Get the path of the "SYSTEMROOT" environment variable

Get the TLS callbacks for a PE (if any)

Disable a previously enabled hook

Enable a previously disabled hook

Initialize the DRIVER_OBJECT

Create the driver section for the driver. This is a linked list that links together driver objects

Initialize cpu engine

Initialize and add the export table to the PE

Initialize configured processes. Subclasses must implement.

Initialize configured processes set in the emulator config

Get the system modules (e.g. drivers) that are loaded in the emulator

Initialize the Thread Information Block

Initialize and add the text section to the PE

Initialize implicit thread local storage. Meant to be called after init_teb.

Returns true if the given apiname is one we don't want to use api hammering mitigation for

Is the current PE file a .NET assembly?

Test data to see if it looks like a PE args: data: Bytes to be tested for a PE return: True is data

int isdigit( int c );

Terminate a process (i.e. remove it from the known process list)

Parse a PE that will be used during emulation. PE type and architecture are automatically determined.

Free a block of memory, if all blocks in a block are set to free, unmap the entire block

Read bytes from the emulated address space

Get current memory allocations from the engine

Reserve (but do not map) a block of memory

Write bytes into the emulated address space

void *memcpy( void *dest, const void *src, size_t count );

void *memmove( void *dest, const void *src, size_t count );

Called when emulation completes. Subclasses must implement.

Open or optionally create a registry key

Get value from the stack and adjust the stack pointer return: value stored at the top of the stack

Unmap all current blocks of mapped memory

Log a call to an OS API. This includes arguments, return address, and return value

Log code that is generated at runtime and then executed

Log a top level emulator error for the emulation report.

Log a handled exception event.

Log registry access events. This includes values and keys being accessed and being read/written

int recv( SOCKET s, char *buf, int len, int flags );

Create a registry key

Remove an object from the object manager

Reset stack to the supplied base address

Resume a previously suspended thread

Begin emulating a previously loaded module Arguments: module: Module to emulate

Sets the current directory path

Set the current process context

Set instruction level hooks

Reserves memory that will be used to handle events that occur during emulation

Establish a handler for unhandled exceptions that occur during emulation