Prevent failure when accessing stack

This commit is contained in:
momo5502
2025-01-26 07:30:04 +01:00
parent e34a9e6468
commit 4597f3b6d6
2 changed files with 13 additions and 4 deletions

View File

@@ -92,7 +92,8 @@ void syscall_dispatcher::dispatch(windows_emulator& win_emu)
if (mod != context.ntdll && mod != context.win32u)
{
win_emu.callbacks().inline_syscall(syscall_id, address, mod ? mod->name.c_str() : "<N/A>",
entry->second.name.c_str());
entry->second.name);
win_emu.log.print(color::blue, "Executing inline syscall: %s (0x%X) at 0x%" PRIx64 " (%s)\n",
entry->second.name.c_str(), syscall_id, address, mod ? mod->name.c_str() : "<N/A>");
}
@@ -101,7 +102,10 @@ void syscall_dispatcher::dispatch(windows_emulator& win_emu)
if (mod->is_within(context.previous_ip))
{
const auto rsp = c.emu.read_stack_pointer();
const auto return_address = c.emu.read_memory<uint64_t>(rsp);
uint64_t return_address{};
c.emu.try_read_memory(rsp, &return_address, sizeof(return_address));
const auto* mod_name = context.mod_manager.find_name(return_address);
win_emu.log.print(color::dark_gray,
@@ -111,9 +115,11 @@ void syscall_dispatcher::dispatch(windows_emulator& win_emu)
else
{
const auto* previous_mod = context.mod_manager.find_by_address(context.previous_ip);
win_emu.callbacks().outofline_syscall(syscall_id, address, mod ? mod->name.c_str() : "<N/A>",
entry->second.name.c_str(), context.previous_ip,
entry->second.name, context.previous_ip,
previous_mod ? previous_mod->name.c_str() : "<N/A>");
win_emu.log.print(color::blue,
"Crafted out-of-line syscall: %s (0x%X) at 0x%" PRIx64 " (%s) via 0x%" PRIx64
" (%s)\n",

View File

@@ -960,7 +960,10 @@ void windows_emulator::on_instruction_execution(const uint64_t address)
if (export_entry != binary->address_names.end())
{
const auto rsp = this->emu().read_stack_pointer();
const auto return_address = this->emu().read_memory<uint64_t>(rsp);
uint64_t return_address{};
this->emu().try_read_memory(rsp, &return_address, sizeof(return_address));
const auto* mod_name = this->process().mod_manager.find_name(return_address);
log.print(is_interesting_call ? color::yellow : color::dark_gray,