(self)
| 734 | self.import_address_table[dll_name.casefold()] = iat |
| 735 | |
| 736 | def init_driver_object(self): |
| 737 | drv_addr = self.structure_last_addr |
| 738 | |
| 739 | # PDRIVER_OBJECT DriverObject |
| 740 | drvobj_cls = make_driver_object(self.ql.arch.bits) |
| 741 | nobj_addr = self.ql.mem.align_up(drv_addr + drvobj_cls.sizeof(), 0x10) |
| 742 | |
| 743 | self.ql.log.info(f'DriverObject is at {drv_addr:#x}') |
| 744 | # note: driver object is volatile; no need to flush its contents to mem |
| 745 | |
| 746 | self.structure_last_addr = nobj_addr |
| 747 | self.driver_object_address = drv_addr |
| 748 | self.driver_object = drvobj_cls.volatile_ref(self.ql.mem, drv_addr) |
| 749 | |
| 750 | def init_registry_path(self): |
| 751 | regpath_addr = self.structure_last_addr |
no test coverage detected