Merge branch 'master' of https://github.com/fireeye/speakeasy

keyman9848 · Apr 12, 2021 · 8c0a261 · 8c0a261
2 parents d1e7654 + a27d2cd
commit 8c0a261
Show file tree

Hide file tree

Showing 5 changed files with 301 additions and 26 deletions.
diff --git a/speakeasy/windows/winemu.py b/speakeasy/windows/winemu.py
@@ -2066,7 +2066,7 @@ def _tmp_hook(emu, addr, size, ctx):
             hook_obj.disable()
 
         exception_list = self._get_exception_list()
-        if exception_list and self.dispatch_handlers:
+        if (exception_list or self.unhandled_exception_filter) and self.dispatch_handlers:
             # Catch software breakpoint interrupts
             if intnum == 3 or intnum == 0x2d:
                 self.curr_exception_code = ddk.STATUS_BREAKPOINT

diff --git a/speakeasy/winenv/api/usermode/advapi32.py b/speakeasy/winenv/api/usermode/advapi32.py
@@ -273,7 +273,7 @@ def RegEnumKeyEx(self, emu, argv, ctx={}):
                             name = name.encode('utf-8')
                         self.mem_write(lpName, name)
                         rv = windefs.ERROR_SUCCESS
-
+            self.log_registry_access(key.get_path(), "list_subkeys")
         return rv
 
     @apihook('RegCreateKey', argc=3)
@@ -297,7 +297,9 @@ def RegCreateKey(self, emu, argv, ctx={}):
                 if lpSubKey:
                     lpSubKey = self.read_mem_string(lpSubKey, cw)
                     argv[1] = lpSubKey
-                    self.emu.reg_create_key(key.get_path() + '\\' + lpSubKey)
+                    sub_key_path = key.get_path() + '\\' + lpSubKey
+                    self.emu.reg_create_key(sub_key_path)
+                    self.log_registry_access(sub_key_path, "create_key")
                 else:
                     hkey = (hkey).to_bytes(self.get_ptr_size(), 'little')
                     self.mem_write(phkResult, hkey)