Lightemerald/windows-user-space-emulator
2
0
Fork 0
mirror of https://github.com/momo5502/emulator.git synced 2026-01-11 08:36:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

partial process_context abstraction

Browse Source
This commit is contained in:
robert-yates
2025-04-26 18:00:02 +02:00
parent 60931da92a
commit 2b76880cf1
11 changed files with 87 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/fuzzer/main.cpp
View File

@@ -20,7 +20,7 @@ namespace
win_emu.log.disable_output(true); win_emu.log.disable_output(true);
win_emu.start(); win_emu.start();
if (win_emu.process.exception_rip.has_value()) if (win_emu.process.exception_ip.has_value())
{ {
throw std::runtime_error("Exception!"); throw std::runtime_error("Exception!");
} }

8
src/windows-emulator/emulator_thread.cpp
View File

@@ -29,7 +29,7 @@ namespace
emu.reg(x86_register::rsp, stack_end); emu.reg(x86_register::rsp, stack_end);
} }
bool is_object_signaled(process_context& c, const handle h, const uint32_t current_thread_id) bool is_object_signaled(process_context64& c, const handle h, const uint32_t current_thread_id)
{ {
const auto type = h.value.type; const auto type = h.value.type;
@@ -83,7 +83,7 @@ namespace
} }
} }
emulator_thread::emulator_thread(memory_manager& memory, const process_context& context, const uint64_t start_address, emulator_thread::emulator_thread(memory_manager& memory, const process_context64& context, const uint64_t start_address,
const uint64_t argument, const uint64_t stack_size, const bool suspended, const uint64_t argument, const uint64_t stack_size, const bool suspended,
const uint32_t id) const uint32_t id)
: memory_ptr(&memory), : memory_ptr(&memory),
@@ -139,7 +139,7 @@ bool emulator_thread::is_terminated() const
return this->exit_status.has_value(); return this->exit_status.has_value();
} }
bool emulator_thread::is_thread_ready(process_context& process, utils::clock& clock) bool emulator_thread::is_thread_ready(process_context64& process, utils::clock& clock)
{ {
if (this->is_terminated() || this->suspended > 0) if (this->is_terminated() || this->suspended > 0)
{ {
@@ -208,7 +208,7 @@ bool emulator_thread::is_thread_ready(process_context& process, utils::clock& cl
return true; return true;
} }
void emulator_thread::setup_registers(x86_64_emulator& emu, const process_context& context) const void emulator_thread::setup_registers(x86_64_emulator& emu, const process_context64& context) const
{ {
if (!this->gs_segment) if (!this->gs_segment)
{ {

10
src/windows-emulator/emulator_thread.hpp
View File

@@ -6,7 +6,7 @@
#include <utils/moved_marker.hpp> #include <utils/moved_marker.hpp>
struct process_context; struct process_context64;
struct pending_apc struct pending_apc
{ {
@@ -48,7 +48,7 @@ class emulator_thread : public ref_counted_object
{ {
} }
emulator_thread(memory_manager& memory, const process_context& context, uint64_t start_address, uint64_t argument, emulator_thread(memory_manager& memory, const process_context64& context, uint64_t start_address, uint64_t argument,
uint64_t stack_size, bool suspended, uint32_t id); uint64_t stack_size, bool suspended, uint32_t id);
emulator_thread(const emulator_thread&) = delete; emulator_thread(const emulator_thread&) = delete;
@@ -103,7 +103,7 @@ class emulator_thread : public ref_counted_object
bool is_terminated() const; bool is_terminated() const;
bool is_thread_ready(process_context& process, utils::clock& clock); bool is_thread_ready(process_context64& process, utils::clock& clock);
void save(x86_64_emulator& emu) void save(x86_64_emulator& emu)
{ {
@@ -115,7 +115,7 @@ class emulator_thread : public ref_counted_object
emu.restore_registers(this->last_registers); emu.restore_registers(this->last_registers);
} }
void setup_if_necessary(x86_64_emulator& emu, const process_context& context) void setup_if_necessary(x86_64_emulator& emu, const process_context64& context)
{ {
if (!this->executed_instructions) if (!this->executed_instructions)
{ {
@@ -211,7 +211,7 @@ class emulator_thread : public ref_counted_object
} }
private: private:
void setup_registers(x86_64_emulator& emu, const process_context& context) const; void setup_registers(x86_64_emulator& emu, const process_context64& context) const;
void release() void release()
{ {

12
src/windows-emulator/exception_dispatch.cpp
View File

@@ -140,7 +140,7 @@ namespace
} }
} }
void dispatch_exception(x86_64_emulator& emu, const process_context& proc, const DWORD status, void dispatch_exception(x86_64_emulator& emu, const process_context64& proc, const DWORD status,
const std::vector<EmulatorTraits<Emu64>::ULONG_PTR>& parameters) const std::vector<EmulatorTraits<Emu64>::ULONG_PTR>& parameters)
{ {
CONTEXT64 ctx{}; CONTEXT64 ctx{};
@@ -172,7 +172,7 @@ void dispatch_exception(x86_64_emulator& emu, const process_context& proc, const
dispatch_exception_pointers(emu, proc.ki_user_exception_dispatcher, pointers); dispatch_exception_pointers(emu, proc.ki_user_exception_dispatcher, pointers);
} }
void dispatch_access_violation(x86_64_emulator& emu, const process_context& proc, const uint64_t address, void dispatch_access_violation(x86_64_emulator& emu, const process_context64& proc, const uint64_t address,
const memory_operation operation) const memory_operation operation)
{ {
dispatch_exception(emu, proc, STATUS_ACCESS_VIOLATION, dispatch_exception(emu, proc, STATUS_ACCESS_VIOLATION,
@@ -182,22 +182,22 @@ void dispatch_access_violation(x86_64_emulator& emu, const process_context& proc
}); });
} }
void dispatch_illegal_instruction_violation(x86_64_emulator& emu, const process_context& proc) void dispatch_illegal_instruction_violation(x86_64_emulator& emu, const process_context64& proc)
{ {
dispatch_exception(emu, proc, STATUS_ILLEGAL_INSTRUCTION, {}); dispatch_exception(emu, proc, STATUS_ILLEGAL_INSTRUCTION, {});
} }
void dispatch_integer_division_by_zero(x86_64_emulator& emu, const process_context& proc) void dispatch_integer_division_by_zero(x86_64_emulator& emu, const process_context64& proc)
{ {
dispatch_exception(emu, proc, STATUS_INTEGER_DIVIDE_BY_ZERO, {}); dispatch_exception(emu, proc, STATUS_INTEGER_DIVIDE_BY_ZERO, {});
} }
void dispatch_single_step(x86_64_emulator& emu, const process_context& proc) void dispatch_single_step(x86_64_emulator& emu, const process_context64& proc)
{ {
dispatch_exception(emu, proc, STATUS_SINGLE_STEP, {}); dispatch_exception(emu, proc, STATUS_SINGLE_STEP, {});
} }
void dispatch_breakpoint(x86_64_emulator& emu, const process_context& proc) void dispatch_breakpoint(x86_64_emulator& emu, const process_context64& proc)
{ {
dispatch_exception(emu, proc, STATUS_BREAKPOINT, {}); dispatch_exception(emu, proc, STATUS_BREAKPOINT, {});
} }

16
src/windows-emulator/exception_dispatch.hpp
View File

@@ -5,21 +5,21 @@
#include <platform/traits.hpp> #include <platform/traits.hpp>
#include <platform/primitives.hpp> #include <platform/primitives.hpp>
struct process_context; struct process_context64;
void dispatch_exception(x86_64_emulator& emu, const process_context& proc, DWORD status, void dispatch_exception(x86_64_emulator& emu, const process_context64& proc, DWORD status,
const std::vector<EmulatorTraits<Emu64>::ULONG_PTR>& parameters); const std::vector<EmulatorTraits<Emu64>::ULONG_PTR>& parameters);
template <typename T> template <typename T>
requires(std::is_integral_v<T> && !std::is_same_v<T, DWORD>) requires(std::is_integral_v<T> && !std::is_same_v<T, DWORD>)
void dispatch_exception(x86_64_emulator& emu, const process_context& proc, const T status, void dispatch_exception(x86_64_emulator& emu, const process_context64& proc, const T status,
const std::vector<EmulatorTraits<Emu64>::ULONG_PTR>& parameters) const std::vector<EmulatorTraits<Emu64>::ULONG_PTR>& parameters)
{ {
dispatch_exception(emu, proc, static_cast<DWORD>(status), parameters); dispatch_exception(emu, proc, static_cast<DWORD>(status), parameters);
} }
void dispatch_access_violation(x86_64_emulator& emu, const process_context& proc, uint64_t address, void dispatch_access_violation(x86_64_emulator& emu, const process_context64& proc, uint64_t address,
memory_operation operation); memory_operation operation);
void dispatch_illegal_instruction_violation(x86_64_emulator& emu, const process_context& proc); void dispatch_illegal_instruction_violation(x86_64_emulator& emu, const process_context64& proc);
void dispatch_integer_division_by_zero(x86_64_emulator& emu, const process_context& proc); void dispatch_integer_division_by_zero(x86_64_emulator& emu, const process_context64& proc);
void dispatch_single_step(x86_64_emulator& emu, const process_context& proc); void dispatch_single_step(x86_64_emulator& emu, const process_context64& proc);
void dispatch_breakpoint(x86_64_emulator& emu, const process_context& proc); void dispatch_breakpoint(x86_64_emulator& emu, const process_context64& proc);

24
src/windows-emulator/process_context.cpp
View File

@@ -27,7 +27,7 @@ namespace
} }
} }
void process_context::setup(x86_64_emulator& emu, memory_manager& memory, const application_settings& app_settings, void process_context64::setup(x86_64_emulator& emu, memory_manager& memory, const application_settings& app_settings,
const mapped_module& executable, const mapped_module& ntdll, const mapped_module& executable, const mapped_module& ntdll,
const apiset::container& apiset_container) const apiset::container& apiset_container)
{ {
@@ -125,7 +125,7 @@ void process_context::setup(x86_64_emulator& emu, memory_manager& memory, const
this->default_register_set = emu.save_registers(); this->default_register_set = emu.save_registers();
} }
void process_context::serialize(utils::buffer_serializer& buffer) const void process_context64::serialize(utils::buffer_serializer& buffer) const
{ {
buffer.write(this->current_ip); buffer.write(this->current_ip);
buffer.write(this->previous_ip); buffer.write(this->previous_ip);
@@ -133,7 +133,7 @@ void process_context::serialize(utils::buffer_serializer& buffer) const
buffer.write(this->shared_section_size); buffer.write(this->shared_section_size);
buffer.write(this->dbwin_buffer); buffer.write(this->dbwin_buffer);
buffer.write(this->dbwin_buffer_size); buffer.write(this->dbwin_buffer_size);
buffer.write_optional(this->exception_rip); buffer.write_optional(this->exception_ip);
buffer.write_optional(this->exit_status); buffer.write_optional(this->exit_status);
buffer.write(this->base_allocator); buffer.write(this->base_allocator);
buffer.write(this->peb); buffer.write(this->peb);
@@ -163,7 +163,7 @@ void process_context::serialize(utils::buffer_serializer& buffer) const
buffer.write(this->threads.find_handle(this->active_thread).bits); buffer.write(this->threads.find_handle(this->active_thread).bits);
} }
void process_context::deserialize(utils::buffer_deserializer& buffer) void process_context64::deserialize(utils::buffer_deserializer& buffer)
{ {
buffer.read(this->current_ip); buffer.read(this->current_ip);
buffer.read(this->previous_ip); buffer.read(this->previous_ip);
@@ -171,7 +171,7 @@ void process_context::deserialize(utils::buffer_deserializer& buffer)
buffer.read(this->shared_section_size); buffer.read(this->shared_section_size);
buffer.read(this->dbwin_buffer); buffer.read(this->dbwin_buffer);
buffer.read(this->dbwin_buffer_size); buffer.read(this->dbwin_buffer_size);
buffer.read_optional(this->exception_rip); buffer.read_optional(this->exception_ip);
buffer.read_optional(this->exit_status); buffer.read_optional(this->exit_status);
buffer.read(this->base_allocator); buffer.read(this->base_allocator);
buffer.read(this->peb); buffer.read(this->peb);
@@ -207,7 +207,7 @@ void process_context::deserialize(utils::buffer_deserializer& buffer)
this->active_thread = this->threads.get(buffer.read<uint64_t>()); this->active_thread = this->threads.get(buffer.read<uint64_t>());
} }
generic_handle_store* process_context::get_handle_store(const handle handle) generic_handle_store* process_context64::get_handle_store(const handle handle)
{ {
switch (handle.value.type) switch (handle.value.type)
{ {
@@ -234,7 +234,7 @@ generic_handle_store* process_context::get_handle_store(const handle handle)
} }
} }
handle process_context::create_thread(memory_manager& memory, const uint64_t start_address, const uint64_t argument, handle process_context64::create_thread(memory_manager& memory, const uint64_t start_address, const uint64_t argument,
const uint64_t stack_size, const bool suspended) const uint64_t stack_size, const bool suspended)
{ {
emulator_thread t{memory, *this, start_address, argument, stack_size, suspended, ++this->spawned_thread_count}; emulator_thread t{memory, *this, start_address, argument, stack_size, suspended, ++this->spawned_thread_count};
@@ -243,7 +243,9 @@ handle process_context::create_thread(memory_manager& memory, const uint64_t sta
return h; return h;
} }
uint16_t process_context::add_or_find_atom(std::u16string name) // --[ process_context_common ]-----------------------------------------------------------------------------------------
uint16_t process_context_common::add_or_find_atom(std::u16string name)
{ {
uint16_t index = 0; uint16_t index = 0;
if (!atoms.empty()) if (!atoms.empty())
@@ -286,7 +288,7 @@ uint16_t process_context::add_or_find_atom(std::u16string name)
return index; return index;
} }
bool process_context::delete_atom(const std::u16string& name) bool process_context_common::delete_atom(const std::u16string& name)
{ {
for (auto it = atoms.begin(); it != atoms.end(); ++it) for (auto it = atoms.begin(); it != atoms.end(); ++it)
{ {
@@ -303,7 +305,7 @@ bool process_context::delete_atom(const std::u16string& name)
return false; return false;
} }
bool process_context::delete_atom(uint16_t atom_id) bool process_context_common::delete_atom(uint16_t atom_id)
{ {
const auto it = atoms.find(atom_id); const auto it = atoms.find(atom_id);
if (it == atoms.end()) if (it == atoms.end())
@@ -319,7 +321,7 @@ bool process_context::delete_atom(uint16_t atom_id)
return true; return true;
} }
const std::u16string* process_context::get_atom_name(uint16_t atom_id) const const std::u16string* process_context_common::get_atom_name(uint16_t atom_id) const
{ {
const auto it = atoms.find(atom_id); const auto it = atoms.find(atom_id);
if (it == atoms.end()) if (it == atoms.end())

73
src/windows-emulator/process_context.hpp
View File

@@ -28,7 +28,7 @@
struct emulator_settings; struct emulator_settings;
struct application_settings; struct application_settings;
struct process_context struct process_context_common
{ {
struct callbacks struct callbacks
{ {
@@ -50,7 +50,44 @@ struct process_context
atom_entry() = default; atom_entry() = default;
}; };
process_context(x86_64_emulator& emu, memory_manager& memory, utils::clock& clock, callbacks& cb) std::map<uint16_t, atom_entry> atoms{};
uint16_t add_or_find_atom(std::u16string name);
bool delete_atom(const std::u16string& name);
bool delete_atom(uint16_t atom_id);
const std::u16string* get_atom_name(uint16_t atom_id) const;
uint64_t current_ip{0};
uint64_t previous_ip{0};
uint64_t shared_section_address{0};
uint64_t shared_section_size{0};
uint64_t dbwin_buffer{0};
uint64_t dbwin_buffer_size{0};
std::optional<NTSTATUS> exit_status{};
uint64_t ntdll_image_base{};
uint64_t ldr_initialize_thunk{};
uint64_t rtl_user_thread_start{};
uint64_t ki_user_apc_dispatcher{};
uint64_t ki_user_exception_dispatcher{};
std::optional<uint64_t> exception_ip{};
handle_store<handle_types::event, event> events{};
handle_store<handle_types::file, file> files{};
handle_store<handle_types::section, section> sections{};
handle_store<handle_types::semaphore, semaphore> semaphores{};
handle_store<handle_types::port, port> ports{};
handle_store<handle_types::mutant, mutant> mutants{};
handle_store<handle_types::registry, registry_key, 2> registry_keys{};
std::vector<std::byte> default_register_set{};
};
struct process_context64 final : process_context_common
{
process_context64(x86_64_emulator& emu, memory_manager& memory, utils::clock& clock, callbacks& cb)
: callbacks_(&cb), : callbacks_(&cb),
base_allocator(emu), base_allocator(emu),
peb(emu), peb(emu),
@@ -65,11 +102,6 @@ struct process_context
handle create_thread(memory_manager& memory, uint64_t start_address, uint64_t argument, uint64_t stack_size, handle create_thread(memory_manager& memory, uint64_t start_address, uint64_t argument, uint64_t stack_size,
bool suspended); bool suspended);
uint16_t add_or_find_atom(std::u16string name);
bool delete_atom(const std::u16string& name);
bool delete_atom(uint16_t atom_id);
const std::u16string* get_atom_name(uint16_t atom_id) const;
void serialize(utils::buffer_serializer& buffer) const; void serialize(utils::buffer_serializer& buffer) const;
void deserialize(utils::buffer_deserializer& buffer); void deserialize(utils::buffer_deserializer& buffer);
@@ -77,40 +109,13 @@ struct process_context
callbacks* callbacks_{}; callbacks* callbacks_{};
uint64_t current_ip{0};
uint64_t previous_ip{0};
uint64_t shared_section_address{0};
uint64_t shared_section_size{0};
uint64_t dbwin_buffer{0};
uint64_t dbwin_buffer_size{0};
std::optional<uint64_t> exception_rip{};
std::optional<NTSTATUS> exit_status{};
emulator_allocator base_allocator; emulator_allocator base_allocator;
emulator_object<PEB64> peb; emulator_object<PEB64> peb;
emulator_object<RTL_USER_PROCESS_PARAMETERS64> process_params; emulator_object<RTL_USER_PROCESS_PARAMETERS64> process_params;
kusd_mmio kusd; kusd_mmio kusd;
uint64_t ntdll_image_base{};
uint64_t ldr_initialize_thunk{};
uint64_t rtl_user_thread_start{};
uint64_t ki_user_apc_dispatcher{};
uint64_t ki_user_exception_dispatcher{};
handle_store<handle_types::event, event> events{};
handle_store<handle_types::file, file> files{};
handle_store<handle_types::section, section> sections{};
handle_store<handle_types::device, io_device_container> devices{}; handle_store<handle_types::device, io_device_container> devices{};
handle_store<handle_types::semaphore, semaphore> semaphores{};
handle_store<handle_types::port, port> ports{};
handle_store<handle_types::mutant, mutant> mutants{};
handle_store<handle_types::registry, registry_key, 2> registry_keys{};
std::map<uint16_t, atom_entry> atoms{};
std::vector<std::byte> default_register_set{};
uint32_t spawned_thread_count{0}; uint32_t spawned_thread_count{0};
handle_store<handle_types::thread, emulator_thread> threads{}; handle_store<handle_types::thread, emulator_thread> threads{};

2
src/windows-emulator/syscall_utils.hpp
View File

@@ -8,7 +8,7 @@ struct syscall_context
{ {
windows_emulator& win_emu; windows_emulator& win_emu;
x86_64_emulator& emu; x86_64_emulator& emu;
process_context& proc; process_context64& proc;
mutable bool write_status{true}; mutable bool write_status{true};
mutable bool retrigger_syscall{false}; mutable bool retrigger_syscall{false};
}; };

4
src/windows-emulator/syscalls/exception.cpp
View File

@@ -18,7 +18,7 @@ namespace syscalls
} }
c.proc.exit_status = error_status; c.proc.exit_status = error_status;
c.proc.exception_rip = c.emu.read_instruction_pointer(); c.proc.exception_ip = c.emu.read_instruction_pointer();
c.emu.stop(); c.emu.stop();
return STATUS_SUCCESS; return STATUS_SUCCESS;
@@ -36,7 +36,7 @@ namespace syscalls
return STATUS_NOT_SUPPORTED; return STATUS_NOT_SUPPORTED;
} }
c.proc.exception_rip = thread_context.read().Rip; c.proc.exception_ip = thread_context.read().Rip;
c.emu.stop(); c.emu.stop();
return STATUS_SUCCESS; return STATUS_SUCCESS;

6
src/windows-emulator/windows_emulator.cpp
View File

@@ -68,7 +68,7 @@ namespace
} }
} }
emulator_thread* get_thread_by_id(process_context& process, const uint32_t id) emulator_thread* get_thread_by_id(process_context64& process, const uint32_t id)
{ {
for (auto& t : process.threads | std::views::values) for (auto& t : process.threads | std::views::values)
{ {
@@ -540,7 +540,7 @@ void windows_emulator::setup_hooks()
if (this->fuzzing || true) // TODO: Fix if (this->fuzzing || true) // TODO: Fix
{ {
this->process.exception_rip = rip; this->process.exception_ip = rip;
this->emu().stop(); this->emu().stop();
} }
}); });
@@ -564,7 +564,7 @@ void windows_emulator::setup_hooks()
if (this->fuzzing) if (this->fuzzing)
{ {
this->process.exception_rip = ip; this->process.exception_ip = ip;
this->emu().stop(); this->emu().stop();
return memory_violation_continuation::stop; return memory_violation_continuation::stop;
} }

4
src/windows-emulator/windows_emulator.hpp
View File

@@ -15,7 +15,7 @@
std::unique_ptr<x86_64_emulator> create_default_x86_64_emulator(); std::unique_ptr<x86_64_emulator> create_default_x86_64_emulator();
struct emulator_callbacks : module_manager::callbacks, process_context::callbacks struct emulator_callbacks : module_manager::callbacks, process_context64::callbacks
{ {
utils::optional_function<instruction_hook_continuation(uint32_t syscall_id, x86_64_emulator::pointer_type address, utils::optional_function<instruction_hook_continuation(uint32_t syscall_id, x86_64_emulator::pointer_type address,
std::string_view mod_name, std::string_view syscall_name)> std::string_view mod_name, std::string_view syscall_name)>
@@ -69,7 +69,7 @@ class windows_emulator
memory_manager memory; memory_manager memory;
registry_manager registry{}; registry_manager registry{};
module_manager mod_manager; module_manager mod_manager;
process_context process; process_context64 process;
syscall_dispatcher dispatcher; syscall_dispatcher dispatcher;
windows_emulator(const emulator_settings& settings = {}, emulator_callbacks callbacks = {}, windows_emulator(const emulator_settings& settings = {}, emulator_callbacks callbacks = {},