From c0d28e82cfffbf5bd8bf7d045771d5eb100b5083 Mon Sep 17 00:00:00 2001 From: "james.bennett" Date: Tue, 31 May 2022 13:26:22 -0700 Subject: [PATCH] update order of operations for initialization of kernel emulator. add get_pc interface for speakeasy. --- speakeasy/speakeasy.py | 9 +++++++++ speakeasy/windows/kernel.py | 20 ++++++++++---------- 2 files changed, 19 insertions(+), 10 deletions(-) diff --git a/speakeasy/speakeasy.py b/speakeasy/speakeasy.py index 2b2f3eb..45811d7 100644 --- a/speakeasy/speakeasy.py +++ b/speakeasy/speakeasy.py @@ -770,6 +770,15 @@ class Speakeasy(object): """ self.emu.set_stack_ptr(addr) + def get_pc(self) -> int: + """ + Get the value of the current program counter + + return: + value of the program counter + """ + return self.emu.get_pc() + def set_pc(self, addr: int) -> None: """ Set the value of the current program counter diff --git a/speakeasy/windows/kernel.py b/speakeasy/windows/kernel.py index b10a065..6a4162a 100644 --- a/speakeasy/windows/kernel.py +++ b/speakeasy/windows/kernel.py @@ -164,6 +164,16 @@ class WinKernelEmulator(WindowsEmulator, IoManager): if s not in self.profiler.strings['unicode']: self.profiler.strings['unicode'].append(s) + # Set the emulator to run in protected mode + self._setup_gdt(self.get_arch()) + + self.setup_kernel_mode() + + self.setup_user_shared_data() + + if not self.stack_base: + self.stack_base, stack_ptr = self.alloc_stack(pe.stack_commit) + # Init imported data for addr, imp in pe.imports.items(): mn, fn = imp @@ -176,16 +186,6 @@ class WinKernelEmulator(WindowsEmulator, IoManager): data_ptr.to_bytes(self.get_ptr_size(), 'little')) - # Set the emulator to run in protected mode - self._setup_gdt(self.get_arch()) - - self.setup_kernel_mode() - - self.setup_user_shared_data() - - if not self.stack_base: - self.stack_base, stack_ptr = self.alloc_stack(pe.stack_commit) - return pe def pool_alloc(self, pooltype, size, tag='None'):