diff --git a/src/windows_emulator/main.cpp b/src/windows_emulator/main.cpp index 3bc6b537..6fd8975b 100644 --- a/src/windows_emulator/main.cpp +++ b/src/windows_emulator/main.cpp @@ -447,14 +447,14 @@ namespace auto context = setup_context(*emu); - context.executable = map_file(*emu, R"(C:\Users\mauri\Desktop\ConsoleApplication6.exe)"); + context.executable = *map_file(*emu, R"(C:\Users\mauri\Desktop\ConsoleApplication6.exe)"); context.peb.access([&](PEB& peb) { peb.ImageBaseAddress = reinterpret_cast(context.executable.image_base); }); - context.ntdll = map_file(*emu, R"(C:\Windows\System32\ntdll.dll)"); + context.ntdll = *map_file(*emu, R"(C:\Windows\System32\ntdll.dll)"); const auto entry1 = find_exported_function(context.ntdll.exports, "LdrInitializeThunk"); const auto entry2 = find_exported_function(context.ntdll.exports, "RtlUserThreadStart"); diff --git a/src/windows_emulator/module_mapper.cpp b/src/windows_emulator/module_mapper.cpp index 8c73da15..a2abed3a 100644 --- a/src/windows_emulator/module_mapper.cpp +++ b/src/windows_emulator/module_mapper.cpp @@ -202,8 +202,13 @@ namespace } } -mapped_binary map_file(x64_emulator& emu, const std::filesystem::path& file) +std::optional map_file(x64_emulator& emu, const std::filesystem::path& file) { const auto data = load_file(file); + if (data.empty()) + { + return {}; + } + return map_module(emu, data, file.generic_string()); } diff --git a/src/windows_emulator/module_mapper.hpp b/src/windows_emulator/module_mapper.hpp index 309ae76c..447ee4a2 100644 --- a/src/windows_emulator/module_mapper.hpp +++ b/src/windows_emulator/module_mapper.hpp @@ -3,4 +3,4 @@ #include "process_context.hpp" #include -mapped_binary map_file(x64_emulator& emu, const std::filesystem::path& file); \ No newline at end of file +std::optional map_file(x64_emulator& emu, const std::filesystem::path& file); \ No newline at end of file diff --git a/src/windows_emulator/syscalls.cpp b/src/windows_emulator/syscalls.cpp index 8992ef85..df61dcbb 100644 --- a/src/windows_emulator/syscalls.cpp +++ b/src/windows_emulator/syscalls.cpp @@ -414,6 +414,7 @@ namespace section_handle.write(index | FILE_BIT); auto status = STATUS_SUCCESS; + std::wstring filename{}; object_attributes.access([&](const OBJECT_ATTRIBUTES& attributes) { if (reinterpret_cast(attributes.RootDirectory) != KNOWN_DLLS_DIRECTORY) @@ -421,10 +422,30 @@ namespace status = STATUS_NOT_SUPPORTED; return; } - auto section = L"C:\\WINDOWS\\System32\\" + read_unicode_string(c.emu, attributes.ObjectName); - c.proc.files.try_emplace(index, std::move(section)); + + filename = read_unicode_string(c.emu, attributes.ObjectName); + if (filename.starts_with(L"api-ms-")) + { + filename = L"C:\\WINDOWS\\System32\\downlevel\\" + filename; + } + else + { + filename = L"C:\\WINDOWS\\System32\\" + filename; + } }); + if (status != STATUS_SUCCESS) + { + return status; + } + + if (std::filesystem::exists(filename)) + { + return STATUS_FILE_INVALID; + } + + c.proc.files.try_emplace(index, std::move(filename)); + return status; } @@ -454,13 +475,17 @@ namespace const auto& section_name = section_entry->second; const auto binary = map_file(c.emu, section_name); + if (!binary.has_value()) + { + return STATUS_FILE_INVALID; + } if (view_size.value()) { - view_size.write(binary.size_of_image); + view_size.write(binary->size_of_image); } - base_address.write(binary.image_base); + base_address.write(binary->image_base); return STATUS_SUCCESS; }