The Mona script is a Python-driven plugin for the Immunity Debugger and provides a variety of options for exploitation. The script can be downloaded from: https://github.com/corelan/mona/blob/master/mona.py. It is easy to install the script by placing it into the \Program Files\Immunity Inc\Immunity Debugger\PyCommands directory.
Now let's analyze the DLL files by using Mona and running the !mona modules command, as follows:
We can see from the preceding screenshot that we have very few DLL files, which are not implemented with the SafeSEH mechanism. Let's use these files to find the relevant address of the POP/POP/RET instruction. ...
