Merge pull request #263 from serpilliere/fix_module_list

Fix module list

1 files changed, 299 insertions, 255 deletions

diff --git a/miasm2/os_dep/win_api_x86_32_seh.py b/miasm2/os_dep/win_api_x86_32_seh.py
index f33a853f..d86bd46a 100644
--- a/miasm2/os_dep/win_api_x86_32_seh.py
+++ b/miasm2/os_dep/win_api_x86_32_seh.py
@@ -87,8 +87,10 @@ main_pe_name = "c:\\xxx\\toto.exe"
 MAX_SEH = 5
 
 
-def build_teb(myjit, teb_address):
+def build_teb(jitter, teb_address):
     """
+    Build TEB informations using following structure:
+
     +0x000 NtTib                     : _NT_TIB
     +0x01c EnvironmentPointer        : Ptr32 Void
     +0x020 ClientId                  : _CLIENT_ID
@@ -97,7 +99,10 @@ def build_teb(myjit, teb_address):
     +0x030 ProcessEnvironmentBlock   : Ptr32 _PEB
     +0x034 LastErrorValue            : Uint4B
     ...
+    @jitter: jitter instance
+    @teb_address: the TEB address
     """
+
     o = ""
     o += pck32(default_seh)
     o += (0x18 - len(o)) * "\x00"
@@ -107,11 +112,13 @@ def build_teb(myjit, teb_address):
     o += pck32(peb_address)
     o += pck32(0x11223344)
 
-    myjit.vm.add_memory_page(teb_address, PAGE_READ | PAGE_WRITE, o)
+    jitter.vm.add_memory_page(teb_address, PAGE_READ | PAGE_WRITE, o)
 
 
-def build_peb(myjit, peb_address):
+def build_peb(jitter, peb_address):
     """
+    Build PEB informations using following structure:
+
     +0x000 InheritedAddressSpace    : UChar
     +0x001 ReadImageFileExecOptions : UChar
     +0x002 BeingDebugged            : UChar
@@ -120,6 +127,9 @@ def build_peb(myjit, peb_address):
     +0x008 ImageBaseAddress         : Ptr32 Void
     +0x00c Ldr                      : Ptr32 _PEB_LDR_DATA
     +0x010 processparameter
+
+    @jitter: jitter instance
+    @peb_address: the PEB address
     """
 
     offset = peb_address + 8
@@ -130,59 +140,80 @@ def build_peb(myjit, peb_address):
         offset += 4
     o += pck32(peb_ldr_data_address)
     o += pck32(process_parameters_address)
-    myjit.vm.add_memory_page(offset, PAGE_READ | PAGE_WRITE, o)
+    jitter.vm.add_memory_page(offset, PAGE_READ | PAGE_WRITE, o)
 
 
-def build_ldr_data(myjit, modules_info):
+def build_ldr_data(jitter, modules_info):
     """
+    Build Loader informations using following structure:
+
     +0x000 Length                          : Uint4B
     +0x004 Initialized                     : UChar
     +0x008 SsHandle                        : Ptr32 Void
     +0x00c InLoadOrderModuleList           : _LIST_ENTRY
     +0x014 InMemoryOrderModuleList         : _LIST_ENTRY
     +0x01C InInitializationOrderModuleList         : _LIST_ENTRY
+
+    @jitter: jitter instance
+    @modules_info: LoadedModules instance
+
     """
-    o = ""
     # ldr offset pad
     offset = LDR_AD + peb_ldr_data_offset + 0xC
 
     # get main pe info
-    m_e = None
-    for bname, (addr, e) in modules_info.items():
-        if e == main_pe:
-            m_e = (e, bname, addr)
-            break
-    if not m_e:
+    main_pe = modules_info.name2module.get(main_pe_name, None)
+    if not main_pe:
         log.warn('No main pe, ldr data will be unconsistant')
         offset, data = offset + 8, ""
     else:
-        log.info('Ldr %x', m_e[2])
-        data = pck32(m_e[2]) + pck32(0)
-
-    # get ntdll
-    ntdll_e = None
-    for bname, (addr, e) in modules_info.items():
-        if bname[::2].lower() == "ntdll.dll":
-            ntdll_e = (e, bname, addr)
-            continue
-    if not ntdll_e:
+        main_addr_entry = modules_info.module2entry[main_pe]
+        log.info('Ldr %x', main_addr_entry)
+        data = pck32(main_addr_entry) + pck32(0)
+        data += pck32(main_addr_entry + 0x8) + pck32(0)  # XXX TODO fix prev
+
+    ntdll_pe = modules_info.name2module.get("ntdll.dll", None)
+    if not ntdll_pe:
         log.warn('No ntdll, ldr data will be unconsistant')
     else:
-        data += pck32(ntdll_e[2] + 0x8) + pck32(0)  # XXX TODO
-        data += pck32(ntdll_e[2] + 0x10) + pck32(0)
+        ntdll_addr_entry = modules_info.module2entry[ntdll_pe]
+        data += pck32(ntdll_addr_entry + 0x10) + pck32(0)  # XXX TODO fix prev
 
     if data:
-        myjit.vm.add_memory_page(offset, PAGE_READ | PAGE_WRITE, data)
+        jitter.vm.add_memory_page(offset, PAGE_READ | PAGE_WRITE, data)
+
+
+class LoadedModules(object):
+
+    """Class representing modules in memory"""
 
+    def __init__(self):
+        self.modules = []
+        self.name2module = {}
+        self.module2entry = {}
+        self.module2name = {}
 
-dummy_e = pe_init.PE()
-dummy_e.NThdr.ImageBase = 0
-dummy_e.Opthdr.AddressOfEntryPoint = 0
-dummy_e.NThdr.sizeofimage = 0
+    def add(self, name, module, module_entry):
+        """Track a new module
+        @name: module name (with extension)
+        @module: module object
+        @module_entry: address of the module entry
+        """
 
+        self.modules.append(module)
+        self.name2module[name] = module
+        self.module2entry[module] = module_entry
+        self.module2name[module] = name
 
-def create_modules_chain(myjit, modules_name):
+    def __repr__(self):
+        out = self.name2module.iteritems()
+        return "\n".join(out)
+
+
+def create_modules_chain(jitter, modules_name):
     """
+    Create the modules entries. Those modules are not linked in this function.
+
     kd> dt nt!_LDR_DATA_TABLE_ENTRY
     +0x000 InLoadOrderLinks : _LIST_ENTRY
     +0x008 InMemoryOrderLinks : _LIST_ENTRY
@@ -202,13 +233,21 @@ def create_modules_chain(myjit, modules_name):
     +0x044 LoadedImports : Ptr32 Void
     +0x048 EntryPointActivationContext : Ptr32 Void
     +0x04c PatchInformation : Ptr32 Void
+
+    @jitter: jitter instance
+    @modules_name: a list of modules names
     """
 
-    modules_info = {}
+    modules_info = LoadedModules()
     base_addr = LDR_AD + modules_list_offset  # XXXX
     offset_name = 0x500
     offset_path = 0x600
 
+    dummy_e = pe_init.PE()
+    dummy_e.NThdr.ImageBase = 0
+    dummy_e.Opthdr.AddressOfEntryPoint = 0
+    dummy_e.NThdr.sizeofimage = 0
+
     out = ""
     for i, m in enumerate([(main_pe_name, main_pe),
                            ("", dummy_e)] + modules_name):
@@ -234,7 +273,7 @@ def create_modules_chain(myjit, modules_name):
             continue
         log.info("Add module %x %r", e.NThdr.ImageBase, bname_str)
 
-        modules_info[bname] = addr, e
+        modules_info.add(bname_str, e, addr)
 
         m_o = ""
         m_o += pck32(0)
@@ -250,168 +289,159 @@ def create_modules_chain(myjit, modules_name):
         m_o += pck32(addr + offset_path)
         m_o += struct.pack('HH', len(bname), len(bname) + 2)
         m_o += pck32(addr + offset_name)
-        myjit.vm.add_memory_page(addr, PAGE_READ | PAGE_WRITE, m_o)
+        jitter.vm.add_memory_page(addr, PAGE_READ | PAGE_WRITE, m_o)
 
         m_o = ""
         m_o += bname
         m_o += "\x00" * 3
-        myjit.vm.add_memory_page(
+        jitter.vm.add_memory_page(
             addr + offset_name, PAGE_READ | PAGE_WRITE, m_o)
 
         m_o = ""
         m_o += "\x00".join(bpath) + "\x00"
         m_o += "\x00" * 3
-        myjit.vm.add_memory_page(
+        jitter.vm.add_memory_page(
             addr + offset_path, PAGE_READ | PAGE_WRITE, m_o)
 
     return modules_info
 
 
-def fix_InLoadOrderModuleList(myjit, module_info):
-    log.debug("Fix InLoadOrderModuleList")
-    # first binary is PE
-    # last is dumm_e
-    olist = []
-    m_e = None
-    d_e = None
-    for m in [main_pe_name, ""] + loaded_modules:
+def fix_InLoadOrderModuleList(jitter, modules_info):
+    """Fix InLoadOrderModuleList double link list. First module is the main pe,
+    then ntdll, kernel32. dummy is last pe.
 
-        if isinstance(m, tuple):
-            fname, e = m
-        else:
-            fname, e = m, None
-
-        if "/" in fname:
-            fname = fname[fname.rfind("/") + 1:]
-        bname_str = fname
-        bname = '\x00'.join(bname_str) + '\x00'
-        if not bname.lower() in module_info:
-            log.warn('Module not found, ldr data will be unconsistant')
-            continue
+    @jitter: the jitter instance
+    @modules_info: the LoadedModules instance
+    """
 
-        addr, e = module_info[bname.lower()]
-        log.debug(bname_str)
-        if e == main_pe:
-            m_e = (e, bname, addr)
-            continue
-        elif e == dummy_e:
-            d_e = (e, bname, addr)
-            continue
-        olist.append((e, bname, addr))
-    if not m_e or not d_e:
+    log.debug("Fix InLoadOrderModuleList")
+    main_pe = modules_info.name2module.get(main_pe_name, None)
+    kernel32_pe = modules_info.name2module.get("kernel32.dll", None)
+    ntdll_pe = modules_info.name2module.get("ntdll.dll", None)
+    dummy_pe = modules_info.name2module.get("", None)
+    special_modules = [main_pe, kernel32_pe, ntdll_pe, dummy_pe]
+    if not all(special_modules):
         log.warn('No main pe, ldr data will be unconsistant')
+        loaded_modules = modules_info.modules
     else:
-        olist[0:0] = [m_e]
-    olist.append(d_e)
-
-    last_addr = 0
-    for i in xrange(len(olist)):
-        e, bname, addr = olist[i]
-        p_e, p_bname, p_addr = olist[(i - 1) % len(olist)]
-        n_e, n_bname, n_addr = olist[(i + 1) % len(olist)]
-        myjit.vm.set_mem(addr + 0, pck32(n_addr) + pck32(p_addr))
-
+        loaded_modules = [module for module in modules_info.modules
+                          if module not in special_modules]
+        loaded_modules[0:0] = [main_pe]
+        loaded_modules[1:1] = [ntdll_pe]
+        loaded_modules[2:2] = [kernel32_pe]
+        loaded_modules.append(dummy_pe)
+
+    for i, module in enumerate(loaded_modules):
+        cur_module_entry = modules_info.module2entry[module]
+        prev_module = loaded_modules[(i - 1) % len(loaded_modules)]
+        next_module = loaded_modules[(i + 1) % len(loaded_modules)]
+        prev_module_entry = modules_info.module2entry[prev_module]
+        next_module_entry = modules_info.module2entry[next_module]
+        jitter.vm.set_mem(cur_module_entry,
+                          (pck32(next_module_entry) +
+                           pck32(prev_module_entry)))
+
+
+def fix_InMemoryOrderModuleList(jitter, modules_info):
+    """Fix InMemoryOrderLinks double link list. First module is the main pe,
+    then ntdll, kernel32. dummy is last pe.
+
+    @jitter: the jitter instance
+    @modules_info: the LoadedModules instance
+    """
 
-def fix_InMemoryOrderModuleList(myjit, module_info):
     log.debug("Fix InMemoryOrderModuleList")
-    # first binary is PE
-    # last is dumm_e
-    olist = []
-    m_e = None
-    d_e = None
-    for m in [main_pe_name, ""] + loaded_modules:
-
-        if isinstance(m, tuple):
-            fname, e = m
-        else:
-            fname, e = m, None
-
-        if "/" in fname:
-            fname = fname[fname.rfind("/") + 1:]
-        bname_str = fname
-        bname = '\x00'.join(bname_str) + '\x00'
-        if not bname.lower() in module_info:
-            log.warn('Module not found, ldr data will be unconsistant')
-            continue
-        addr, e = module_info[bname.lower()]
-        log.debug(bname_str)
-        if e == main_pe:
-            m_e = (e, bname, addr)
-            continue
-        elif e == dummy_e:
-            d_e = (e, bname, addr)
-            continue
-        olist.append((e, bname, addr))
-    if not m_e or not d_e:
+    main_pe = modules_info.name2module.get(main_pe_name, None)
+    kernel32_pe = modules_info.name2module.get("kernel32.dll", None)
+    ntdll_pe = modules_info.name2module.get("ntdll.dll", None)
+    dummy_pe = modules_info.name2module.get("", None)
+    special_modules = [main_pe, kernel32_pe, ntdll_pe, dummy_pe]
+    if not all(special_modules):
         log.warn('No main pe, ldr data will be unconsistant')
+        loaded_modules = modules_info.modules
     else:
-        olist[0:0] = [m_e]
-    olist.append(d_e)
-
-    last_addr = 0
-
-    for i in xrange(len(olist)):
-        e, bname, addr = olist[i]
-        p_e, p_bname, p_addr = olist[(i - 1) % len(olist)]
-        n_e, n_bname, n_addr = olist[(i + 1) % len(olist)]
-        myjit.vm.set_mem(
-            addr + 0x8, pck32(n_addr + 0x8) + pck32(p_addr + 0x8))
-
-
-def fix_InInitializationOrderModuleList(myjit, module_info):
-    # first binary is ntdll
-    # second binary is kernel32
-    olist = []
-    ntdll_e = None
-    kernel_e = None
-    for bname, (addr, e) in module_info.items():
-        if bname[::2].lower() == "ntdll.dll":
-            ntdll_e = (e, bname, addr)
-            continue
-        elif bname[::2].lower() == "kernel32.dll":
-            kernel_e = (e, bname, addr)
-            continue
-        elif e == dummy_e:
-            d_e = (e, bname, addr)
-            continue
-        elif e == main_pe:
-            continue
-        olist.append((e, bname, addr))
-    if not ntdll_e or not kernel_e or not d_e:
-        log.warn('No kernel ntdll, ldr data will be unconsistant')
-    else:
-        olist[0:0] = [ntdll_e]
-        olist[1:1] = [kernel_e]
+        loaded_modules = [module for module in modules_info.modules
+                          if module not in special_modules]
+        loaded_modules[0:0] = [main_pe]
+        loaded_modules[1:1] = [ntdll_pe]
+        loaded_modules[2:2] = [kernel32_pe]
+        loaded_modules.append(dummy_pe)
+
+    for i, module in enumerate(loaded_modules):
+        cur_module_entry = modules_info.module2entry[module]
+        prev_module = loaded_modules[(i - 1) % len(loaded_modules)]
+        next_module = loaded_modules[(i + 1) % len(loaded_modules)]
+        prev_module_entry = modules_info.module2entry[prev_module]
+        next_module_entry = modules_info.module2entry[next_module]
+        jitter.vm.set_mem(cur_module_entry + 0x8,
+                          (pck32(next_module_entry + 0x8) +
+                           pck32(prev_module_entry + 0x8)))
+
+
+def fix_InInitializationOrderModuleList(jitter, modules_info):
+    """Fix InInitializationOrderModuleList double link list. First module is the
+    ntdll, then kernel32. dummy is last pe.
+
+    @jitter: the jitter instance
+    @modules_info: the LoadedModules instance
 
-    olist.append(d_e)
-
-    last_addr = 0
-    for i in xrange(len(olist)):
-        e, bname, addr = olist[i]
-        p_e, p_bname, p_addr = olist[(i - 1) % len(olist)]
-        n_e, n_bname, n_addr = olist[(i + 1) % len(olist)]
-        myjit.vm.set_mem(
-            addr + 0x10, pck32(n_addr + 0x10) + pck32(p_addr + 0x10))
+    """
 
+    log.debug("Fix InInitializationOrderModuleList")
+    main_pe = modules_info.name2module.get(main_pe_name, None)
+    kernel32_pe = modules_info.name2module.get("kernel32.dll", None)
+    ntdll_pe = modules_info.name2module.get("ntdll.dll", None)
+    dummy_pe = modules_info.name2module.get("", None)
+    special_modules = [main_pe, kernel32_pe, ntdll_pe, dummy_pe]
+    if not all(special_modules):
+        log.warn('No main pe, ldr data will be unconsistant')
+        loaded_modules = modules_info.modules
+    else:
+        loaded_modules = [module for module in modules_info.modules
+                          if module not in special_modules]
+        loaded_modules[0:0] = [ntdll_pe]
+        loaded_modules[1:1] = [kernel32_pe]
+        loaded_modules.append(dummy_pe)
+
+    for i, module in enumerate(loaded_modules):
+        cur_module_entry = modules_info.module2entry[module]
+        prev_module = loaded_modules[(i - 1) % len(loaded_modules)]
+        next_module = loaded_modules[(i + 1) % len(loaded_modules)]
+        prev_module_entry = modules_info.module2entry[prev_module]
+        next_module_entry = modules_info.module2entry[next_module]
+        jitter.vm.set_mem(cur_module_entry + 0x10,
+                          (pck32(next_module_entry + 0x10) +
+                           pck32(prev_module_entry + 0x10)))
+
+
+def add_process_env(jitter):
+    """
+    Build a process environement structure
+    @jitter: jitter instance
+    """
 
-def add_process_env(myjit):
     env_str = 'ALLUSEESPROFILE=C:\\Documents and Settings\\All Users\x00'
     env_str = '\x00'.join(env_str)
     env_str += "\x00" * 0x10
-    myjit.vm.add_memory_page(process_environment_address,
-                             PAGE_READ | PAGE_WRITE,
-                             env_str)
-    myjit.vm.set_mem(process_environment_address, env_str)
+    jitter.vm.add_memory_page(process_environment_address,
+                              PAGE_READ | PAGE_WRITE,
+                              env_str)
+    jitter.vm.set_mem(process_environment_address, env_str)
 
 
-def add_process_parameters(myjit):
+def add_process_parameters(jitter):
+    """
+    Build a process parameters structure
+    @jitter: jitter instance
+    """
+
     o = ""
     o += pck32(0x1000)  # size
     o += "E" * (0x48 - len(o))
     o += pck32(process_environment_address)
-    myjit.vm.add_memory_page(process_parameters_address,
-                             PAGE_READ | PAGE_WRITE,
-                             o)
+    jitter.vm.add_memory_page(process_parameters_address,
+                              PAGE_READ | PAGE_WRITE,
+                              o)
 
 
 all_seh_ad = dict([(x, None)
@@ -420,39 +450,44 @@ all_seh_ad = dict([(x, None)
 seh_count = 0
 
 
-def init_seh(myjit):
+def init_seh(jitter):
+    """
+    Build the modules entries and create double links
+    @jitter: jitter instance
+    """
+
     global seh_count
     seh_count = 0
-    build_teb(myjit, FS_0_AD)
-    build_peb(myjit, peb_address)
+    build_teb(jitter, FS_0_AD)
+    build_peb(jitter, peb_address)
 
-    module_info = create_modules_chain(myjit, loaded_modules)
-    fix_InLoadOrderModuleList(myjit, module_info)
-    fix_InMemoryOrderModuleList(myjit, module_info)
-    fix_InInitializationOrderModuleList(myjit, module_info)
+    modules_info = create_modules_chain(jitter, loaded_modules)
+    fix_InLoadOrderModuleList(jitter, modules_info)
+    fix_InMemoryOrderModuleList(jitter, modules_info)
+    fix_InInitializationOrderModuleList(jitter, modules_info)
 
-    build_ldr_data(myjit, module_info)
-    add_process_env(myjit)
-    add_process_parameters(myjit)
+    build_ldr_data(jitter, modules_info)
+    add_process_env(jitter)
+    add_process_parameters(jitter)
 
-    myjit.vm.add_memory_page(default_seh, PAGE_READ | PAGE_WRITE, pck32(
+    jitter.vm.add_memory_page(default_seh, PAGE_READ | PAGE_WRITE, pck32(
         0xffffffff) + pck32(0x41414141) + pck32(0x42424242))
 
-    myjit.vm.add_memory_page(
+    jitter.vm.add_memory_page(
         context_address, PAGE_READ | PAGE_WRITE, '\x00' * 0x2cc)
-    myjit.vm.add_memory_page(
+    jitter.vm.add_memory_page(
         exception_record_address, PAGE_READ | PAGE_WRITE, '\x00' * 200)
 
-    myjit.vm.add_memory_page(
+    jitter.vm.add_memory_page(
         FAKE_SEH_B_AD, PAGE_READ | PAGE_WRITE, 0x10000 * "\x00")
 
 # http://www.codeproject.com/KB/system/inject2exe.aspx#RestorethefirstRegistersContext5_1
 
 
-def regs2ctxt(myjit):
+def regs2ctxt(jitter):
     """
     Build x86_32 cpu context for exception handling
-    @myjit: jitload instance
+    @jitter: jitload instance
     """
 
     ctxt = []
@@ -463,30 +498,30 @@ def regs2ctxt(myjit):
     # Float context
     ctxt += ['\x00' * 112]
     # Segment selectors
-    ctxt += [pck32(reg) for reg in (myjit.cpu.GS, myjit.cpu.FS,
-                                    myjit.cpu.ES, myjit.cpu.DS)]
+    ctxt += [pck32(reg) for reg in (jitter.cpu.GS, jitter.cpu.FS,
+                                    jitter.cpu.ES, jitter.cpu.DS)]
     # Gpregs
-    ctxt += [pck32(reg) for reg in (myjit.cpu.EDI, myjit.cpu.ESI,
-                                    myjit.cpu.EBX, myjit.cpu.EDX,
-                                    myjit.cpu.ECX, myjit.cpu.EAX,
-                                    myjit.cpu.EBP, myjit.cpu.EIP)]
+    ctxt += [pck32(reg) for reg in (jitter.cpu.EDI, jitter.cpu.ESI,
+                                    jitter.cpu.EBX, jitter.cpu.EDX,
+                                    jitter.cpu.ECX, jitter.cpu.EAX,
+                                    jitter.cpu.EBP, jitter.cpu.EIP)]
     # CS
-    ctxt += [pck32(myjit.cpu.CS)]
+    ctxt += [pck32(jitter.cpu.CS)]
     # Eflags
     # XXX TODO real eflag
     ctxt += [pck32(0x0)]
     # ESP
-    ctxt += [pck32(myjit.cpu.ESP)]
+    ctxt += [pck32(jitter.cpu.ESP)]
     # SS
-    ctxt += [pck32(myjit.cpu.SS)]
+    ctxt += [pck32(jitter.cpu.SS)]
     return "".join(ctxt)
 
 
-def ctxt2regs(ctxt, myjit):
+def ctxt2regs(ctxt, jitter):
     """
     Restore x86_32 registers from an exception context
     @ctxt: the serialized context
-    @myjit: jitload instance
+    @jitter: jitload instance
     """
 
     ctxt = ctxt[:]
@@ -497,68 +532,74 @@ def ctxt2regs(ctxt, myjit):
     # Float context XXX TODO
     ctxt = ctxt[112:]
     # gs
-    myjit.cpu.GS = upck32(ctxt[:4])
+    jitter.cpu.GS = upck32(ctxt[:4])
     ctxt = ctxt[4:]
     # fs
-    myjit.cpu.FS = upck32(ctxt[:4])
+    jitter.cpu.FS = upck32(ctxt[:4])
     ctxt = ctxt[4:]
     # es
-    myjit.cpu.ES = upck32(ctxt[:4])
+    jitter.cpu.ES = upck32(ctxt[:4])
     ctxt = ctxt[4:]
     # ds
-    myjit.cpu.DS = upck32(ctxt[:4])
+    jitter.cpu.DS = upck32(ctxt[:4])
     ctxt = ctxt[4:]
 
     # Gpregs
-    myjit.cpu.EDI = upck32(ctxt[:4])
+    jitter.cpu.EDI = upck32(ctxt[:4])
     ctxt = ctxt[4:]
-    myjit.cpu.ESI = upck32(ctxt[:4])
+    jitter.cpu.ESI = upck32(ctxt[:4])
     ctxt = ctxt[4:]
-    myjit.cpu.EBX = upck32(ctxt[:4])
+    jitter.cpu.EBX = upck32(ctxt[:4])
     ctxt = ctxt[4:]
-    myjit.cpu.EDX = upck32(ctxt[:4])
+    jitter.cpu.EDX = upck32(ctxt[:4])
     ctxt = ctxt[4:]
-    myjit.cpu.ECX = upck32(ctxt[:4])
+    jitter.cpu.ECX = upck32(ctxt[:4])
     ctxt = ctxt[4:]
-    myjit.cpu.EAX = upck32(ctxt[:4])
+    jitter.cpu.EAX = upck32(ctxt[:4])
     ctxt = ctxt[4:]
-    myjit.cpu.EBP = upck32(ctxt[:4])
+    jitter.cpu.EBP = upck32(ctxt[:4])
     ctxt = ctxt[4:]
-    myjit.cpu.EIP = upck32(ctxt[:4])
+    jitter.cpu.EIP = upck32(ctxt[:4])
     ctxt = ctxt[4:]
 
     # CS
-    myjit.cpu.CS = upck32(ctxt[:4])
+    jitter.cpu.CS = upck32(ctxt[:4])
     ctxt = ctxt[4:]
     # Eflag XXX TODO
     ctxt = ctxt[4:]
     # ESP
-    myjit.cpu.ESP = upck32(ctxt[:4])
+    jitter.cpu.ESP = upck32(ctxt[:4])
     ctxt = ctxt[4:]
 
 
-def fake_seh_handler(myjit, except_code):
+def fake_seh_handler(jitter, except_code):
+    """
+    Create an exception context
+    @jitter: jitter instance
+    @except_code: x86 exception code
+    """
+
     global seh_count, context_address
-    regs = myjit.cpu.get_gpreg()
-    log.warning('Exception at %x %r', myjit.cpu.EIP, seh_count)
+    regs = jitter.cpu.get_gpreg()
+    log.warning('Exception at %x %r', jitter.cpu.EIP, seh_count)
     seh_count += 1
 
     # Help lambda
     p = lambda s: struct.pack('I', s)
 
     # Forge a CONTEXT
-    ctxt = regs2ctxt(myjit)
+    ctxt = regs2ctxt(jitter)
 
     # Get current seh (fs:[0])
-    seh_ptr = upck32(myjit.vm.get_mem(tib_address, 4))
+    seh_ptr = upck32(jitter.vm.get_mem(tib_address, 4))
 
     # Retrieve seh fields
     old_seh, eh, safe_place = struct.unpack(
-        'III', myjit.vm.get_mem(seh_ptr, 0xc))
+        'III', jitter.vm.get_mem(seh_ptr, 0xc))
 
     # Get space on stack for exception handling
-    myjit.cpu.ESP -= 0x3c8
-    exception_base_address = myjit.cpu.ESP
+    jitter.cpu.ESP -= 0x3c8
+    exception_base_address = jitter.cpu.ESP
     exception_record_address = exception_base_address + 0xe8
     context_address = exception_base_address + 0xfc
     fake_seh_address = exception_base_address + 0x14
@@ -567,7 +608,7 @@ def fake_seh_handler(myjit, except_code):
              seh_ptr, old_seh, eh, safe_place, context_address)
 
     # Write context
-    myjit.vm.set_mem(context_address, ctxt)
+    jitter.vm.set_mem(context_address, ctxt)
 
     # Write exception_record
 
@@ -584,46 +625,51 @@ def fake_seh_handler(myjit, except_code):
     } EXCEPTION_RECORD, *PEXCEPTION_RECORD;
     """
 
-    myjit.vm.set_mem(exception_record_address,
-                     pck32(except_code) + pck32(0) + pck32(0) +
-                     pck32(myjit.cpu.EIP) + pck32(0))
+    jitter.vm.set_mem(exception_record_address,
+                      pck32(except_code) + pck32(0) + pck32(0) +
+                      pck32(jitter.cpu.EIP) + pck32(0))
 
     # Prepare the stack
-    myjit.push_uint32_t(context_address)               # Context
-    myjit.push_uint32_t(seh_ptr)                       # SEH
-    myjit.push_uint32_t(exception_record_address)      # ExceptRecords
-    myjit.push_uint32_t(return_from_exception)         # Ret address
+    jitter.push_uint32_t(context_address)               # Context
+    jitter.push_uint32_t(seh_ptr)                       # SEH
+    jitter.push_uint32_t(exception_record_address)      # ExceptRecords
+    jitter.push_uint32_t(return_from_exception)         # Ret address
 
     # Set fake new current seh for exception
     log.info("Fake seh ad %x", fake_seh_address)
-    myjit.vm.set_mem(fake_seh_address, pck32(seh_ptr) + pck32(
+    jitter.vm.set_mem(fake_seh_address, pck32(seh_ptr) + pck32(
         0xaaaaaaaa) + pck32(0xaaaaaabb) + pck32(0xaaaaaacc))
-    myjit.vm.set_mem(tib_address, pck32(fake_seh_address))
+    jitter.vm.set_mem(tib_address, pck32(fake_seh_address))
 
-    dump_seh(myjit)
+    dump_seh(jitter)
 
     log.info('Jumping at %x', eh)
-    myjit.vm.set_exception(0)
-    myjit.cpu.set_exception(0)
+    jitter.vm.set_exception(0)
+    jitter.cpu.set_exception(0)
 
     # XXX set ebx to nul?
-    myjit.cpu.EBX = 0
+    jitter.cpu.EBX = 0
 
     return eh
 
 fake_seh_handler.base = FAKE_SEH_B_AD
 
 
-def dump_seh(myjit):
+def dump_seh(jitter):
+    """
+    Walk and dump the SEH entries
+    @jitter: jitter instance
+    """
+
     log.info('Dump_seh. Tib_address: %x', tib_address)
-    cur_seh_ptr = upck32(myjit.vm.get_mem(tib_address, 4))
+    cur_seh_ptr = upck32(jitter.vm.get_mem(tib_address, 4))
     indent = 1
     loop = 0
     while True:
         if loop > MAX_SEH:
             log.warn("Too many seh, quit")
             return
-        prev_seh, eh = struct.unpack('II', myjit.vm.get_mem(cur_seh_ptr, 8))
+        prev_seh, eh = struct.unpack('II', jitter.vm.get_mem(cur_seh_ptr, 8))
         log.info('\t' * indent + 'seh_ptr: %x { prev_seh: %x eh %x }',
                  cur_seh_ptr, prev_seh, eh)
         if prev_seh in [0xFFFFFFFF, 0]:
@@ -633,55 +679,53 @@ def dump_seh(myjit):
         loop += 1
 
 
-def set_win_fs_0(myjit, fs=4):
-    regs = myjit.cpu.get_gpreg()
+def set_win_fs_0(jitter, fs=4):
+    """
+    Set FS segment selector and create its corresponding segment
+    @jitter: jitter instance
+    @fs: segment selector value
+    """
+
+    regs = jitter.cpu.get_gpreg()
     regs['FS'] = 0x4
-    myjit.cpu.set_gpreg(regs)
-    myjit.cpu.set_segm_base(regs['FS'], FS_0_AD)
+    jitter.cpu.set_gpreg(regs)
+    jitter.cpu.set_segm_base(regs['FS'], FS_0_AD)
     segm_to_do = set([x86_regs.FS])
     return segm_to_do
 
 
-def add_modules_info(pe_in, pe_in_name="toto.exe", all_pe=None):
-    global main_pe, main_pe_name, loaded_modules
-    if all_pe is None:
-        all_pe = []
-    main_pe = pe_in
-    main_pe_name = pe_in_name
-    loaded_modules = all_pe
-
-
-def return_from_seh(myjit):
-    "Handle return after a call to fake seh handler"
+def return_from_seh(jitter):
+    """Handle the return from an exception handler
+    @jitter: jitter instance"""
 
     # Get current context
-    context_address = upck32(myjit.vm.get_mem(myjit.cpu.ESP + 0x8, 4))
+    context_address = upck32(jitter.vm.get_mem(jitter.cpu.ESP + 0x8, 4))
     log.info('Context address: %x', context_address)
-    myjit.cpu.ESP = upck32(myjit.vm.get_mem(context_address + 0xc4, 4))
-    log.info('New esp: %x', myjit.cpu.ESP)
+    jitter.cpu.ESP = upck32(jitter.vm.get_mem(context_address + 0xc4, 4))
+    log.info('New esp: %x', jitter.cpu.ESP)
 
     # Rebuild SEH
-    old_seh = upck32(myjit.vm.get_mem(tib_address, 4))
-    new_seh = upck32(myjit.vm.get_mem(old_seh, 4))
+    old_seh = upck32(jitter.vm.get_mem(tib_address, 4))
+    new_seh = upck32(jitter.vm.get_mem(old_seh, 4))
     log.info('Old seh: %x New seh: %x', old_seh, new_seh)
-    myjit.vm.set_mem(tib_address, pck32(new_seh))
+    jitter.vm.set_mem(tib_address, pck32(new_seh))
 
-    dump_seh(myjit)
+    dump_seh(jitter)
 
-    if myjit.cpu.EAX == 0x0:
+    if jitter.cpu.EAX == 0x0:
         # ExceptionContinueExecution
         ctxt_ptr = context_address
         log.info('Seh continues Context: %x', ctxt_ptr)
 
         # Get registers changes
-        ctxt_str = myjit.vm.get_mem(ctxt_ptr, 0x2cc)
-        ctxt2regs(ctxt_str, myjit)
-        myjit.pc = myjit.cpu.EIP
-        log.info('Context::Eip: %x', myjit.pc)
+        ctxt_str = jitter.vm.get_mem(ctxt_ptr, 0x2cc)
+        ctxt2regs(ctxt_str, jitter)
+        jitter.pc = jitter.cpu.EIP
+        log.info('Context::Eip: %x', jitter.pc)
 
-    elif myjit.cpu.EAX == -1:
+    elif jitter.cpu.EAX == -1:
         raise NotImplementedError("-> seh try to go to the next handler")
 
-    elif myjit.cpu.EAX == 1:
+    elif jitter.cpu.EAX == 1:
         # ExceptionContinueSearch
         raise NotImplementedError("-> seh, gameover")