Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
import immlib
imm = immlib.Debugger()
OEP = 0x44F308
def killWatchDogThreads():
global imm
for i in xrange(3):
# Get return address
esp = imm.getRegs()['ESP']
returnAddress = imm.readLong(esp)
# Adjust stack
imm.setReg('ESP', (imm.getRegs())['ESP'] + 0x18)
# Force early return
imm.setReg('EIP', returnAddress)
# Continue Execution
def main(args):
imm.log('[*] Breakpoint set on OEP')
addrCreateThread = imm.getAddress('kernel32.CreateThread')
imm.log('[*] Breakpoint set on CreateThread')
imm.log('[*] Running')
# Due to somw weird problem the previous call
# return early, so we need to run again, but
# does not work without pausing the process first
# We break when we are in CreateThread
imm.log('[*] First breakpoint on CreateThread reached...')
# Allow this thread to be created
# nip other watchdog threads in the bud
# Now we are at OEP
imm.log('[*] At OEP --> %08X' %(OEP), highlight = True)
return 'At OEP...'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.