From 4597f3b6d6c7e101785add147730e63d78032ebe Mon Sep 17 00:00:00 2001 From: momo5502 Date: Sun, 26 Jan 2025 07:30:04 +0100 Subject: [PATCH] Prevent failure when accessing stack --- src/windows-emulator/syscall_dispatcher.cpp | 12 +++++++++--- src/windows-emulator/windows_emulator.cpp | 5 ++++- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/src/windows-emulator/syscall_dispatcher.cpp b/src/windows-emulator/syscall_dispatcher.cpp index 1ed7581c..810268ce 100644 --- a/src/windows-emulator/syscall_dispatcher.cpp +++ b/src/windows-emulator/syscall_dispatcher.cpp @@ -92,7 +92,8 @@ void syscall_dispatcher::dispatch(windows_emulator& win_emu) if (mod != context.ntdll && mod != context.win32u) { win_emu.callbacks().inline_syscall(syscall_id, address, mod ? mod->name.c_str() : "", - entry->second.name.c_str()); + entry->second.name); + win_emu.log.print(color::blue, "Executing inline syscall: %s (0x%X) at 0x%" PRIx64 " (%s)\n", entry->second.name.c_str(), syscall_id, address, mod ? mod->name.c_str() : ""); } @@ -101,7 +102,10 @@ void syscall_dispatcher::dispatch(windows_emulator& win_emu) if (mod->is_within(context.previous_ip)) { const auto rsp = c.emu.read_stack_pointer(); - const auto return_address = c.emu.read_memory(rsp); + + uint64_t return_address{}; + c.emu.try_read_memory(rsp, &return_address, sizeof(return_address)); + const auto* mod_name = context.mod_manager.find_name(return_address); win_emu.log.print(color::dark_gray, @@ -111,9 +115,11 @@ void syscall_dispatcher::dispatch(windows_emulator& win_emu) else { const auto* previous_mod = context.mod_manager.find_by_address(context.previous_ip); + win_emu.callbacks().outofline_syscall(syscall_id, address, mod ? mod->name.c_str() : "", - entry->second.name.c_str(), context.previous_ip, + entry->second.name, context.previous_ip, previous_mod ? previous_mod->name.c_str() : ""); + win_emu.log.print(color::blue, "Crafted out-of-line syscall: %s (0x%X) at 0x%" PRIx64 " (%s) via 0x%" PRIx64 " (%s)\n", diff --git a/src/windows-emulator/windows_emulator.cpp b/src/windows-emulator/windows_emulator.cpp index 242927e3..2f612d9f 100644 --- a/src/windows-emulator/windows_emulator.cpp +++ b/src/windows-emulator/windows_emulator.cpp @@ -960,7 +960,10 @@ void windows_emulator::on_instruction_execution(const uint64_t address) if (export_entry != binary->address_names.end()) { const auto rsp = this->emu().read_stack_pointer(); - const auto return_address = this->emu().read_memory(rsp); + + uint64_t return_address{}; + this->emu().try_read_memory(rsp, &return_address, sizeof(return_address)); + const auto* mod_name = this->process().mod_manager.find_name(return_address); log.print(is_interesting_call ? color::yellow : color::dark_gray,