MCPcopy Create free account
hub / github.com/qilingframework/qiling / init_registry_path

Method init_registry_path

qiling/loader/pe.py:750–768  ·  view source on GitHub ↗
(self)

Source from the content-addressed store, hash-verified

748 self.driver_object = drvobj_cls.volatile_ref(self.ql.mem, drv_addr)
749
750 def init_registry_path(self):
751 regpath_addr = self.structure_last_addr
752
753 # PUNICODE_STRING RegistryPath
754 ucstrtype = make_unicode_string(self.ql.arch.bits)
755
756 regpath_obj = ucstrtype(
757 Length=0,
758 MaximumLength=0,
759 Buffer=regpath_addr # FIXME: pointing to self? this does not seem right
760 )
761
762 nobj_addr = self.ql.mem.align_up(regpath_addr + ucstrtype.sizeof(), 0x10)
763
764 self.ql.log.info(f'RegistryPath is at {regpath_addr:#x}')
765 regpath_obj.save_to(self.ql.mem, regpath_addr)
766
767 self.structure_last_addr = nobj_addr
768 self.regitry_path_address = regpath_addr
769
770 def init_eprocess(self):
771 eproc_addr = self.structure_last_addr

Callers 1

loadMethod · 0.80

Calls 4

make_unicode_stringFunction · 0.85
align_upMethod · 0.80
sizeofMethod · 0.80
save_toMethod · 0.80

Tested by

no test coverage detected