names = ["GetModuleHandleA", "lstrlenW", "TlsSetValue", "TlsGetValue", "CreateProcessW", "GetProcessId", "CreateProcessA", "Sleep", "GetLastError", "SetLastError", "lstrcatW", "RtlEnterCriticalSection", "OpenEventW", "HeapDestroy", "RtlLeaveCriticalSection", "ResetEvent", "HeapCreate", "WaitForSingleObject", "CloseHandle", "SetEvent", "lstrcpyW", "RtlRemoveVectoredExceptionHandler", "CreateMutexW", "RtlAddVectoredExceptionHandler", "CreateEventW", "RtlExitUserThread", "GetProcAddress", "lstrcpyA", "SleepEx", "lstrcmp", "lstrlen", "RtlInitializeCriticalSection", "GetModuleHandleExW", "GetCurrentThreadId", "VirtualFree", "ReadFile", "CancelIo", "GetOverlappedResult", "WaitNamedPipeW", "WriteFile", "CreateEventA", "GetModuleFileNameW", "lstrcmpiA", "GetSystemTimeAsFileTime", "LoadLibraryA", "SetThreadContext", "CreateThread", "GetThreadContext", "WaitForMultipleObjects", "ProcessIdToSessionId", "GetCurrentProcessId", "RtlReAllocateHeap", "HeapFree", "RtlAllocateHeap", "SetFilePointer", "ResumeThread", "CheckRemoteDebuggerPresent", "TlsAlloc", "OpenProcess", None, "NtOpenKey", "ZwCreateKey", "ZwDeleteValueKey", "ZwSetValueKey", "ZwQueryValueKey", "RtlCopyMemory", "memcmp",
"mbstowcs", "NtQueryInformationToken", "ZwOpenProcessToken", "RtlImageNtHeader", "wcstombs", "_strupr", "_wcsupr", "ZwQueryVirtualMemory", "ZwProtectVirtualMemory", "ZwAllocateVirtualMemory", "memset", "ZwOpenFile", "ZwUnmapViewOfSection", "ZwSetInformationProcess", "ZwQueryInformationProcess", "NtOpenSection", "NtQuerySection", "ZwMapViewOfSection", "RtlNtStatusToDosError", "_snwprintf", "strchr", "LdrFindEntryForAddress", "wcsrchr", "NtClose", "RtlInitUnicodeString", "RtlCopyMemory", "__C_specific_handler"]
addr = 0x23174cef000
for i, name in enumerate(names):
if name == None:
continue
s = Symbol(SymbolType.DataSymbol, addr + (i * 8), name)
bv.define_user_symbol(s)
Comments