address of the function and then removes the breakpoint so that we don' continually log the same function addresses load calc exe in immunity debuggerbut don' run it yet then in the command bar at the bottom of immunity debugger' screenentercodecoverage now you can run the process by pressing the key if you switch to the log view (alt- )you'll see functions scroll by now click as many buttons as you wantexcept the button the idea is that you want to execute everything but the one function you're looking for after you've clicked around enoughright-click in the log view and select clear window this removes all of your previously hit functions you can verify this by clicking button you previously clickedyou shouldn' see anything appear in the log window now let' click that pesky button you should see only single entry in the log screen (you might have to enter an expression like + and then hit the buttonon my windows xp sp vmthis address is all rightour whirlwind tour of immunity debugger and some basic code coverage techniques is over and we have the address where we want to inject code let' start writing our volatility code to do this nasty business this is multistage process we first need to scan memory looking for the calc exe process and then hunt through its memory space for place to inject the shellcodeas well as to find the physical offset in the ram image that contains the function we previously found we then have to insert small jump over the function address for the button that jumps to our shellcode and executes it the shellcode we use for this example is from demonstration did at fantastic canadian security conference called countermeasure this shellcode is using hardcoded offsetsso your mileage may vary [ open new filename it code_inject pyand hammer out the following code import sys import struct equals_button memory_file "winxpsp vmemslack_space none trampoline_offset none read in our shellcode sc_fd open("cmeasure bin","rb"sc sc_fd read(sc_fd close(sys path append("/users/justin/downloads/volatility-"import volatility conf as conf import volatility registry as registry registry pluginimporter(config conf confobject(import volatility commands as commands import volatility addrspace as addrspace registry register_global_options(configcommands commandregistry register_global_options(configaddrspace baseaddressspaceconfig parse_options(config profile "winxpsp