{"id":126,"date":"2018-01-15T00:44:17","date_gmt":"2018-01-15T00:44:17","guid":{"rendered":"http:\/\/malwrforensics.com\/en\/?p=126"},"modified":"2018-01-15T00:44:17","modified_gmt":"2018-01-15T00:44:17","slug":"immunitydbg-api-breakpoints-script","status":"publish","type":"post","link":"https:\/\/malwrforensics.com\/en\/2018\/01\/15\/immunitydbg-api-breakpoints-script\/","title":{"rendered":"ImmunityDbg API breakpoints script"},"content":{"rendered":"

This is a python script for\u00a0Immunity debugger<\/a>\u00a0that sets breakpoints on “interesting” APIs.<\/p>\n

Here is the list of APIs (in no particular order):<\/p>\n

“ZwRaiseHardError”
\n“bind”
\n“listen”
\n“socket”
\n“DeviceIoControl”
\n“ZwCreateFile”
\n“ZwCreateSection”
\n“ZwQueryInformationFile”
\n“ZwQueryAttributesFile”
\n“ZwCreateUserProcess”
\n“ZwOpenKeyEx”
\n“ZwOpenKey”
\n“ResumeThread”
\n“CopyFileA”
\n“CopyFileExW”
\n“CopyFileW”
\n“CreateDirectoryA”
\n“CreateDirectoryW”
\n“CreateMutexA”
\n“CreateMutexW”
\n“CreateFileA”
\n“CreateFileW”
\n“CreateProcessA”
\n“CreateProcessW”
\n“CreateProcessInternalA”
\n“CreateRemoteThread”
\n“WinExec”
\n“OpenProcess”
\n“Sleep”
\n“IsDebuggerPresent”
\n“WriteProcessMemory”
\n“_write”
\n“ZwWriteFile”
\n“ZwWriteVirtualMemory”
\n“SetThreadContext”
\n“RegOpenKeyExA”
\n“SysFreeString”
\n“RtlFillMemory”
\n“InternetCrackUrlA”
\n“InternetConnectA”
\n“InternetOpenUrlA”
\n“InternetSetOptionW”
\n“HttpOpenRequestW”
\n“HttpSendRequestW”
\n“UrlDownloadToFileA”
\n“UrlDownloadToFileW”
\n“connect”
\n“send”
\n“__vbaFreeStr”
\n“__vbaFreeStrList”
\n“__vbaStrMove”
\n“__vbaStrCopy”
\n“__vbaStrCat”<\/p>\n

The script is available on github<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

This is a python script for\u00a0Immunity debugger\u00a0that sets breakpoints on “interesting” APIs. Here is the list of APIs (in no particular order): “ZwRaiseHardError” “bind” “listen” “socket” “DeviceIoControl” “ZwCreateFile” “ZwCreateSection” “ZwQueryInformationFile” “ZwQueryAttributesFile” “ZwCreateUserProcess” “ZwOpenKeyEx” “ZwOpenKey” “ResumeThread” “CopyFileA” “CopyFileExW” “CopyFileW” “CreateDirectoryA” “CreateDirectoryW” “CreateMutexA” “CreateMutexW” “CreateFileA” “CreateFileW” “CreateProcessA” “CreateProcessW” “CreateProcessInternalA” “CreateRemoteThread” “WinExec” “OpenProcess” “Sleep” “IsDebuggerPresent” “WriteProcessMemory” “_write” “ZwWriteFile” […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[30,31,18,6,4],"class_list":["post-126","post","type-post","status-publish","format-standard","hentry","category-security","tag-debugger","tag-immunity","tag-malware","tag-tool","tag-windows"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[]}},"featured_image_urls_v2":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":""},"post_excerpt_stackable_v2":"

This is a python script for\u00a0Immunity debugger\u00a0that sets breakpoints on “interesting” APIs. Here is the list of APIs (in no particular order): “ZwRaiseHardError” “bind” “listen” “socket” “DeviceIoControl” “ZwCreateFile” “ZwCreateSection” “ZwQueryInformationFile” “ZwQueryAttributesFile” “ZwCreateUserProcess” “ZwOpenKeyEx” “ZwOpenKey” “ResumeThread” “CopyFileA” “CopyFileExW” “CopyFileW” “CreateDirectoryA” “CreateDirectoryW” “CreateMutexA” “CreateMutexW” “CreateFileA” “CreateFileW” “CreateProcessA” “CreateProcessW” “CreateProcessInternalA” “CreateRemoteThread” “WinExec” “OpenProcess” “Sleep” “IsDebuggerPresent” “WriteProcessMemory” “_write” “ZwWriteFile” “ZwWriteVirtualMemory” “SetThreadContext” “RegOpenKeyExA” “SysFreeString” “RtlFillMemory” “InternetCrackUrlA” “InternetConnectA” “InternetOpenUrlA” “InternetSetOptionW” “HttpOpenRequestW” “HttpSendRequestW” “UrlDownloadToFileA” “UrlDownloadToFileW” “connect” “send” “__vbaFreeStr” “__vbaFreeStrList” “__vbaStrMove” “__vbaStrCopy” “__vbaStrCat” The script is available on github.<\/p>\n","category_list_v2":"Security<\/a>","author_info_v2":{"name":"malwrforensics","url":"https:\/\/malwrforensics.com\/en\/author\/u_malwrforensics\/"},"comments_num_v2":"0 comments","_links":{"self":[{"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/posts\/126","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/comments?post=126"}],"version-history":[{"count":1,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/posts\/126\/revisions"}],"predecessor-version":[{"id":127,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/posts\/126\/revisions\/127"}],"wp:attachment":[{"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/media?parent=126"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/categories?post=126"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/tags?post=126"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}