We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent 965e041 commit 53b4e52Copy full SHA for 53b4e52
readme.md
@@ -66,19 +66,10 @@ assert emu.rax == 0x0
66
assert emu.rbx == 0x0
67
```
68
69
-Install TEB and PEB for Windows process emulation (useful for shellcode):
+Install TEB and PEB for Windows process emulation (useful for tracing shellcode), and then load a PE file:
70
```python
71
-# Thread Environment Block (TEB)
72
-teb_addr = ucutils.plat.win64.map_teb(emu)
+ucutils.plat.win64.map_teb(emu)
73
74
-# Process Environment Block (PEB)
75
-peb_addr = ucutils.plat.win64.map_peb(emu)
76
-
77
-ucutils.arch.x64.set_fs(emu, teb_addr)
78
-```
79
80
-Load a PE file:
81
-```python
82
pe = pefile.PE(data=b"MZ...")
83
ucutils.plat.win.load_dll(emu, {"filename": "payload.dll", "pe": pe})
84
0 commit comments