- Help
	- `!mona help assemble`
	- manual : https://www.corelan.be/index.php/2011/07/14/mona-py-the-manual/
- Update Mona
	- `!mona update`
	- Switch between stable and trunk release:
		- `!mona update -t release`
		- `!mona update -t trunk`
- Configure working folder
	- `!mona config -set workingfolder c:\mona%p`
- Global options
	- `-o` - ignore OS module from search operations.
	- `-m` - specify the modules to perform the search operation on (ex: -m "gtk*,*win*,shell32.dll")
		- `-m *` searches all modules
	- `-cm` - set criteria (c) a module (m) should comply with to get included in search operations.
		- Available:
		    - aslr
		    - rebase
		    - safeseh
		    - nx
		    - os
		- Example of including aslr and rebase modules, but excluding safeseh modules:
			- `-cm aslr=true,rebase=true,safeseh=false`
	- `-cp` - specify what criteria (c) a pointer (p) should match.
		- Available:
			- unicode (also includes unicode transforms)
			- ascii
			- asciiprint
			- upper
			- lower
			- uppernum
			- lowernum
			- numeric
			- alphanum
			- nonull
			- startswithnull
		- Example : only show pointers that contain ascii printable bytes
			- `-cp asciiprint`
		- Example : only show pointers that don’t contain null bytes
			- `-cp nonull`
	- `-cpb` - specify bad characters for pointers, so pointers containing them are skipped
		- Example with null byte, carriage return, and line feet:
			- `-cpb '\x00\x0a\x0d'`

- Analyze crash
	- `!mona findmsp`
- Locate EIP - pattern_create / pattern_offset :
	- `!mona pattern_create 5000`
	- `!mona pattern_offset <EIP_VALUE>`
	- Get value on stack (ascii):
		- `!mona pattern_offset 5Ai6`

- Find bad characters:
	- 1 - generate array of all possible characters:
		- `!mona bytearray -cpb "\x00"`
	- 2 - Put array of all hex chars into overflow
	- 3 - run the program until EIP gets overwritten. Then enter the following (0012FD6C is the address of first byte of the badchars array):
		- `!mona compare -f C:\mona\<app>\bytearray.bin -a 0012FD6C`
	- 4 - mona gives 1 or multiple badchars. Remove these badchars from array. 
	- 5 - repeat above until all bad chars are removed
	- Example:
		- `!mona bytearray -cpb "\x00\x09"`
		- `!mona compare -f C:\mona\<app>\bytearray.bin -a 0012FD6C`
		- `!mona bytearray -cpb "\x00\x09\x0a"`
		- `!mona compare -f C:\mona\<app>\bytearray.bin -a 0012FD6C`
		- `!mona bytearray -cpb "\x00\x09\x0a\x0d"`
		- `!mona compare -f C:\mona\<app>\bytearray.bin -a 0012FD6C`


- SEH
	- Find SEH offset (nseh / seh + jump code):
		- 1 - Replace A's by unique pattern (pattern_create)
		- 2 - `!mona sehchain`
	- Find pop pop ret (for SEH Bypass):
		- `!mona seh`
		- Note: this will create seh.txt in working folder

- Egg Hunter:
	- Find eggs occurrences in memory:
		- `!mona find -s "W00TW00T"`
	- Generate egghunter:
		- mona can create an egghunter with checksum check :
			- -t : tag (ex: w00t). Default value is w00t
			- -c : enable checksum routine. Only works in conjunction with parameter -f
			- -f : file containing the shellcode
		- Example:
			- `!mona egg -t W00T`
			- `!mona egg -t W00T -c -f shellcode.bin`

- Find jump or call or push/ret to a register:
	- `!mona jmp -r edi`
	- Note: this creates jmp.txt in working folder.


- Find arbitrary instructions in dll:
	- `/usr/share/metasploit-framework/tools/exploit/nasm_shell.rb`
	- `jmp esp ==> FF E4`
	- `!mona modules`
	- `!mona find -s "\xff\xe4" -m <module>`


- Find shellcode occurrences in memory (and integrity check):
	- 1 - Create raw shellcode.bin file using Python or anything you'd like
	- 2 - Search memory for the shellcode with mona: 
		- `!mona  compare -f C:\Users\administrator\Desktop\WORK\tmp\shellcode.bin`

- Asm instructions to opcodes:
	- `!mona assemble -s "xor eax,eax # pop EBX # ret"`

- Set breakpoint on addr when the program read or write it:
	- Mandatory arguments:
		- -a
		- -t : where is either “READ” or “WRITE”
	- Note : the address should exist when setting the breakpoint. If not, you’ll get an error.
	- Example : set a breakpoint when the application reads from 0012C431:
		- `!mona bp -a 0x0012C431 -t READ`

- Generate msfmodule based on crash:
	- 1 - Replace A's by unique pattern (pattern_create)
	- 2 - When crash occurs:
		- `!mona suggest`