def get_kernel_mod(self):
"""
Get the kernel image module
"""
sys_mods = self.get_sys_modules()
for mod in sys_mods:
if mod.name.lower() == 'ntoskrnl':
return mod
raise KernelEmuError('Failed to get kernel base')
def load_module(self, path=None, data=None):
"""
Load the kernel module to be emulated
"""
pe = self.load_pe(path, data=data, imp_id=w32common.IMPORT_HOOK_ADDR)
if pe.arch == _arch.ARCH_X86:
disasm_mode = cs.CS_MODE_32
elif pe.arch == _arch.ARCH_AMD64:
disasm_mode = cs.CS_MODE_64
else:
raise KernelEmuError('Unsupported architecture: %s', pe.arch)
if not self.arch:
self.arch = pe.arch
self.set_ptr_size(self.arch)
self.emu_eng.init_engine(_arch.ARCH_X86, pe.arch)
if not self.disasm_eng:
self.disasm_eng = cs.Cs(cs.CS_ARCH_X86, disasm_mode)
self.api = WindowsApi(self)
self.om = objman.ObjectManager(emu=self)
if not data:
file_name = os.path.basename(path)
mod_name = os.path.splitext(file_name)[0]
else:
drv_hash = hashlib.sha256()
drv_hash.update(data)
drv_hash = drv_hash.hexdigest()
mod_name = drv_hash
file_name = '%s.sys' % (mod_name)
emu_path = '%sdrivers\\%s' % (self.get_system_root(), file_name)
pe.emu_path = emu_path
self.map_pe(pe, mod_name=mod_name, emu_path=emu_path)
self.mem_write(pe.base, pe.mapped_image)
# Strings the initial buffer so that we can detect decoded strings later on
if self.profiler and self.do_strings:
astrs = self.get_ansi_strings(pe.mapped_image)
wstrs = self.get_unicode_strings(pe.mapped_image)
for s in astrs:
if s not in self.profiler.strings['ansi']:
self.profiler.strings['ansi'].append(s)
for s in wstrs:
if s not in self.profiler.strings['unicode']:
self.profiler.strings['unicode'].append(s)
# Init imported data
for addr, imp in pe.imports.items():
mn, fn = imp
mod, eh = self.api.get_data_export_handler(mn, fn)
if eh:
data_ptr = self.handle_import_data(mn, fn)
sym = "%s.%s" % (mn, fn)
self.global_data.update({addr: [sym, data_ptr]})
self.mem_write(
addr, data_ptr.to_bytes(self.get_ptr_size(), 'little'))
# Set the emulator to run in protected mode
self._setup_gdt(self.get_arch())
self.setup_kernel_mode()
self.setup_user_shared_data()
if not self.stack_base:
self.stack_base, stack_ptr = self.alloc_stack(pe.stack_commit)
return pe