Implement more efficient export logging

Unicorn hooks are expensive. It seems to iterate all hooks every
time an instruction is executed. Therefore more hooks -> slower execution.

Instead, we'll have one hook. Within that hook we'll check if the address
is within a mapped binary. If so, we then check if it is and export and
log when true. That's far more efficient than checking all hooks every time.
This commit is contained in:
momo5502
2024-09-08 16:08:31 +02:00
parent 9c5b65b103
commit 01b1d422d9
5 changed files with 73 additions and 53 deletions

View File

@@ -14,10 +14,13 @@ using exported_symbols = std::vector<exported_symbol>;
struct mapped_binary
{
std::filesystem::path path{};
std::string name{};
uint64_t image_base{};
uint64_t size_of_image{};
uint64_t entry_point{};
exported_symbols exports{};
std::unordered_map<uint64_t, std::string> export_remap{};
};
struct event
@@ -51,8 +54,10 @@ struct process_context
emulator_object<RTL_USER_PROCESS_PARAMETERS> process_params{};
emulator_object<KUSER_SHARED_DATA> kusd{};
mapped_binary executable{};
mapped_binary ntdll{};
std::map<uint64_t, std::unique_ptr<mapped_binary>> mapped_binaries{};
mapped_binary* executable{};
mapped_binary* ntdll{};
handle_store<handle_types::event, event> events{};
handle_store<handle_types::file, file> files{};