mona.py

TL;DR: Corelan’s Python plugin for Immunity Debugger and WinDbg — automates pattern generation, bad-character byte arrays, gadget search, SEH chain analysis, and module-property reports.

What it is

mona.py is a long-running scripting plugin written by Peter Van Eeckhoutte (Corelan). Originally for Immunity Debugger, with WinDbg support via PyKD, it concentrates the repetitive tasks of exploit development — finding offsets, hunting gadgets, listing module mitigations — into one command set. It is a staple of user-mode Windows stack-overflow work.

Preconditions / where it applies

Immunity Debugger with PyCommands, or WinDbg with the PyKD extension.
32-bit Windows targets (mona is most mature there) or 64-bit with caveats.
A reproducible crash already attached in the debugger.

Technique

Configure once per session.

!mona config -set workingfolder c:\mona\%p
!mona config -set author yourname

Common commands.

!mona pc 5000 — generate a 5 000-byte De Bruijn cyclic pattern; paste into your exploit input.
!mona po <EIP> — given the EIP after crash, returns the offset into the cyclic pattern.
!mona bytearray -cpb "\x00\x0a\x0d" — emit \x01..\xff excluding listed bytes plus a binary file for compare.
!mona compare -f bytearray.bin -a 0x0012f100 — diff in-memory bytes vs. the generated file to find bad characters (bad-character-handling).
!mona modules — list loaded modules with ASLR/SafeSEH/DEP/Rebase/OS flags; pick the one without protections for your gadget source.
!mona find -s "\xff\xe4" -m foo.dll — search bytes (here jmp esp) inside a module.
!mona rop -m "msvcr71.dll" -n — dump ROP gadgets, suggesting chains for VirtualProtect/VirtualAlloc.
!mona seh — list usable POP-POP-RET sequences for SEH overwrite exploitation; integrates with seh-overwrite and safeseh-bypass workflows.
!mona suggest — given the current crash state, suggests an exploit skeleton.

Workflow example (stack overflow).

Send A * 5000, crash, note EIP. !mona pc 5000 to know the search space.
Send pattern, crash, !mona po <EIP> → offset.
Build with offset, append B*4 for EIP, C*200 for payload.
!mona bytearray -cpb "\x00" and place after the Cs. Crash, !mona compare to find bad chars.
!mona modules, pick unprotected module; !mona find -s "\xff\xe4" -m mod.dll for jmp esp.
Encode shellcode avoiding bad chars; chain.

Detection and defence

Mona is a research tool, not a payload — there’s no runtime to “detect.”
The mitigations it helps you discover (ASLR, DEP, SafeSEH, CFG) are precisely what break the workflow on modern targets; mona usage implies legacy/unhardened binaries.

References

Corelan mona.py repo — source + docs
Corelan exploit-writing tutorial 1 — original workflow
Mona cheat sheet — command reference