| 704 | self.ql.mem.write_ptr(imp.address, addr) |
| 705 | |
| 706 | def init_exports(self, pe: pefile.PE): |
| 707 | if not Process.directory_exists(pe, 'IMAGE_DIRECTORY_ENTRY_EXPORT'): |
| 708 | return |
| 709 | |
| 710 | # Do a full load if IMAGE_DIRECTORY_ENTRY_EXPORT is present so we can load the exports |
| 711 | pe.full_load() |
| 712 | |
| 713 | # address corner case for malformed export tables where IMAGE_DIRECTORY_ENTRY_EXPORT exists, but DIRECTORY_ENTRY_EXPORT does not |
| 714 | if not hasattr(pe, 'DIRECTORY_ENTRY_EXPORT'): |
| 715 | return |
| 716 | |
| 717 | iat = {} |
| 718 | |
| 719 | # parse directory entry export |
| 720 | for entry in pe.DIRECTORY_ENTRY_EXPORT.symbols: |
| 721 | ea = self.pe_image_address + entry.address |
| 722 | |
| 723 | self.export_symbols[ea] = { |
| 724 | 'name' : entry.name, |
| 725 | 'ordinal' : entry.ordinal |
| 726 | } |
| 727 | |
| 728 | if entry.name: |
| 729 | iat[entry.name] = ea |
| 730 | |
| 731 | iat[entry.ordinal] = ea |
| 732 | |
| 733 | dll_name = os.path.basename(self.path) |
| 734 | self.import_address_table[dll_name.casefold()] = iat |
| 735 | |
| 736 | def init_driver_object(self): |
| 737 | drv_addr = self.structure_last_addr |