Small fix

This commit is contained in:
Maurice Heumann
2025-04-07 22:01:33 +02:00
parent 0d9e03b673
commit 67d34b3988
6 changed files with 48 additions and 0 deletions

View File

@@ -9,6 +9,7 @@ using NTSTATUS = std::uint32_t;
#define STATUS_TIMEOUT ((NTSTATUS)0x00000102L)
#define STATUS_PENDING ((NTSTATUS)0x00000103L)
#define STATUS_BREAKPOINT ((NTSTATUS)0x80000003L)
#define STATUS_SINGLE_STEP ((NTSTATUS)0x80000004L)
#define STATUS_ACCESS_VIOLATION ((NTSTATUS)0xC0000005L)

View File

@@ -196,3 +196,8 @@ void dispatch_single_step(x64_emulator& emu, const process_context& proc)
{
dispatch_exception(emu, proc, STATUS_SINGLE_STEP, {});
}
void dispatch_breakpoint(x64_emulator& emu, const process_context& proc)
{
dispatch_exception(emu, proc, STATUS_BREAKPOINT, {});
}

View File

@@ -22,3 +22,4 @@ void dispatch_access_violation(x64_emulator& emu, const process_context& proc, u
void dispatch_illegal_instruction_violation(x64_emulator& emu, const process_context& proc);
void dispatch_integer_division_by_zero(x64_emulator& emu, const process_context& proc);
void dispatch_single_step(x64_emulator& emu, const process_context& proc);
void dispatch_breakpoint(x64_emulator& emu, const process_context& proc);

View File

@@ -93,6 +93,7 @@ void process_context::setup(x64_emulator& emu, memory_manager& memory, const app
});
this->peb.access([&](PEB64& p) {
p.BeingDebugged = 0;
p.ImageBaseAddress = executable.image_base;
p.ProcessParameters = this->process_params.ptr();
p.ApiSetMap = apiset::clone(emu, allocator, apiset_container).ptr();

View File

@@ -1718,6 +1718,42 @@ namespace
return STATUS_SUCCESS;
}
if (info_class == ThreadPerformanceCount)
{
if (return_length)
{
return_length.write(sizeof(LARGE_INTEGER));
}
if (thread_information_length < sizeof(LARGE_INTEGER))
{
return STATUS_BUFFER_OVERFLOW;
}
const emulator_object<LARGE_INTEGER> info{c.emu, thread_information};
info.write({});
return STATUS_SUCCESS;
}
if (info_class == ThreadHideFromDebugger)
{
if (return_length)
{
return_length.write(sizeof(BOOLEAN));
}
if (thread_information_length < sizeof(BOOLEAN))
{
return STATUS_BUFFER_OVERFLOW;
}
const emulator_object<BOOLEAN> info{c.emu, thread_information};
info.write(0);
return STATUS_SUCCESS;
}
if (info_class == ThreadTimes)
{
if (return_length)

View File

@@ -475,6 +475,10 @@ void windows_emulator::setup_hooks()
this->log.print(color::pink, "Singlestep: 0x%" PRIx64 "\n", rip);
dispatch_single_step(this->emu(), this->process);
return;
case 3:
this->log.print(color::pink, "Breakpoint: 0x%" PRIx64 "\n", rip);
dispatch_breakpoint(this->emu(), this->process);
return;
case 6:
dispatch_illegal_instruction_violation(this->emu(), this->process);
return;