Lightemerald/windows-user-space-emulator
2
0
Fork 0
mirror of https://github.com/momo5502/emulator.git synced 2026-01-19 19:53:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Conditionally print access to executable memory

Browse Source
This commit is contained in:
momo5502
2025-06-30 21:21:59 +02:00
parent 965055b875
commit 6b6dcc9ce2
3 changed files with 72 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
page/src/components/settings-menu.tsx
View File

@@ -84,6 +84,17 @@ export class SettingsMenu extends React.Component<SettingsMenuProps, Settings> {
<Label htmlFor="settings-buffer">Buffer stdout</Label>
</div>
<div className="flex gap-6">
<Checkbox
id="settings-exec"
checked={this.state.execAccess}
onCheckedChange={(checked: boolean) => {
this.setState({ execAccess: checked });
}}
/>
<Label htmlFor="settings-exec">Log exec Memory Access</Label>
</div>
<div className="flex gap-6">
<Checkbox
id="settings-persist"

6
page/src/settings.ts
View File

@@ -4,6 +4,7 @@ export interface Settings {
silent: boolean;
bufferStdout: boolean;
persist: boolean;
execAccess: boolean;
}
export function createDefaultSettings(): Settings {
@@ -13,6 +14,7 @@ export function createDefaultSettings(): Settings {
silent: false,
bufferStdout: true,
persist: false,
execAccess: true,
};
}
@@ -61,5 +63,9 @@ export function translateSettings(settings: Settings): string[] {
switches.push("-b");
}
if (settings.execAccess) {
switches.push("-x");
}
return switches;
}

104
src/analyzer/main.cpp
View File

@@ -23,6 +23,7 @@ namespace
struct analysis_options : analysis_settings
{
mutable bool use_gdb{false};
bool log_executable_access{false};
std::filesystem::path dump{};
std::filesystem::path minidump_path{};
std::string registry_path{"./registry"};
@@ -312,58 +313,62 @@ namespace
return instruction_hook_continuation::run_instruction;
});
for (const auto& section : exe.sections)
if (options.log_executable_access)
{
if ((section.region.permissions & memory_permission::exec) != memory_permission::exec)
for (const auto& section : exe.sections)
{
continue;
if ((section.region.permissions & memory_permission::exec) != memory_permission::exec)
{
continue;
}
auto read_handler = [&, section, concise_logging](const uint64_t address, const void*, size_t) {
const auto rip = win_emu->emu().read_instruction_pointer();
if (!win_emu->mod_manager.executable->is_within(rip))
{
return;
}
if (concise_logging)
{
static uint64_t count{0};
++count;
if (count > 100 && count % 100000 != 0)
{
return;
}
}
win_emu->log.print(color::green,
"Reading from executable section %s at 0x%" PRIx64 " via 0x%" PRIx64 "\n",
section.name.c_str(), address, rip);
};
const auto write_handler = [&, section, concise_logging](const uint64_t address, const void*, size_t) {
const auto rip = win_emu->emu().read_instruction_pointer();
if (!win_emu->mod_manager.executable->is_within(rip))
{
return;
}
if (concise_logging)
{
static uint64_t count{0};
++count;
if (count > 100 && count % 100000 != 0)
{
return;
}
}
win_emu->log.print(color::blue,
"Writing to executable section %s at 0x%" PRIx64 " via 0x%" PRIx64 "\n",
section.name.c_str(), address, rip);
};
win_emu->emu().hook_memory_read(section.region.start, section.region.length, std::move(read_handler));
win_emu->emu().hook_memory_write(section.region.start, section.region.length, std::move(write_handler));
}
auto read_handler = [&, section, concise_logging](const uint64_t address, const void*, size_t) {
const auto rip = win_emu->emu().read_instruction_pointer();
if (!win_emu->mod_manager.executable->is_within(rip))
{
return;
}
if (concise_logging)
{
static uint64_t count{0};
++count;
if (count > 100 && count % 100000 != 0)
{
return;
}
}
win_emu->log.print(color::green,
"Reading from executable section %s at 0x%" PRIx64 " via 0x%" PRIx64 "\n",
section.name.c_str(), address, rip);
};
const auto write_handler = [&, section, concise_logging](const uint64_t address, const void*, size_t) {
const auto rip = win_emu->emu().read_instruction_pointer();
if (!win_emu->mod_manager.executable->is_within(rip))
{
return;
}
if (concise_logging)
{
static uint64_t count{0};
++count;
if (count > 100 && count % 100000 != 0)
{
return;
}
}
win_emu->log.print(color::blue, "Writing to executable section %s at 0x%" PRIx64 " via 0x%" PRIx64 "\n",
section.name.c_str(), address, rip);
};
win_emu->emu().hook_memory_read(section.region.start, section.region.length, std::move(read_handler));
win_emu->emu().hook_memory_write(section.region.start, section.region.length, std::move(write_handler));
}
return run_emulation(context, options);
@@ -391,6 +396,7 @@ namespace
printf(" -v, --verbose Verbose logging\n");
printf(" -b, --buffer Buffer stdout\n");
printf(" -c, --concise Concise logging\n");
printf(" -x, --exec Log r/w access to executable memory\n");
printf(" -m, --module <module> Specify module to track\n");
printf(" -e, --emulation <path> Set emulation root path\n");
printf(" -a, --snapshot <path> Load snapshot dump from path\n");