Chapter 5. IMMUNITY DEBUGGER—THE BEST OF BOTH WORLDS

Now that we have covered how to build our own debugger and how to use a pure Python debugger in the form of PyDbg, it's time to explore Immunity Debugger, which has a full user interface as well as the most powerful Python library to date for exploit development, vulnerability discovery, and malware analysis. Released in 2007, Immunity Debugger has a nice blend of dynamic (debugging) capabilities as well as a very powerful analysis engine for static analysis tasks. It also sports a fully customizable, pure Python graphing algorithm for plotting functions and basic blocks. We'll take a quick tour of Immunity Debugger and its user interface to get us warmed up. Then we'll dig into using Immunity Debugger during the exploit development lifecycle and to automatically bypass anti-debugging routines in malware. Let's get started by getting Immunity Debugger up and running.

Immunity Debugger is provided and supported[27] free of charge, and it's only a download link away: http://debugger.immunityinc.com/.

Simply download the installer and execute it. If you don't already have Python 2.5 installed, it's no big deal, as the Immunity Debugger installer contains the Python 2.5 installer and will install Python for you if need it. Once you execute the file, Immunity Debugger is ready for use.



[27] For debugger support and general discussions visit http://forum.immunityinc.com.