1

file_buffer = requests.get(file_url)

buf_size = len(file_buffer)

pe_file = pefile.PE(data=file_buffer)

print("This is really a pe imphash %s." % pe_file.get_imphash())

addr = hex(id(file_buffer))

print("PE start memory at %s length %d." % (addr, len(file_buffer)))

new_loader = ida_idaapi.loader_input_t()

mem_inp = ida_diskio.create_memory_linput(addr, buf_size)

6
  • 1
    Your code is broken. What is addr? Jan 3, 2021 at 5:24
  • ea_t - I cant' this parameter right in python @RolfRolles Jan 3, 2021 at 9:22
  • 1
    Right. Well, your code snippet shows no definition for that variable, so we don't know what you did wrong. Nobody can help you until you show us how you defined the addr variable. Jan 3, 2021 at 16:57
  • buffer = b'\xB8\x01\x00\x00\x00' id(addr) - will be the start address of the buffer thank you for your help Jan 4, 2021 at 17:36
  • 1
    Man, if you want help, paste the real code into your question, not pseudocode, not snippets that you think are relevant, the whole thing. Jan 4, 2021 at 22:42

1 Answer 1

2

After some research time, I found a way to do it in CPP but not in python.

https://github.com/SentineLabs/Memloader/blob/main/MemoryLoader/MemoryLoader/MemoryLoader.cpp

The most relevant part of the code dealing with loading PEs from buffer to memory:

void destroy_linput(linput_t* li)
{
    close_linput(li);
}

linput_t* create_linput(std::vector< bit7z::byte_t >& file_buffer)
{
    return create_bytearray_linput(file_buffer.data(), file_buffer.size());
}

void destroy_linfos(load_info_t* linfos)
{
    free_loaders_list(linfos);
}

load_info_t* create_linfos(linput_t* li)
{
    return build_loaders_list(li, "");
}

const unique_ptr_s1<linput_t, destroy_linput> li2{
  create_linput(file_buffer)
};
        
const unique_ptr_s1<load_info_t, destroy_linfos> linfos{
  create_linfos(li2.get())
};

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.