diff --git a/src/windows-emulator/syscall_dispatcher.cpp b/src/windows-emulator/syscall_dispatcher.cpp index 4aabed1c..21284ca5 100644 --- a/src/windows-emulator/syscall_dispatcher.cpp +++ b/src/windows-emulator/syscall_dispatcher.cpp @@ -102,18 +102,7 @@ void syscall_dispatcher::dispatch(windows_emulator& win_emu) entry->second.handler(c); - if (context.instrumentation_callback != 0 && entry->second.name != "NtContinue") - { - uint64_t rip_old = emu.reg(x86_register::rip); - - // The increase in RIP caused by executing the syscall here has not yet occurred. - // If RIP is set directly, it will lead to an incorrect address, so the length of - // the syscall instruction needs to be subtracted. - emu.reg(x86_register::rip, context.instrumentation_callback - 2); - - emu.reg(x86_register::r10, rip_old); - } - + dispatch_callback(win_emu, entry->second.name); } catch (std::exception& e) { @@ -129,6 +118,24 @@ void syscall_dispatcher::dispatch(windows_emulator& win_emu) } } +void syscall_dispatcher::dispatch_callback(windows_emulator& win_emu, std::string syscall_name) +{ + auto& emu = win_emu.emu(); + auto& context = win_emu.process; + + if (context.instrumentation_callback != 0 && syscall_name != "NtContinue") + { + uint64_t rip_old = emu.reg(x86_register::rip); + + // The increase in RIP caused by executing the syscall here has not yet occurred. + // If RIP is set directly, it will lead to an incorrect address, so the length of + // the syscall instruction needs to be subtracted. + emu.reg(x86_register::rip, context.instrumentation_callback - 2); + + emu.reg(x86_register::r10, rip_old); + } +} + syscall_dispatcher::syscall_dispatcher(const exported_symbols& ntdll_exports, const std::span ntdll_data, const exported_symbols& win32u_exports, const std::span win32u_data) { diff --git a/src/windows-emulator/syscall_dispatcher.hpp b/src/windows-emulator/syscall_dispatcher.hpp index d8c80374..f80f947c 100644 --- a/src/windows-emulator/syscall_dispatcher.hpp +++ b/src/windows-emulator/syscall_dispatcher.hpp @@ -21,6 +21,7 @@ class syscall_dispatcher std::span win32u_data); void dispatch(windows_emulator& win_emu); + void dispatch_callback(windows_emulator& win_emu, std::string syscall_name); void serialize(utils::buffer_serializer& buffer) const; void deserialize(utils::buffer_deserializer& buffer);