diff --git a/src/common/platform/win_pefile.hpp b/src/common/platform/win_pefile.hpp index c3f99d3f..20b8073e 100644 --- a/src/common/platform/win_pefile.hpp +++ b/src/common/platform/win_pefile.hpp @@ -659,7 +659,6 @@ namespace winpe return std::make_error_code(std::errc::executable_format_error); } - // Helper function to parse PE headers and extract image information template inline bool parse_pe_headers(const std::vector& file_data, pe_image_basic_info& info) { @@ -674,18 +673,15 @@ namespace winpe return false; } - // First check if we can read up to the optional header magic if (file_data.size() < dos_header->e_lfanew + sizeof(uint32_t) + sizeof(PEFileHeader_t) + sizeof(uint16_t)) { return false; } - // Read the magic number from the optional header const auto* magic_ptr = reinterpret_cast(file_data.data() + dos_header->e_lfanew + sizeof(uint32_t) + sizeof(PEFileHeader_t)); const uint16_t magic = *magic_ptr; - // Check if the magic matches the expected type constexpr uint16_t expected_magic = (sizeof(T) == sizeof(uint32_t)) ? static_cast(PEOptionalHeader_t::k_Magic) : static_cast(PEOptionalHeader_t::k_Magic); @@ -695,7 +691,6 @@ namespace winpe return false; } - // Now check the full NT headers size if (file_data.size() < dos_header->e_lfanew + sizeof(PENTHeaders_t)) { return false; @@ -710,7 +705,6 @@ namespace winpe const auto& file_header = nt_headers->FileHeader; const auto& optional_header = nt_headers->OptionalHeader; - // Extract information from headers info.machine = static_cast(file_header.Machine); info.image_characteristics = file_header.Characteristics; @@ -726,10 +720,8 @@ namespace winpe info.loader_flags = optional_header.LoaderFlags; info.checksum = optional_header.CheckSum; - // Check if image contains code info.has_code = (optional_header.SizeOfCode > 0) || (optional_header.AddressOfEntryPoint != 0); - // Also check section characteristics for code sections const auto sections_offset = dos_header->e_lfanew + sizeof(uint32_t) + sizeof(PEFileHeader_t) + file_header.SizeOfOptionalHeader; if (file_data.size() >= sections_offset + sizeof(IMAGE_SECTION_HEADER) * file_header.NumberOfSections) { diff --git a/src/emulator/address_utils.hpp b/src/emulator/address_utils.hpp index 3edc0b98..12773f59 100644 --- a/src/emulator/address_utils.hpp +++ b/src/emulator/address_utils.hpp @@ -53,7 +53,7 @@ constexpr uint64_t page_align_up(const uint64_t value, const uint64_t page_size return align_up(value, page_size); } -constexpr uint64_t rva_to_raw(uint64_t va_base, uint64_t raw_base, uint64_t rva) +constexpr uint64_t rva_to_file_offset(uint64_t va_base, uint64_t raw_base, uint64_t rva) { return rva - (va_base - raw_base); } diff --git a/src/windows-emulator/module/module_manager.cpp b/src/windows-emulator/module/module_manager.cpp index b715ab28..ce0fef80 100644 --- a/src/windows-emulator/module/module_manager.cpp +++ b/src/windows-emulator/module/module_manager.cpp @@ -221,7 +221,7 @@ mapped_module* module_manager::map_module_core(const pe_detection_result& detect mapped_module mod = mapper(); mod.is_static = is_static; - if (!mod.path.empty() && mod.path.filename() != "win32u.dll") + if (!mod.path.empty()) { this->module_load_count[mod.path]++; } @@ -465,6 +465,13 @@ std::optional module_manager::get_module_load_count_by_path(const wind mapped_module* module_manager::map_module(const windows_path& file, const logger& logger, const bool is_static, bool allow_duplicate) { + auto local_file = this->file_sys_->translate(file); + + if (local_file.filename() == "win32u.dll") + { + return this->map_local_module(this->file_sys_->translate(file), logger, is_static, false); + } + return this->map_local_module(this->file_sys_->translate(file), logger, is_static, allow_duplicate); } diff --git a/src/windows-emulator/process_context.cpp b/src/windows-emulator/process_context.cpp index ae7f0821..6a97079f 100644 --- a/src/windows-emulator/process_context.cpp +++ b/src/windows-emulator/process_context.cpp @@ -318,7 +318,7 @@ namespace auto import_directory_rbase = section_with_import_descs.PointerToRawData; uint64_t import_directory_raw = - rva_to_raw(import_directory_vbase, import_directory_rbase, import_directory_entry.VirtualAddress); + rva_to_file_offset(import_directory_vbase, import_directory_rbase, import_directory_entry.VirtualAddress); auto import_descriptors = buffer.as(static_cast(import_directory_raw)); for (size_t import_desc_index = 0;; import_desc_index++) { @@ -328,8 +328,8 @@ namespace break; } - auto known_dll_dep_name = - buffer.as_string(static_cast(rva_to_raw(import_directory_vbase, import_directory_rbase, descriptor.Name))); + auto known_dll_dep_name = buffer.as_string( + static_cast(rva_to_file_offset(import_directory_vbase, import_directory_rbase, descriptor.Name))); utils::string::to_lower_inplace(known_dll_dep_name); auto known_dll_dep_name_16 = u8_to_u16(known_dll_dep_name); diff --git a/src/windows-emulator/syscalls/section.cpp b/src/windows-emulator/syscalls/section.cpp index d2a39d3d..7fa31d66 100644 --- a/src/windows-emulator/syscalls/section.cpp +++ b/src/windows-emulator/syscalls/section.cpp @@ -120,12 +120,6 @@ namespace syscalls utils::string::to_lower_inplace(filename); - // Workaround for win32u.dll - if (is_known_dll && filename.starts_with(u"win32u.dll")) - { - return STATUS_OBJECT_NAME_NOT_FOUND; - } - if (attributes.RootDirectory == KNOWN_DLLS_DIRECTORY || filename.starts_with(u"\\knowndlls\\")) { auto& knowndlls_sections = c.win_emu.process.knowndlls64_sections;