Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
defcall = vivisect.parsers.pe.defcalls.get(self.arch)
self.vw.setMeta("DefaultCall", defcall)
self.vw.addMemoryMap(va, envi.memory.MM_RWX, "", bytes)
pe = None
if utils.is_legit_pe(bytes):
pe = utils.get_pe_obj(va)
if not entry_point and pe:
entry_point = pe.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint + va
if entry_point:
self.vw.addEntryPoint(entry_point)
self.vw.addExport(entry_point, vivisect.const.EXP_FUNCTION, '__entry', '')
if pe:
self.vw.addVaSet("Library Loads",
(("Address", vivisect.const.VASET_ADDRESS), ("Library", vivisect.const.VASET_STRING)))
self.vw.addVaSet('pe:ordinals',
(('Address', vivisect.const.VASET_ADDRESS), ('Ordinal', vivisect.const.VASET_INTEGER)))
# Add exports
for rva, _, expname in pe.getExports():
self.vw.addExport(
va + rva, vivisect.const.EXP_UNTYPED, expname, '')
# Add imports
for rva, lname, iname in pe.getImports():
if self.vw.probeMemory(rva + va, 4, envi.memory.MM_READ):
self.vw.makeImport(rva + va, lname, iname)
self.vw._snapInAnalysisModules()
# save the analysis
self.vw.setMeta("StorageModule", "vivisect.storage.basicfile")
self.vw.setMeta("StorageName", storage_fname)
self.vw.analyze()