search

hzqst / unicorn_pe

Unicorn PE is an unicorn based instrumentation project designed to emulate code execution for windows PE files.
MIT License
787 stars 199 forks source link

dll模块地址重叠 #30

Open wallds opened 2 years ago

wallds commented 2 years ago

https://github.com/hzqst/unicorn_pe/blob/b6be00543069c366451a93af1a7fa5ea7fd9d3e3/unicorn_pe/unicorn_pe.cpp#L55-L62 实际上在blackbone::PreCallback事件中，modInfo.size一直都是0，modInfo.size并没有起到预期的作用。

https://github.com/hzqst/unicorn_pe/blob/b6be00543069c366451a93af1a7fa5ea7fd9d3e3/Blackbone/src/BlackBone/ManualMap/MMap.cpp#L854-L868

如果加载的模块大小超过0x10000，那么就会出现下面的情况。

`GG0A_S~BCZCI4I$F5)U9`O

很显然这些ImageBase是错误的 ImageName ImageBase ImageSize
"ntdll.dll" 0x0000000180030000 0x001f5000
"kernelbase.dll" 0x0000000180020000 0x002c8000
"kernel32.dll" 0x0000000180050000 0x000be000

"kernel32.LocalAlloc" 0x00000001800684c0