Skip to content

library.md

Latest commit

 

History

History
62 lines (45 loc) · 1.76 KB

library.md

File metadata and controls

62 lines (45 loc) · 1.76 KB
Raw

Python library usage

You can use Speakeasy as a Python library through the speakeasy.Speakeasy interface.

Minimal DLL emulation flow

import speakeasy

se = speakeasy.Speakeasy()
module = se.load_module("sample.dll")
se.run_module(module, all_entrypoints=True)
report = se.get_report()
se.shutdown()

Calling a specific export

import speakeasy

se = speakeasy.Speakeasy()
module = se.load_module("sample.dll")
se.run_module(module)

for export in module.get_exports():
    if export.name == "myexport":
        se.call(export.address, [0x0, 0x1])

report = se.get_report()
se.shutdown()

Library options you may want

  • pass config= to control environment and analysis
  • pass argv= to populate emulated process arguments
  • pass volumes= to mount host paths into emulated filesystem
  • pass gdb_port= to block for GDB attach before execution; gdb_host= controls the bind address and defaults to 127.0.0.1

API hooks

se.add_api_hook(cb, "user32", "MessageBox*") calls cb(emu, api_name, func, params) in place of the handler. params holds the raw argument slots, and func(params) runs the handler. After that call, emu.get_api_args() returns the arguments as the report shows them, with the values the handler decoded:

def hook_messagebox(emu, api_name, func, params):
    rv = func(params)
    print(emu.get_api_args()[1].display)  # the lpText string
    return rv

For runnable scripts, see ../examples.

Related docs