(self)
| 211 | |
| 212 | |
| 213 | def injectable_patch_iat(self): |
| 214 | #logger.info(" Checking if IAT entries required by carrier are available") |
| 215 | iatRequests = self.injectable.get_all_iat_requests() |
| 216 | iatMissing = [] |
| 217 | |
| 218 | for iatRequest in iatRequests: |
| 219 | # skip available |
| 220 | addr = self.superpe.get_vaddr_of_iatentry(iatRequest.name) |
| 221 | if addr != None: |
| 222 | logger.debug(" Request IAT {} is available at 0x{:X}".format( |
| 223 | iatRequest.name, addr)) |
| 224 | else: |
| 225 | logger.debug(" Request IAT {} is NOT available".format( |
| 226 | iatRequest.name)) |
| 227 | iatMissing.append(iatRequest) |
| 228 | |
| 229 | logger.info(" IAT entries missing in injectable for carrier: {}".format(len(iatMissing))) |
| 230 | for iatRequest in iatMissing: |
| 231 | # Not available, check if we can patch it |
| 232 | iat_name = self.superpe.get_replacement_iat_for("KERNEL32.dll", iatRequest.name) |
| 233 | if not self.settings.fix_missing_iat: |
| 234 | raise Exception("Error: {} not available, but fix_missing_iat is False".format( |
| 235 | iatRequest.name)) |
| 236 | # do the patch |
| 237 | self.superpe.patch_iat_entry("KERNEL32.dll", iat_name, iatRequest.name) |
| 238 | logger.info(" Patch injectable to import {}".format( |
| 239 | iatRequest.name)) |
| 240 | # we modify the IAT raw, so reparsing is required |
| 241 | self.superpe.pe.parse_data_directories() |
| 242 | self.superpe.init_iat_entries() |
| 243 | |
| 244 | |
| 245 | def injectable_write_iat_references(self): |
no test coverage detected