| 507 | self.TEB = teb_obj |
| 508 | |
| 509 | def init_peb(self): |
| 510 | peb_struct = make_peb(self.ql.arch.bits) |
| 511 | |
| 512 | peb_addr = self.structure_last_addr |
| 513 | ldr_addr = self.ql.mem.align_up(peb_addr + peb_struct.sizeof(), 0x10) |
| 514 | |
| 515 | # we must set a heap, will try to retrieve this value. Is ok to be all \x00 |
| 516 | peb_obj = peb_struct.volatile_ref(self.ql.mem, peb_addr) |
| 517 | peb_obj.ImageBaseAddress = self.pe_image_address |
| 518 | peb_obj.LdrAddress = ldr_addr |
| 519 | peb_obj.ProcessParameters = self.ql.os.heap.alloc(0x100) |
| 520 | peb_obj.ProcessHeap = self.ql.os.heap.alloc(0x100) |
| 521 | peb_obj.NumberOfProcessors = self.ql.os.profile.getint('HARDWARE', 'number_processors') |
| 522 | |
| 523 | self.ql.log.info(f'PEB is at {peb_addr:#x}') |
| 524 | |
| 525 | self.structure_last_addr = ldr_addr |
| 526 | self.PEB = peb_obj |
| 527 | |
| 528 | def init_ldr_data(self): |
| 529 | ldr_struct = make_ldr_data(self.ql.arch.bits) |