Return STATUS_IMAGE_MACHINE_TYPE_MISMATCH in case a 64-bit process tries to map a 32-bit executable

This commit is contained in:
ahm3dgg
2026-01-07 19:50:26 +02:00
parent fdcc7455a1
commit 1ec9816d9a
2 changed files with 7 additions and 0 deletions

View File

@@ -86,6 +86,7 @@ using NTSTATUS = std::uint32_t;
#define STATUS_PORT_NOT_SET ((NTSTATUS)0xC0000353L)
#define STATUS_DEBUGGER_INACTIVE ((NTSTATUS)0xC0000354L)
#define STATUS_IMAGE_NOT_AT_BASE ((NTSTATUS)0x40000003L)
#define STATUS_IMAGE_MACHINE_TYPE_MISMATCH ((NTSTATUS)0x4000000EL)
#define FILE_DEVICE_NETWORK 0x00000012
#define FSCTL_AFD_BASE FILE_DEVICE_NETWORK

View File

@@ -276,6 +276,12 @@ namespace syscalls
base_address.write(binary->image_base);
// Should return STATUS_IMAGE_MACHINE_TYPE_MISMATCH if a 64-bit process tried to map a 32-bit PE.
if (!c.win_emu.process.is_wow64_process && binary->machine == IMAGE_FILE_MACHINE_I386)
{
return STATUS_IMAGE_MACHINE_TYPE_MISMATCH;
}
if (c.win_emu.mod_manager.get_module_load_count_by_path(section_entry->file_name) > 1)
{
return STATUS_IMAGE_NOT_AT_BASE;