":{"self":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/810"}],"collection":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/comments?post=810"}],"version-history":[{"count":3,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/810\/revisions"}],"predecessor-version":[{"id":814,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/810\/revisions\/814"}],"wp:attachment":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/media?parent=810"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/categories?post=810"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/tags?post=810"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}