Comprehensive WOW64 subsystem implementation (#555)

# Major Features Implemented
**Core WOW64 Architecture**
1. Full TEB, PEB, and Windows structure implementations for 32-bit
processes
2. Proper thread context switching with 32-bit stack allocation
3. Configurable memory allocation with 32-bit/64-bit address space
handling
4. Automatic WOW64 process identification and handling
5. Heaven's Gate Implementation for handling exceptions

**Enhanced Emulation Features**
1. Fixed GDT setup and segment management for WOW64
2. Multi-architecture PE loading with proper import resolution
3. Segment-aware disassembly with WOW64 debugging capabilities

**Testing & Validation**
**32-bit Test Sample**: Minimal "hello" executable with full ASM source

# TODO
Needs more testing, currently in very early stages.
This commit is contained in:
Maurice Heumann
2025-10-21 20:13:01 +02:00
committed by GitHub
51 changed files with 3772 additions and 283 deletions

View File

@@ -868,6 +868,28 @@ namespace syscalls
const auto attributes = object_attributes.read();
auto filename = read_unicode_string(c.emu, attributes.ObjectName);
// Check for console device paths
// Convert to uppercase for case-insensitive comparison
std::u16string filename_upper = filename;
std::transform(filename_upper.begin(), filename_upper.end(), filename_upper.begin(), ::towupper);
// Handle console output device
if (filename_upper == u"\\??\\CONOUT$" || filename_upper == u"\\DEVICE\\CONOUT$" || filename_upper == u"CONOUT$" ||
filename_upper == u"\\??\\CON" || filename_upper == u"\\DEVICE\\CONSOLE" || filename_upper == u"CON")
{
c.win_emu.callbacks.on_generic_access("Opening console output", filename);
file_handle.write(STDOUT_HANDLE);
return STATUS_SUCCESS;
}
// Handle console input device
if (filename_upper == u"\\??\\CONIN$" || filename_upper == u"\\DEVICE\\CONIN$" || filename_upper == u"CONIN$")
{
c.win_emu.callbacks.on_generic_access("Opening console input", filename);
file_handle.write(STDIN_HANDLE);
return STATUS_SUCCESS;
}
if (is_named_pipe_path(filename))
{
return handle_named_pipe_create(c, file_handle, filename, attributes, desired_access);
@@ -1106,6 +1128,12 @@ namespace syscalls
return STATUS_SUCCESS;
}
if (object_name == u"\\KnownDlls32")
{
directory_handle.write(KNOWN_DLLS32_DIRECTORY);
return STATUS_SUCCESS;
}
if (object_name == u"\\Sessions\\1\\BaseNamedObjects")
{
directory_handle.write(BASE_NAMED_OBJECTS_DIRECTORY);
@@ -1164,6 +1192,29 @@ namespace syscalls
return too_small ? STATUS_BUFFER_TOO_SMALL : STATUS_SUCCESS;
}
if (link_handle == KNOWN_DLLS32_SYMLINK)
{
constexpr std::u16string_view syswow64 = u"C:\\WINDOWS\\SysWOW64";
constexpr auto str_length = syswow64.size() * 2;
constexpr auto max_length = str_length + 2;
returned_length.write(max_length);
bool too_small = false;
link_target.access([&](UNICODE_STRING<EmulatorTraits<Emu64>>& str) {
if (str.MaximumLength < max_length)
{
too_small = true;
return;
}
str.Length = str_length;
c.emu.write_memory(str.Buffer, syswow64.data(), max_length);
});
return too_small ? STATUS_BUFFER_TOO_SMALL : STATUS_SUCCESS;
}
return STATUS_NOT_SUPPORTED;
}