Running a DLL without PE file

[Te-k]

Hi,

I am trying to run a function in a DLL using a script similar to this one but I encounter an issue when running GetModuleFileName :

0x1000111: Error while calling API handler for KERNEL32.GetModuleFileNameW:
Traceback (most recent call last):
  File "speakeasy/speakeasy/windows/winemu.py", line 1126, in handle_import_func
    rv = self.api.call_api_func(mod, func, argv, ctx=default_ctx)
  File "speakeasy/speakeasy/winenv/api/winapi.py", line 77, in call_api_func
    return func(mod, self.emu, argv, ctx)
  File "speakeasy/speakeasy/winenv/api/usermode/kernel32.py", line 2852, in GetModuleFileName
    filename = emu.get_process_path()
AttributeError: 'Win32Emulator' object has no attribute 'get_process_path'
0xfeedf02c: call_0x10001650: Caught error: 'Win32Emulator' object has no attribute 'get_process_path'
Invalid memory read (UC_ERR_READ_UNMAPPED)

The get_current_process function does not return anything :

    def GetModuleFileName(self, emu, argv, ctx={}):
        [...]
        if hModule == 0:
            proc = emu.get_current_process()
            filename = proc.get_process_path()

Which actually make sense because I am running a DLL not loaded properly by a PE file, but I wonder if there is an easy way to load a DLL and avoid that issue (I can hook the function and overwrite it but it is quite annoying for something that is really common). Maybe having a script available to fully reproduce rundll32? Or am I missing something?

[Te-k]

Nevermind, I actually forgot to call run_module :facepalm: