jtbennett-fe

_handleApiHooks calls skipInstruction after the hook is called, which undoes any change to the pc made by the hook

whether it be FIFO, LIFO, etc. Speakeasy should have an intuitive order of execution for hooks when there are multiple hooks set for a given API.

should Speakeasy be stripping the file extensions when storing the module names passed to GetProcAddress?

05e355ade0467021057237150f0a0e03

File "speakeasy/speakeasy/binemu.py", line 324, in set_func_args self.mem_write(curr_sp, r) File "speakeasy/speakeasy/memmgr.py", line 194, in mem_write self.emu_eng.mem_write(addr, data) File "speakeasy/speakeasy/engines/unicorn_eng.py", line 196, in mem_write return self.emu.mem_write(addr, data) File "python3.7/site-packages/unicorn/unicorn.py", line 442, in...

it is not always clear why speakeasy has stopped emulation. logging the reason for stopping (even if it is simply because it ended naturally) would be helpful for understanding what...

this will be useful when malware expect a certain name.