Fix creating suspended thread and parse create_flags

This commit is contained in:
ssvine
2025-12-30 15:18:55 +03:00
parent 0370da327b
commit 57ad277158
7 changed files with 29 additions and 8 deletions

View File

@@ -116,16 +116,18 @@ namespace
}
emulator_thread::emulator_thread(memory_manager& memory, const process_context& context, const uint64_t start_address,
const uint64_t argument, const uint64_t stack_size, const bool suspended, const uint32_t id,
const uint64_t argument, const uint64_t stack_size, const uint32_t create_flags, const uint32_t id,
const bool initial_thread)
: memory_ptr(&memory),
// stack_size(page_align_up(std::max(stack_size, static_cast<uint64_t>(STACK_SIZE)))),
start_address(start_address),
argument(argument),
id(id),
suspended(suspended),
create_flags(create_flags),
last_registers(context.default_register_set)
{
this->suspended = create_flags & THREAD_CREATE_FLAGS_CREATE_SUSPENDED;
// native 64-bit
if (!context.is_wow64_process)
{
@@ -154,6 +156,9 @@ emulator_thread::emulator_thread(memory_manager& memory, const process_context&
teb_obj.CurrentLocale = 0x409;
teb_obj.ProcessEnvironmentBlock = context.peb64.value();
teb_obj.SameTebFlags.InitialThread = initial_thread;
teb_obj.SameTebFlags.SkipThreadAttach = (create_flags & THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH) ? 1 : 0;
teb_obj.SameTebFlags.LoaderWorker = (create_flags & THREAD_CREATE_FLAGS_LOADER_WORKER) ? 1 : 0;
teb_obj.SameTebFlags.SkipLoaderInit = (create_flags & THREAD_CREATE_FLAGS_SKIP_LOADER_INIT) ? 1 : 0;
});
return;
@@ -212,6 +217,9 @@ emulator_thread::emulator_thread(memory_manager& memory, const process_context&
teb_obj.ProcessEnvironmentBlock = context.peb64.value();
teb_obj.SameTebFlags.InitialThread = initial_thread;
teb_obj.SameTebFlags.SkipThreadAttach = (create_flags & THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH) ? 1 : 0;
teb_obj.SameTebFlags.LoaderWorker = (create_flags & THREAD_CREATE_FLAGS_LOADER_WORKER) ? 1 : 0;
teb_obj.SameTebFlags.SkipLoaderInit = (create_flags & THREAD_CREATE_FLAGS_SKIP_LOADER_INIT) ? 1 : 0;
teb_obj.StaticUnicodeString.MaximumLength = sizeof(teb_obj.StaticUnicodeBuffer);
teb_obj.StaticUnicodeString.Buffer = this->teb64->value() + offsetof(TEB64, StaticUnicodeBuffer);
@@ -268,6 +276,9 @@ emulator_thread::emulator_thread(memory_manager& memory, const process_context&
teb32_obj.WowTebOffset = -0x2000;
teb32_obj.InitialThread = initial_thread;
teb32_obj.SkipThreadAttach = (create_flags & THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH) ? 1 : 0;
teb32_obj.LoaderWorker = (create_flags & THREAD_CREATE_FLAGS_LOADER_WORKER) ? 1 : 0;
teb32_obj.SkipLoaderInit = (create_flags & THREAD_CREATE_FLAGS_SKIP_LOADER_INIT) ? 1 : 0;
// Note: CurrentLocale and other fields will be initialized by WOW64 runtime
});