(self)
| 780 | self.eprocess_address = eproc_addr |
| 781 | |
| 782 | def init_ki_user_shared_data(self): |
| 783 | sysconf = self.ql.os.profile['SYSTEM'] |
| 784 | osconf = self.ql.os.profile[f'OS{self.ql.arch.bits}'] |
| 785 | |
| 786 | kusd_addr = osconf.getint('KI_USER_SHARED_DATA') |
| 787 | kust_struct = KUSER_SHARED_DATA |
| 788 | self.ql.mem.map(kusd_addr, self.ql.mem.align_up(kust_struct.sizeof()), info='[kuser shared data]') |
| 789 | |
| 790 | # initialize an instance with a few key fields |
| 791 | kusd_obj = kust_struct.volatile_ref(self.ql.mem, kusd_addr) |
| 792 | kusd_obj.ImageNumberLow = 0x014c # IMAGE_FILE_MACHINE_I386 |
| 793 | kusd_obj.ImageNumberHigh = 0x8664 # IMAGE_FILE_MACHINE_AMD64 |
| 794 | kusd_obj.NtSystemRoot = self.ql.os.windir |
| 795 | kusd_obj.NtProductType = sysconf.getint('productType') |
| 796 | kusd_obj.NtMajorVersion = sysconf.getint('majorVersion') |
| 797 | kusd_obj.NtMinorVersion = sysconf.getint('minorVersion') |
| 798 | kusd_obj.KdDebuggerEnabled = 0 |
| 799 | kusd_obj.NXSupportPolicy = 0 # NX_SUPPORT_POLICY_ALWAYSOFF |
| 800 | |
| 801 | self.ql.os.KUSER_SHARED_DATA = kusd_obj |
| 802 | |
| 803 | def init_security_cookie(self, pe: pefile.PE, image_base: int): |
| 804 | if not Process.directory_exists(pe, 'IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG'): |
no test coverage detected