Extract callback handling into a separate function

This commit is contained in:
66hh
2025-12-28 19:51:45 +08:00
parent 41b86f655b
commit 418c5abf49
2 changed files with 20 additions and 12 deletions

View File

@@ -102,18 +102,7 @@ void syscall_dispatcher::dispatch(windows_emulator& win_emu)
entry->second.handler(c);
if (context.instrumentation_callback != 0 && entry->second.name != "NtContinue")
{
uint64_t rip_old = emu.reg<uint64_t>(x86_register::rip);
// The increase in RIP caused by executing the syscall here has not yet occurred.
// If RIP is set directly, it will lead to an incorrect address, so the length of
// the syscall instruction needs to be subtracted.
emu.reg<uint64_t>(x86_register::rip, context.instrumentation_callback - 2);
emu.reg<uint64_t>(x86_register::r10, rip_old);
}
dispatch_callback(win_emu, entry->second.name);
}
catch (std::exception& e)
{
@@ -129,6 +118,24 @@ void syscall_dispatcher::dispatch(windows_emulator& win_emu)
}
}
void syscall_dispatcher::dispatch_callback(windows_emulator& win_emu, std::string syscall_name)
{
auto& emu = win_emu.emu();
auto& context = win_emu.process;
if (context.instrumentation_callback != 0 && syscall_name != "NtContinue")
{
uint64_t rip_old = emu.reg<uint64_t>(x86_register::rip);
// The increase in RIP caused by executing the syscall here has not yet occurred.
// If RIP is set directly, it will lead to an incorrect address, so the length of
// the syscall instruction needs to be subtracted.
emu.reg<uint64_t>(x86_register::rip, context.instrumentation_callback - 2);
emu.reg<uint64_t>(x86_register::r10, rip_old);
}
}
syscall_dispatcher::syscall_dispatcher(const exported_symbols& ntdll_exports, const std::span<const std::byte> ntdll_data,
const exported_symbols& win32u_exports, const std::span<const std::byte> win32u_data)
{

View File

@@ -21,6 +21,7 @@ class syscall_dispatcher
std::span<const std::byte> win32u_data);
void dispatch(windows_emulator& win_emu);
void dispatch_callback(windows_emulator& win_emu, std::string syscall_name);
void serialize(utils::buffer_serializer& buffer) const;
void deserialize(utils::buffer_deserializer& buffer);