(self, dll_name: str)
| 547 | self.LDR = ldr_obj |
| 548 | |
| 549 | def add_ldr_data_table_entry(self, dll_name: str): |
| 550 | entry_struct = make_ldr_data_table_entry(self.ql.arch.bits) |
| 551 | |
| 552 | entry_addr = self.ql.os.heap.alloc(entry_struct.sizeof()) |
| 553 | |
| 554 | def populate_unistr(obj, s: str) -> None: |
| 555 | encoded = s.encode('utf-16le') |
| 556 | ucslen = len(encoded) |
| 557 | ucsbuf = self.ql.os.heap.alloc(ucslen + 2) |
| 558 | |
| 559 | self.ql.mem.write(ucsbuf, encoded + b'\x00\x00') |
| 560 | |
| 561 | obj.Length = ucslen |
| 562 | obj.MaximumLength = ucslen + 2 |
| 563 | obj.Buffer = ucsbuf |
| 564 | |
| 565 | image = self.get_image_by_name(dll_name, casefold=True) |
| 566 | assert image, 'image should have been added to loader.images first' |
| 567 | |
| 568 | with entry_struct.ref(self.ql.mem, entry_addr) as entry_obj: |
| 569 | entry_obj.DllBase = image.base |
| 570 | populate_unistr(entry_obj.FullDllName, ntpath.join(self.ql.os.winsys, dll_name)) |
| 571 | populate_unistr(entry_obj.BaseDllName, dll_name) |
| 572 | |
| 573 | # Flink |
| 574 | if self.ldr_list: |
| 575 | with entry_struct.ref(self.ql.mem, self.ldr_list[-1]) as flink: |
| 576 | entry_obj.InLoadOrderLinks.Flink = flink.InLoadOrderLinks.Flink |
| 577 | entry_obj.InMemoryOrderLinks.Flink = flink.InMemoryOrderLinks.Flink |
| 578 | entry_obj.InInitializationOrderLinks.Flink = flink.InInitializationOrderLinks.Flink |
| 579 | |
| 580 | flink.InLoadOrderLinks.Flink = entry_addr + entry_struct.InLoadOrderLinks.offset |
| 581 | flink.InMemoryOrderLinks.Flink = entry_addr + entry_struct.InMemoryOrderLinks.offset |
| 582 | flink.InInitializationOrderLinks.Flink = entry_addr + entry_struct.InInitializationOrderLinks.offset |
| 583 | |
| 584 | else: |
| 585 | # a volatile ref to self.PEB.LdrAddress |
| 586 | flink = self.LDR |
| 587 | |
| 588 | entry_obj.InLoadOrderLinks.Flink = flink.InLoadOrderModuleList.Flink |
| 589 | entry_obj.InMemoryOrderLinks.Flink = flink.InMemoryOrderModuleList.Flink |
| 590 | entry_obj.InInitializationOrderLinks.Flink = flink.InInitializationOrderModuleList.Flink |
| 591 | |
| 592 | flink.InLoadOrderModuleList.Flink = entry_addr + entry_struct.InLoadOrderLinks.offset |
| 593 | flink.InMemoryOrderModuleList.Flink = entry_addr + entry_struct.InMemoryOrderLinks.offset |
| 594 | flink.InInitializationOrderModuleList.Flink = entry_addr + entry_struct.InInitializationOrderLinks.offset |
| 595 | |
| 596 | # Blink |
| 597 | blink = self.LDR |
| 598 | |
| 599 | entry_obj.InLoadOrderLinks.Blink = blink.InLoadOrderModuleList.Blink |
| 600 | entry_obj.InMemoryOrderLinks.Blink = blink.InMemoryOrderModuleList.Blink |
| 601 | entry_obj.InInitializationOrderLinks.Blink = blink.InInitializationOrderModuleList.Blink |
| 602 | |
| 603 | blink.InLoadOrderModuleList.Blink = entry_addr + entry_struct.InLoadOrderLinks.offset |
| 604 | blink.InMemoryOrderModuleList.Blink = entry_addr + entry_struct.InMemoryOrderLinks.offset |
| 605 | blink.InInitializationOrderModuleList.Blink = entry_addr + entry_struct.InInitializationOrderLinks.offset |
| 606 |
no test coverage detected