mirror of
https://github.com/mandiant/speakeasy.git
synced 2026-10-12 02:18:47 +00:00
Willi Ballenthin
9c53359951
Handlers set the report display of an argument through ctx.args, by parameter name where the signature is usable on x86 and x64 and by slot index otherwise. argv holds the raw slots, and the transitional copy of argv writes in handle_import_func is gone. Variadic handlers use ctx.args.clear() and append(); delegating handlers pass ctx, so the inner handler's displays apply to the outer call. The display setter ignores values that are not strings, such as None from a failed constant lookup or the raw pointer of a NULL string argument. API hooks get raw argv. WindowsEmulator.get_api_args() returns the arguments of the hooked call as the report shows them, and the emu_dll and dbgview examples use it.