diff --git a/src/common/platform/status.hpp b/src/common/platform/status.hpp index 80663621..935cb406 100644 --- a/src/common/platform/status.hpp +++ b/src/common/platform/status.hpp @@ -86,6 +86,7 @@ using NTSTATUS = std::uint32_t; #define STATUS_PORT_NOT_SET ((NTSTATUS)0xC0000353L) #define STATUS_DEBUGGER_INACTIVE ((NTSTATUS)0xC0000354L) #define STATUS_IMAGE_NOT_AT_BASE ((NTSTATUS)0x40000003L) +#define STATUS_IMAGE_MACHINE_TYPE_MISMATCH ((NTSTATUS)0x4000000EL) #define FILE_DEVICE_NETWORK 0x00000012 #define FSCTL_AFD_BASE FILE_DEVICE_NETWORK diff --git a/src/windows-emulator/syscalls/section.cpp b/src/windows-emulator/syscalls/section.cpp index 786d3518..26659907 100644 --- a/src/windows-emulator/syscalls/section.cpp +++ b/src/windows-emulator/syscalls/section.cpp @@ -276,6 +276,12 @@ namespace syscalls base_address.write(binary->image_base); + // Should return STATUS_IMAGE_MACHINE_TYPE_MISMATCH if a 64-bit process tried to map a 32-bit PE. + if (!c.win_emu.process.is_wow64_process && binary->machine == IMAGE_FILE_MACHINE_I386) + { + return STATUS_IMAGE_MACHINE_TYPE_MISMATCH; + } + if (c.win_emu.mod_manager.get_module_load_count_by_path(section_entry->file_name) > 1) { return STATUS_IMAGE_NOT_AT_BASE;