Mona script is a Python-driven plugin for immunity debugger and provides a variety of options for exploitation. The script can be downloaded from https://github.com/corelan/mona/blob/master/mona.py. It is easy to install the script by placing it into the \Program Files\Immunity Inc\Immunity Debugger\PyCommands directory.
Let's now analyze the DLL files by using Mona and running the !mona modules command as follows:
We can see from the preceding screenshot that we have very few DLL files, which are not implemented with the SafeSEH mechanism. Let's use these files to find the relevant address of the POP/POP/RET instruction.
