Hey everybody welcome to the next video.
So in this video we're going to be going over debunkers.
Now what does a debugger a debugger is something that attaches to an application or an application is
ran inside of that allows you to inspect and interact with the code.
The actual live code that's running this is good for tracking down errors when you see things happening.
You can modify the code while it's running so injecting different operations moving things around.
Cetera.
And this is also very useful for when you're building exploits.
You find a vulnerability where an application crashes you use a debugger to help craft your payload
that allows you to be able to manipulate the memory or the operations set whatever the issue might be
into doing what you want.
So it's important to get familiar with them.
We're going to hit this a little harder in the exploit development course.
However it's good to understand what it looks like and kind of play around with it a little bit.
Now there are a few different types.
These are just the three common ones that you're going to find is all a debug immunity debug and then
GDP.
Now the first two are Windows based and the last one is Linux based.
In this particular video we're just going to touch on immunity but I want you for homework to look at
all the debug and GDP as well.
Those two are going to be import inspect memory look at the registers and identify what's in a certain
memory location what's on the stack.
Just understanding the common flow of how these work.
Now a common layout in this particular case this is immunity but for all debug it's going to be pretty
similar.
So at the top right you have you register so you do see X X X GSP and then e IP and then at the bottom
right you're going to see the stack.
So there's four things on the stack right now and you can see the modules and entry point and then when
you have at the top left the execution flow.
So this is the what e IP is pointing to at this current point.
And for example this is a move instruction which will then move to a jump in depending on the jump condition
it will move to L.A. or another value but this is where you actually have the core instruction sets
of the application and where you can break into it and modify so we can modify the jump to points somewhere
else and it will do so and then the bottom left is the actual memory location.
It just defaults to see here with default defaults to the top of the stack or the bottom outputs.
OK perfect.
So depending you can actually click on a memory doesn't have it dumped data.
So if I wanted to know what was at X as an example I could double click that would pop open the memory
in ASCII as well so you can see it on the far right.
It's important to understand the the layout of this and what you're seeing here.
So let's do a quick look on attaching something to a debugger.
Now in this video we're going to go over immunity like I said the installer is in a link above.
You don't need the public key that it prompts you for.
So just fill in the basic information that it asks with useless data and it'll just give you the download
link.
So when you first open this up you see our for our four section.
So we'll do file open and then we're going to go ahead and pick an executable in this case something
to do pipe list so what's going to do is it's going to load it up and as soon as it hits its entry point
it's going to lock into the debugger and then pause it 60 at the bottom right.
It's pause the application.
So now we can see all of our data.
So if we right click to this parents that's fine.
Debug registers go so we can see here that we can even moved and jumped to different instructions as
you want.
We can just play the application with the play button.
Now in this case it's a console app.
So it's going to close pretty quickly but kind of get familiar with this.
You don't need to get too much into the weeds with this at this current moment just understand the concepts
of where everything's at.
That that this is the stack.
This is where the memory is in ASCII form and hex.
These are the registers and this is the actual code execution flow.
So go ahead and download immunity first and attach something.
Now we just opened but you can also attach to a current process in this particular case I just have
this running currently that I'm already attached to.
However if you are running in HD GDP server you could do file attach and then you can attach to that
HDD server so go out and play around with immunity then play it.
Go ahead and download all the debug and then load up the Ubuntu machine and go ahead and trust test
a few things out with like the the less binary on GDP.