api hooks: add support for msvcrt.memmove

closes #262.
mandiant · Mar 15, 2017 · 2d78a44 · 2d78a44
1 parent 4fd1450
commit 2d78a44
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/floss/api_hooks.py b/floss/api_hooks.py
@@ -239,15 +239,16 @@ def hook(self, callname, driver, callconv, api, argv):
 
 class MemcpyHook(viv_utils.emulator_drivers.Hook):
     '''
-    Hook and handle calls to memcpy.
+    Hook and handle calls to memcpy and memmove.
     '''
     MAX_COPY_SIZE = 1024 * 1024 * 32  # don't attempt to copy more than 32MB, or something is wrong
 
     def __init__(self, *args, **kwargs):
         super(MemcpyHook, self).__init__(*args, **kwargs)
 
     def hook(self, callname, driver, callconv, api, argv):
-        if callname == "msvcrt.memcpy":
+        if callname == "msvcrt.memcpy" or \
+           callname == "msvcrt.memmove":
             emu = driver
             dst, src, count = argv
             if count > self.MAX_COPY_SIZE:

diff --git a/floss/main.py b/floss/main.py
@@ -30,6 +30,7 @@
 
 from utils import get_vivisect_meta_info
 
+
 floss_logger = logging.getLogger("floss")