1

file_buffer = requests.get(file_url)

buf_size = len(file_buffer)

pe_file = pefile.PE(data=file_buffer)

print("This is really a pe imphash %s." % pe_file.get_imphash())

addr = hex(id(file_buffer))

print("PE start memory at %s length %d." % (addr, len(file_buffer)))

new_loader = ida_idaapi.loader_input_t()

mem_inp = ida_diskio.create_memory_linput(addr, buf_size)

6
  • Your code is broken. What is addr? – Rolf Rolles Jan 3 at 5:24
  • ea_t - I cant' this parameter right in python @RolfRolles – BlackRussian Jan 3 at 9:22
  • 1
    Right. Well, your code snippet shows no definition for that variable, so we don't know what you did wrong. Nobody can help you until you show us how you defined the addr variable. – Rolf Rolles Jan 3 at 16:57
  • buffer = b'\xB8\x01\x00\x00\x00' id(addr) - will be the start address of the buffer thank you for your help – BlackRussian Jan 4 at 17:36
  • 1
    Man, if you want help, paste the real code into your question, not pseudocode, not snippets that you think are relevant, the whole thing. – Rolf Rolles Jan 4 at 22:42
2

After some research time, I found a way to do it in CPP but not in python.

https://github.com/SentineLabs/Memloader/blob/main/MemoryLoader/MemoryLoader/MemoryLoader.cpp

The most relevant part of the code dealing with loading PEs from buffer to memory:

void destroy_linput(linput_t* li)
{
    close_linput(li);
}

linput_t* create_linput(std::vector< bit7z::byte_t >& file_buffer)
{
    return create_bytearray_linput(file_buffer.data(), file_buffer.size());
}

void destroy_linfos(load_info_t* linfos)
{
    free_loaders_list(linfos);
}

load_info_t* create_linfos(linput_t* li)
{
    return build_loaders_list(li, "");
}

const unique_ptr_s1<linput_t, destroy_linput> li2{
  create_linput(file_buffer)
};
        
const unique_ptr_s1<load_info_t, destroy_linfos> linfos{
  create_linfos(li2.get())
};

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.