in functions/kernel32.py [0:0]
def VirtualAlloc(self, is_return=False):
if is_return:
return f"{hex(funcutils.get_result(self.is_64bit))} -> LPVOID"
lpAddress = funcutils.get_func_args(1, self.is_64bit)
dwSize = funcutils.get_func_args(2, self.is_64bit)
flAllocationType = funcutils.get_func_args(3, self.is_64bit)
flProtect = funcutils.get_func_args(4, self.is_64bit)
allocation_flags = []
if flAllocationType & 0x00001000:
allocation_flags.append("MEM_COMMIT")
if flAllocationType & 0x00002000:
allocation_flags.append("MEM_RESERVE")
if flAllocationType & 0x00008000:
allocation_flags.append("MEM_RESET")
allocation_flags_str = '|'.join(allocation_flags) if allocation_flags else '0'
protection_flags = []
if flProtect & 0x01:
protection_flags.append("PAGE_NOACCESS")
if flProtect & 0x02:
protection_flags.append("PAGE_READONLY")
if flProtect & 0x04:
protection_flags.append("PAGE_READWRITE")
if flProtect & 0x08:
protection_flags.append("PAGE_WRITECOPY")
protection_flags_str = '|'.join(protection_flags) if protection_flags else '0'
_debug_info = (f"lpAddress={hex(lpAddress)}, "
f"dwSize={dwSize}, "
f"flAllocationType={allocation_flags_str}, "
f"flProtect={protection_flags_str}) = ")
return _debug_info