def get_kernel_mod(self): """ Get the kernel image module """ sys_mods = self.get_sys_modules() for mod in sys_mods: if mod.name.lower() == 'ntoskrnl': return mod raise KernelEmuError('Failed to get kernel base')
def load_module(self, path=None, data=None): """ Load the kernel module to be emulated """ pe = self.load_pe(path, data=data, imp_id=w32common.IMPORT_HOOK_ADDR) if pe.arch == _arch.ARCH_X86: disasm_mode = cs.CS_MODE_32 elif pe.arch == _arch.ARCH_AMD64: disasm_mode = cs.CS_MODE_64 else: raise KernelEmuError('Unsupported architecture: %s', pe.arch) if not self.arch: self.arch = pe.arch self.set_ptr_size(self.arch) self.emu_eng.init_engine(_arch.ARCH_X86, pe.arch) if not self.disasm_eng: self.disasm_eng = cs.Cs(cs.CS_ARCH_X86, disasm_mode) self.api = WindowsApi(self) self.om = objman.ObjectManager(emu=self) if not data: file_name = os.path.basename(path) mod_name = os.path.splitext(file_name)[0] else: drv_hash = hashlib.sha256() drv_hash.update(data) drv_hash = drv_hash.hexdigest() mod_name = drv_hash file_name = '%s.sys' % (mod_name) emu_path = '%sdrivers\\%s' % (self.get_system_root(), file_name) pe.emu_path = emu_path self.map_pe(pe, mod_name=mod_name, emu_path=emu_path) self.mem_write(pe.base, pe.mapped_image) # Strings the initial buffer so that we can detect decoded strings later on if self.profiler and self.do_strings: astrs = self.get_ansi_strings(pe.mapped_image) wstrs = self.get_unicode_strings(pe.mapped_image) for s in astrs: if s not in self.profiler.strings['ansi']: self.profiler.strings['ansi'].append(s) for s in wstrs: if s not in self.profiler.strings['unicode']: self.profiler.strings['unicode'].append(s) # Init imported data for addr, imp in pe.imports.items(): mn, fn = imp mod, eh = self.api.get_data_export_handler(mn, fn) if eh: data_ptr = self.handle_import_data(mn, fn) sym = "%s.%s" % (mn, fn) self.global_data.update({addr: [sym, data_ptr]}) self.mem_write( addr, data_ptr.to_bytes(self.get_ptr_size(), 'little')) # Set the emulator to run in protected mode self._setup_gdt(self.get_arch()) self.setup_kernel_mode() self.setup_user_shared_data() if not self.stack_base: self.stack_base, stack_ptr = self.alloc_stack(pe.stack_commit) return pe