What is Mona.py?

• A pycommand for Immunity Debugger, designed and developed to aid the exploit development process

• Automates various tasks such as address search, pattern generation and comparison, egg hunter generation etc.

• Replaces pvefindaddr

• Developed by Corelanc0d3r (Peter Van Eeckhoutte)

• Official link: http://bit.ly/mona-py

Command 1: Set workingfolder

• Sets the working directory for mona to store command output and related files:

  • !mona config -set workingfolder c:\logs\%p

• This will tell mona to write the output to subfolders of c:\logs. The %p variable will be replaced with the process name currently being debugged.

• If you want to further group output, you can even use the %i variable in the workingfolder parameter. This variable will get replaced with the process ID of the application being debugged.

Command 2: bytearray

• Generates an array of hex bytes from \x00 to \xff (except for the excluded ones):

  • !mona bytearray

• Produces two files: text and binary

• Takes two flags:

  • -b – to exclude bytes from array

  • -r – to output array in the reverse order (\xff..\x00)

• Use compare command to automate the comparison process:

  • !mona compare –f <filename> -a <address>

Command 3: pc, po & findmsp

• Generates a cyclic pattern (Metasploit pattern) of a given size and length:

  • !mona pc <length>

• Locates given four bytes in a cyclic pattern and returns the offset:

  • !mona po <bytes>

• Find instances of the cyclic pattern:

  • !mona findmsp

• Optional argument:

  • -distance Sets the distance from ESP to begin search from

Command 4: egg

• Creates an egghunter routine with a default tag (w00t):

  • !mona egg

• Optional arguments:

  • -t : tag (ex: w00t). Default value is w00t

  • -c : enable checksum routine. Only works in conjunction with parameter -f

  • -f : file containing the shellcode

  • -depmethod : method can be “virtualprotect”, “copy” or “copy_size”

  • -depreg : sets the register that contains a pointer to the API function to bypass DEP. By default this register is set to ESI

  • -depsize : sets the size for the dep bypass routine

  • -depdest : this register points to the location of the egghunter itself.

Command 5: jmp

• Searches for pointers that will lead to execution of the code located at the address pointed by a given register:

  • !mona jmp –r <register>

• Default module criteria : skip aslr and rebase modules. The search will include OS modules by default, but this can be overruled by using the -cm os=false global option.

Command 6: seh

• Searches for pointers to routines that will lead to code execution in a SEH overwrite exploit:

  • !mona seh

• By default, it will attempt to bypass SafeSEH by excluding pointers from rebase, aslr and safeseh protected modules.

• The optional -all parameter, if specified, will also search for pointers in memory locations outside of loaded modules.

Watch the video

Learn the art of exploit development

If you want to learn the art of exploit development check out our Hands-on courses:

• Hands-on Exploit Development

• Hands-on Exploit Development (Advanced)

• Immunity Debugger for Exploit Devs - YCSC Lab Essentials

This course covers Immunity Debugger in and out. You will learn both, well-known and lesser-known, features. A few topics taught in this course are as follows:

Download and Installation
Views
Stack Operations
Disassembler Operations
Breakpoints, stepping through, tracing etc.
PyCommands and Mona Library
Just-in-time debugging
... and a lot more

Immunity Debugger is extremely useful while creating exploits, backdooring PE files, encoding binaries to evade anti-malware software. Therefore, a good understanding of this tool is must for security professionals, specially for people studying for security certifications from Offensive Security (OSCP, OSCE, OSED etc.), eLearnSecurity (ePTP, ePTX etc.) and various other organizations.

I have created this course with the vision that it becomes your go to reference guide for Immunity Debugger and other similar debuggers (Ollydbg, Evans debugger etc).

This is a FREE course and you can enrol here.

Who this course is for:

- Cyber security professionals
- Reverse Engineers
- Beginners in Exploit Development
- Security Researchers / Engineers/ Analysts

What you’ll learn

- Basics of Immunity Debugger
- Get familiar with various Views / Windows
- Stack operations available in Immunity Debugger
- Disassembler operations available in Immunity Debugger
- Get started with PyCommands & Mona Library
- Just-in-time debugging with Immunity Debugger
- How to set breakpoints, step through and trace
- Immunity Debugger command line

Requirements

- Familiarity with Assembly Language (good to have)
- Understanding of x86 CPU architecture (registers, flags, stack etc.)

Note: This website is not associated or owned by Immunity Inc. Immunity Debugger logo is a copyright of Immunity Inc. and is used here for representational purposes only.