Serialize and Deserialize KnownDLLs Tables

This commit is contained in:
ahm3dgg
2026-01-08 00:36:53 +02:00
parent bb98f2cee3
commit 06cc62042c

View File

@@ -229,13 +229,10 @@ namespace
}
template <typename T>
void create_known_dlls_section_objects(std::unordered_map<std::u16string, section>& knowndlls_section_objects,
registry_manager& registry, const apiset::container& apiset_container,
void create_known_dlls_section_objects(knowndlls_map& knowndlls_section_objects,
std::unordered_map<std::u16string, std::u16string>& apiset, registry_manager& registry,
const file_system& file_system, bool is_wow64)
{
const auto* api_set_data = reinterpret_cast<const API_SET_NAMESPACE*>(apiset_container.data.data());
auto apiset = get_apiset_namespace_table(api_set_data);
windows_path system_root_path;
std::filesystem::path local_system_root_path;
@@ -574,8 +571,10 @@ void process_context::setup(x86_64_emulator& emu, memory_manager& memory, regist
}
}
create_known_dlls_section_objects<uint32_t>(this->knowndlls32_sections, registry, apiset_container, file_system, true);
create_known_dlls_section_objects<uint64_t>(this->knowndlls64_sections, registry, apiset_container, file_system, false);
const auto* api_set_data = reinterpret_cast<const API_SET_NAMESPACE*>(apiset_container.data.data());
auto apiset = get_apiset_namespace_table(api_set_data);
create_known_dlls_section_objects<uint32_t>(this->knowndlls32_sections, apiset, registry, file_system, true);
create_known_dlls_section_objects<uint64_t>(this->knowndlls64_sections, apiset, registry, file_system, false);
this->ntdll_image_base = ntdll.image_base;
this->ldr_initialize_thunk = ntdll.find_export("LdrInitializeThunk");
@@ -652,6 +651,8 @@ void process_context::serialize(utils::buffer_serializer& buffer) const
buffer.write(this->timers);
buffer.write(this->registry_keys);
buffer.write_map(this->atoms);
buffer.write_map(this->knowndlls32_sections);
buffer.write_map(this->knowndlls64_sections);
buffer.write(this->last_extended_params_numa_node);
buffer.write(this->last_extended_params_attributes);
@@ -701,6 +702,8 @@ void process_context::deserialize(utils::buffer_deserializer& buffer)
buffer.read(this->timers);
buffer.read(this->registry_keys);
buffer.read_map(this->atoms);
buffer.read_map(this->knowndlls32_sections);
buffer.read_map(this->knowndlls64_sections);
buffer.read(this->last_extended_params_numa_node);
buffer.read(this->last_extended_params_attributes);