traceoep.py

import immlib

imm = immlib.Debugger()
OEP = 0x44F308

def killWatchDogThreads():
	global imm
	for i in xrange(3):
		# Get return address
		esp = imm.getRegs()['ESP']
		returnAddress = imm.readLong(esp)
		
		# Adjust stack
		imm.setReg('ESP', (imm.getRegs())['ESP'] +  0x18)

		# Force early return
		imm.setReg('EIP', returnAddress)

		# Continue Execution
		imm.run()



def main(args):
	imm.ignoreSingleStep('DISABLE')
	imm.setHardwareBreakpoint(OEP)
	imm.log('[*] Breakpoint set on OEP')

	addrCreateThread = imm.getAddress('kernel32.CreateThread')
	imm.setHardwareBreakpoint(addrCreateThread)
	imm.log('[*] Breakpoint set on CreateThread')

	imm.log('[*] Running')
	imm.run()

	# Due to somw weird problem the previous imm.run() call
	# return early, so we need to run again, but imm.run()
	# does not work without pausing the process first
	imm.pause()
	imm.run()

	# We break when we are in CreateThread
	imm.log('[*] First breakpoint on CreateThread reached...')

	# Allow this thread to be created
	imm.run()

	# nip other watchdog threads in the bud
	killWatchDogThreads()

	# Now we are at OEP
	imm.log('[*] At OEP --> %08X' %(OEP), highlight = True)
	return 'At OEP...'