Mona Rop Generation with WinDBG Preview

[BitTheByte]

Using Mona with WinDBG Preview always stuck at

[+] Creating suggestions list
[+] Processing suggestions
[+] Launching ROP generator
[+] Attempting to produce rop chain for VirtualProtect
    Sun 2025/07/13 09:14:15 PM: Step 1/7: esi
** Error trying to process module kernelbase.dll
** Error trying to process module kernel32.dll

This was traced back to a problematic line that tries to get the function name

mona/mona.py

Line 2986 in e793209

thisfuncfullname = thisfunc.getName().lower()

For some unknown reason, this takes so much time, thus I've updated my local source code to

# thisfunc = dbglib.Function(dbg,ptr)
# thisfuncfullname = thisfunc.getName().lower()
thisfuncfullname, _ = getFunctionName(ptr)
thisfuncfullname = thisfuncfullname.replace("!", ".")

which only works on WinDBG as stated in the getFunctionName function comments.

[corelanc0d3r]

what would it take to not break it on immunity?

[BitTheByte]

I'm not familiar with the windbglib but if there is something to detect which debugger is running then decide how to get the function name would be awesome

[corelanc0d3r]

you can check if __DEBUGGERAPP__ is "WinDBG"

[corelanc0d3r]

working on something, this will be improved soon