(self, pe: Optional[pefile.PE])
| 881 | self.load(pe) |
| 882 | |
| 883 | def load(self, pe: Optional[pefile.PE]): |
| 884 | # set stack pointer |
| 885 | self.ql.log.info("Initiate stack address at 0x%x " % self.stack_address) |
| 886 | self.ql.mem.map(self.stack_address, self.stack_size, info="[stack]") |
| 887 | |
| 888 | if pe is not None: |
| 889 | image_name = os.path.basename(self.path) |
| 890 | image_base = pe.OPTIONAL_HEADER.ImageBase |
| 891 | image_size = self.ql.mem.align_up(pe.OPTIONAL_HEADER.SizeOfImage) |
| 892 | |
| 893 | # if default base address is taken, use the one specified in profile |
| 894 | if not self.ql.mem.is_available(image_base, image_size): |
| 895 | image_base = self.image_address |
| 896 | pe.relocate_image(image_base) |
| 897 | |
| 898 | self.entry_point = image_base + pe.OPTIONAL_HEADER.AddressOfEntryPoint |
| 899 | self.pe_image_address = image_base |
| 900 | self.pe_image_size = image_size |
| 901 | |
| 902 | self.ql.log.info(f'Loading {self.path} to {image_base:#x}') |
| 903 | self.ql.log.info(f'PE entry point at {self.entry_point:#x}') |
| 904 | |
| 905 | self.ql.mem.map(image_base, image_size, info=f'{image_name}') |
| 906 | self.images.append(Image(image_base, image_base + pe.NT_HEADERS.OPTIONAL_HEADER.SizeOfImage, os.path.abspath(self.path))) |
| 907 | |
| 908 | if self.is_driver: |
| 909 | self.init_driver_object() |
| 910 | self.init_registry_path() |
| 911 | self.init_eprocess() |
| 912 | |
| 913 | # set IRQ Level in CR8 to PASSIVE_LEVEL |
| 914 | self.ql.arch.regs.write(UC_X86_REG_CR8, 0) |
| 915 | |
| 916 | # setup CR4, enabling: DE, PSE, PAE, MCE, PGE, OSFXSR and OSXMMEXCPT. |
| 917 | # some drivers may check this at initialized |
| 918 | self.ql.arch.regs.write(UC_X86_REG_CR4, 0b0000011011111000) |
| 919 | |
| 920 | else: |
| 921 | # initialize thread information block |
| 922 | self.init_teb() |
| 923 | self.init_peb() |
| 924 | self.init_ldr_data() |
| 925 | self.init_exports(pe) |
| 926 | |
| 927 | # add image to ldr table |
| 928 | self.add_ldr_data_table_entry(image_name) |
| 929 | |
| 930 | self.init_ki_user_shared_data() |
| 931 | |
| 932 | pe.parse_data_directories() |
| 933 | |
| 934 | # done manipulating pe file; write its contents into memory |
| 935 | self.ql.mem.write(image_base, bytes(pe.get_memory_mapped_image())) |
| 936 | |
| 937 | if self.is_driver: |
| 938 | # security cookie can be written only after image has been loaded to memory |
| 939 | self.init_security_cookie(pe, image_base) |
| 940 |
no test coverage detected