Repository navigation
fix the Windows TEB/PEB/LDR structures, and Emulator(plat=...) - #6
Merged
Merged
Conversation
- x64: UNICODE_STRING.Buffer is at +0x8, after padding, not +0x4: use the pointer size, so the names in x64 LDR_DATA_TABLE_ENTRYs point at the strings (#3). - x86: append_ldr_data_entry linked entries into lists at PEB_LDR_DATA +0x8/+0x10/+0x18, while the heads are at +0xC/+0x14/+0x1C, so the module lists stayed empty (#4). - x86: write LDR_DATA_TABLE_ENTRY.SizeOfImage, at +0x20, and drop the print in parse_teb (#5). - Emulator(..., plat=...) raised TypeError with unicorn 2.1, whose ucsubclass replaces __new__ with one that takes only (arch, mode), so scripts/scemu.py couldn't start. wrap it to accept the other arguments. tests/test_plat_win.py builds the structures for two DLLs, on x86 and x64, and walks InLoadOrderModuleList from the TEB, the way shellcode does, reading each module's BaseDllName and SizeOfImage at the documented offsets. Fixes #3, fixes #4, fixes #5. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qxz5p5MiB2cdYjen8srqac
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3, fixes #4, fixes #5, and one more bug the new test ran into.
UNICODE_STRING.Buffer(x64: UNICODE_STRING.Buffer written at +0x4, should be +0x8 #3): it's at+0x8(after padding), not+0x4.emit_unicode/parse_unicodenow use the pointer size.append_ldr_data_entrylinked entries intoPEB_LDR_DATA+0x8/+0x10/+0x18, while the list heads are at+0xC/+0x14/+0x1C, so the module lists stayed empty. It now uses theOFFSET_IN_*constants.SizeOfImage(x86: LDR_DATA_TABLE_ENTRY.SizeOfImage not written; stray print in parse_teb #5): now written atLDR_DATA_TABLE_ENTRY+0x20. Also drops theprintinparse_teb.Emulator(..., plat=...): with unicorn 2.1 this raisedTypeError, becauseucsubclassreplaces__new__with one that takes only(arch, mode). That also brokescripts/scemu.py. The fix wraps that__new__so it ignores the extra arguments, which__init__still receives.Testing
tests/test_plat_win.pybuilds the structures for two DLLs, on x86 and x64. It then walksInLoadOrderModuleListfrom the TEB, the way shellcode does, reading eachBaseDllNameandSizeOfImageat the documented offsets rather than through ucutils' own parsers.Emulatorfix, the x86 test fails without thewin32.pyfix, and the x64 test fails without thewin.pyfix.master, none from these changes.Generated by Claude Code