PE: Only load ntoskrnl on drivers

Author: learn-more

qiling/loader/pe.py

@@ -349,17 +349,17 @@ def __init__(self, ql):
         self.path       = self.ql.path
 
     def run(self):
-        self.init_dlls = [b"ntoskrnl.exe", b"ntdll.dll", b"kernel32.dll", b"user32.dll"]
-        self.sys_dlls = [b"ntoskrnl.exe", b"ntdll.dll", b"kernel32.dll"]
+        self.init_dlls = [b"ntdll.dll", b"kernel32.dll", b"user32.dll"]
+        self.sys_dlls = [b"ntdll.dll", b"kernel32.dll"]
         self.pe_entry_point = 0
         self.sizeOfStackReserve = 0        
 
-        if self.ql.shellcoder:
-            self.init_dlls.remove(b"ntoskrnl.exe")
-            self.sys_dlls.remove(b"ntoskrnl.exe")
-        else:
+        if not self.ql.shellcoder:
             self.pe = pefile.PE(self.path, fast_load=True)
             self.is_driver = (self.pe.OPTIONAL_HEADER.Subsystem == 1)
+            if self.is_driver:
+                self.init_dlls = [b"ntoskrnl.exe"]
+                self.sys_dlls = [b"ntoskrnl.exe"]
 
         if self.ql.archtype == QL_ARCH.X86:
             self.stack_address = int(self.ql.os.profile.get("OS32", "stack_address"), 16)