Functions | |
def | build_teb |
def | build_peb |
def | build_ldr_data |
def | create_modules_chain |
def | fix_InLoadOrderModuleList |
def | fix_InMemoryOrderModuleList |
def | fix_InInitializationOrderModuleList |
def | add_process_env |
def | add_process_parameters |
def | init_seh |
def | regs2ctxt |
def | ctxt2regs |
def | fake_seh_handler |
def | dump_seh |
def | set_win_fs_0 |
def | add_modules_info |
def | return_from_seh |
def miasm2.os_dep.win_api_x86_32_seh.add_modules_info | ( | pe_in, | |
pe_in_name = "toto.exe" , |
|||
all_pe = None |
|||
) |
Definition at line 645 of file win_api_x86_32_seh.py.
def miasm2.os_dep.win_api_x86_32_seh.add_process_env | ( | myjit | ) |
Definition at line 397 of file win_api_x86_32_seh.py.
def miasm2.os_dep.win_api_x86_32_seh.add_process_parameters | ( | myjit | ) |
Definition at line 407 of file win_api_x86_32_seh.py.
def miasm2.os_dep.win_api_x86_32_seh.build_ldr_data | ( | myjit, | |
modules_info | |||
) |
+0x000 Length : Uint4B +0x004 Initialized : UChar +0x008 SsHandle : Ptr32 Void +0x00c InLoadOrderModuleList : _LIST_ENTRY +0x014 InMemoryOrderModuleList : _LIST_ENTRY +0x01C InInitializationOrderModuleList : _LIST_ENTRY
Definition at line 136 of file win_api_x86_32_seh.py.
def miasm2.os_dep.win_api_x86_32_seh.build_peb | ( | myjit, | |
peb_address | |||
) |
+0x000 InheritedAddressSpace : UChar +0x001 ReadImageFileExecOptions : UChar +0x002 BeingDebugged : UChar +0x003 SpareBool : UChar +0x004 Mutant : Ptr32 Void +0x008 ImageBaseAddress : Ptr32 Void +0x00c Ldr : Ptr32 _PEB_LDR_DATA +0x010 processparameter
Definition at line 113 of file win_api_x86_32_seh.py.
def miasm2.os_dep.win_api_x86_32_seh.build_teb | ( | myjit, | |
teb_address | |||
) |
+0x000 NtTib : _NT_TIB +0x01c EnvironmentPointer : Ptr32 Void +0x020 ClientId : _CLIENT_ID +0x028 ActiveRpcHandle : Ptr32 Void +0x02c ThreadLocalStoragePointer : Ptr32 Void +0x030 ProcessEnvironmentBlock : Ptr32 _PEB +0x034 LastErrorValue : Uint4B ...
Definition at line 90 of file win_api_x86_32_seh.py.
def miasm2.os_dep.win_api_x86_32_seh.create_modules_chain | ( | myjit, | |
modules_name | |||
) |
kd> dt nt!_LDR_DATA_TABLE_ENTRY +0x000 InLoadOrderLinks : _LIST_ENTRY +0x008 InMemoryOrderLinks : _LIST_ENTRY +0x010 InInitializationOrderLinks : _LIST_ENTRY +0x018 DllBase : Ptr32 Void +0x01c EntryPoint : Ptr32 Void +0x020 SizeOfImage : Uint4B +0x024 FullDllName : _UNICODE_STRING +0x02c BaseDllName : _UNICODE_STRING +0x034 Flags : Uint4B +0x038 LoadCount : Uint2B +0x03a TlsIndex : Uint2B +0x03c HashLinks : _LIST_ENTRY +0x03c SectionPointer : Ptr32 Void +0x040 CheckSum : Uint4B +0x044 TimeDateStamp : Uint4B +0x044 LoadedImports : Ptr32 Void +0x048 EntryPointActivationContext : Ptr32 Void +0x04c PatchInformation : Ptr32 Void
Definition at line 184 of file win_api_x86_32_seh.py.
def miasm2.os_dep.win_api_x86_32_seh.ctxt2regs | ( | ctxt, | |
myjit | |||
) |
Restore x86_32 registers from an exception context @ctxt: the serialized context @myjit: jitload instance
Definition at line 485 of file win_api_x86_32_seh.py.
def miasm2.os_dep.win_api_x86_32_seh.dump_seh | ( | myjit | ) |
Definition at line 617 of file win_api_x86_32_seh.py.
def miasm2.os_dep.win_api_x86_32_seh.fake_seh_handler | ( | myjit, | |
except_code | |||
) |
Definition at line 540 of file win_api_x86_32_seh.py.
def miasm2.os_dep.win_api_x86_32_seh.fix_InInitializationOrderModuleList | ( | myjit, | |
module_info | |||
) |
Definition at line 361 of file win_api_x86_32_seh.py.
def miasm2.os_dep.win_api_x86_32_seh.fix_InLoadOrderModuleList | ( | myjit, | |
module_info | |||
) |
Definition at line 270 of file win_api_x86_32_seh.py.
def miasm2.os_dep.win_api_x86_32_seh.fix_InMemoryOrderModuleList | ( | myjit, | |
module_info | |||
) |
Definition at line 315 of file win_api_x86_32_seh.py.
def miasm2.os_dep.win_api_x86_32_seh.init_seh | ( | myjit | ) |
Definition at line 423 of file win_api_x86_32_seh.py.
def miasm2.os_dep.win_api_x86_32_seh.regs2ctxt | ( | myjit | ) |
Build x86_32 cpu context for exception handling @myjit: jitload instance
Definition at line 452 of file win_api_x86_32_seh.py.
def miasm2.os_dep.win_api_x86_32_seh.return_from_seh | ( | myjit | ) |
Definition at line 654 of file win_api_x86_32_seh.py.
def miasm2.os_dep.win_api_x86_32_seh.set_win_fs_0 | ( | myjit, | |
fs = 4 |
|||
) |
Definition at line 636 of file win_api_x86_32_seh.py.
tuple miasm2.os_dep.win_api_x86_32_seh.all_seh_ad |
Definition at line 417 of file win_api_x86_32_seh.py.
tuple miasm2.os_dep.win_api_x86_32_seh.console_handler = logging.StreamHandler() |
Definition at line 41 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.context_address = 0x201000 |
Definition at line 75 of file win_api_x86_32_seh.py.
miasm2.os_dep.win_api_x86_32_seh.cur_seh_ad = FAKE_SEH_B_AD |
Definition at line 81 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.default_seh = PEB_AD+0x20000 |
Definition at line 70 of file win_api_x86_32_seh.py.
tuple miasm2.os_dep.win_api_x86_32_seh.dummy_e = pe_init.PE() |
Definition at line 178 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.EXCEPTION_ACCESS_VIOLATION = 0xc0000005 |
Definition at line 34 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.EXCEPTION_BREAKPOINT = 0x80000003 |
Definition at line 33 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.EXCEPTION_ILLEGAL_INSTRUCTION = 0xc000001d |
Definition at line 37 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.EXCEPTION_INT_DIVIDE_BY_ZERO = 0xc0000094 |
Definition at line 35 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.EXCEPTION_PRIV_INSTRUCTION = 0xc0000096 |
Definition at line 36 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.exception_record_address = context_address+0x1000 |
Definition at line 76 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.FAKE_SEH_B_AD = context_address+0x2000 |
Definition at line 79 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.FS_0_AD = 0x7ff70000 |
Definition at line 46 of file win_api_x86_32_seh.py.
miasm2.os_dep.win_api_x86_32_seh.InInitializationOrderModuleList_address = LDR_AD+\ |
Definition at line 62 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.InInitializationOrderModuleList_offset = 0x1ee0 |
Definition at line 61 of file win_api_x86_32_seh.py.
miasm2.os_dep.win_api_x86_32_seh.InLoadOrderModuleList_address = LDR_AD+\ |
Definition at line 67 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.InLoadOrderModuleList_offset = 0x1ee0 |
Definition at line 65 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.LDR_AD = 0x340000 |
Definition at line 48 of file win_api_x86_32_seh.py.
list miasm2.os_dep.win_api_x86_32_seh.loaded_modules = ["ntdll.dll", "kernel32.dll"] |
Definition at line 83 of file win_api_x86_32_seh.py.
tuple miasm2.os_dep.win_api_x86_32_seh.log = logging.getLogger("seh_helper") |
Definition at line 40 of file win_api_x86_32_seh.py.
miasm2.os_dep.win_api_x86_32_seh.main_pe = None |
Definition at line 84 of file win_api_x86_32_seh.py.
string miasm2.os_dep.win_api_x86_32_seh.main_pe_name = "c:\\xxx\\toto.exe" |
Definition at line 85 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.MAX_MODULES = 0x40 |
Definition at line 50 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.MAX_SEH = 5 |
Definition at line 87 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.modules_list_offset = 0x1f00 |
Definition at line 59 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.PEB_AD = 0x7ffdf000 |
Definition at line 47 of file win_api_x86_32_seh.py.
miasm2.os_dep.win_api_x86_32_seh.peb_address = PEB_AD |
Definition at line 54 of file win_api_x86_32_seh.py.
miasm2.os_dep.win_api_x86_32_seh.peb_ldr_data_address = LDR_AD+peb_ldr_data_offset |
Definition at line 56 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.peb_ldr_data_offset = 0x1ea0 |
Definition at line 55 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.process_environment_address = 0x10000 |
Definition at line 72 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.process_parameters_address = 0x200000 |
Definition at line 73 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.return_from_exception = 0x6eadbeef |
Definition at line 77 of file win_api_x86_32_seh.py.
int miasm2.os_dep.win_api_x86_32_seh.seh_count = 0 |
Definition at line 420 of file win_api_x86_32_seh.py.
miasm2.os_dep.win_api_x86_32_seh.tib_address = FS_0_AD |
Definition at line 53 of file win_api_x86_32_seh.py.