-
-
[下载]The Narliest Windbg Extension Evar!
-
发表于: 2011-2-23 09:49 3400
-
This windbg extension is intended to be able to:
list /SafeSEH, /GS, DEP, and ASLR info about all loaded modules
search for ROP gadgets
other misc utils
Currently, only listing info about loaded modules is implemented. Go to the downloads section to get the most recently compiled extension and pdb. For those of you who might download and use this extension, it would be worth it to check back every now and then for a new release, as a lot is currently in the works (or you could ping me directly). Also, if you find a bug with this extension, please let me know.
Example:
To "install", download one of the zips from the download page, extract narly.dll, and copy it in to the winext folder for windbg. The path to the winext folder usually looks something like this
C:\Program Files\Debugging Tools for Windows (x86)\winextAfter you do that, you can .load narly to load the extension into windbg:
0:018> .load narly
下载http://code.google.com/p/narly/downloads/detail?name=narly_0.1.zip&can=2&q=
narly_0.1.zip
总的来说就是windbg的扩展,可以检测SEH GS DEP ASLR等,ROP检测没有看到,估计后续版本会实现吧。。。。标记一下
list /SafeSEH, /GS, DEP, and ASLR info about all loaded modules
search for ROP gadgets
other misc utils
Currently, only listing info about loaded modules is implemented. Go to the downloads section to get the most recently compiled extension and pdb. For those of you who might download and use this extension, it would be worth it to check back every now and then for a new release, as a lot is currently in the works (or you could ping me directly). Also, if you find a bug with this extension, please let me know.
Example:
To "install", download one of the zips from the download page, extract narly.dll, and copy it in to the winext folder for windbg. The path to the winext folder usually looks something like this
C:\Program Files\Debugging Tools for Windows (x86)\winextAfter you do that, you can .load narly to load the extension into windbg:
0:018> .load narly
下载http://code.google.com/p/narly/downloads/detail?name=narly_0.1.zip&can=2&q=
narly_0.1.zip
总的来说就是windbg的扩展,可以检测SEH GS DEP ASLR等,ROP检测没有看到,估计后续版本会实现吧。。。。标记一下
赞赏
他的文章
看原图
赞赏
雪币:
留言: