diff --git a/src/sample/main.cpp b/src/sample/main.cpp index 8e01d032..6c1e1d6b 100644 --- a/src/sample/main.cpp +++ b/src/sample/main.cpp @@ -57,10 +57,10 @@ namespace throw; } - win_emu.logger.print(color::red, "Emulation terminated!"); + win_emu.logger.print(color::red, "Emulation terminated!\n"); } - void run(std::string_view application) + void run(const std::string_view application) { windows_emulator win_emu{ application, {} @@ -73,9 +73,9 @@ namespace const auto text_start = exe.image_base + 0x1000; const auto text_end = exe.image_base + 0x52000; - const auto scan_size = 0x100; + constexpr auto scan_size = 0x100; - win_emu.emu().hook_memory_read(text_start, scan_size, [&](uint64_t address, size_t, uint64_t) + win_emu.emu().hook_memory_read(text_start, scan_size, [&](const uint64_t address, size_t, uint64_t) { const auto rip = win_emu.emu().read_instruction_pointer(); if (rip >= text_start && rip < text_end) @@ -96,19 +96,20 @@ namespace syscall_name.c_str(), syscall_id, rip); - /*if (syscall_name == "NtQueryInformationProcess") + if (syscall_name == "NtQueryInformationProcess") { const auto info_class = win_emu.emu().reg(x64_register::rdx); if (info_class == ProcessImageFileNameWin32) { const auto data = win_emu.emu().reg(x64_register::r8); - emulator_allocator data_allocator{ win_emu.emu(), data, 0x100 }; - data_allocator.make_unicode_string(L"C:\\Users\\mauri\\source\\repos\\lul\\x64\\Release\\lul.exe"); + emulator_allocator data_allocator{win_emu.emu(), data, 0x100}; + data_allocator.make_unicode_string( + L"C:\\Users\\mauri\\source\\repos\\lul\\x64\\Release\\lul.exe"); win_emu.emu().reg(x64_register::rax, STATUS_SUCCESS); return instruction_hook_continuation::skip_instruction; } - }*/ + } } return instruction_hook_continuation::run_instruction; @@ -118,7 +119,7 @@ namespace } } -int main(int argc, char** argv) +int main(const int argc, char** argv) { if (argc <= 1) { diff --git a/src/windows_emulator/syscalls.hpp b/src/windows_emulator/syscalls.hpp index 14314baf..198bfc9a 100644 --- a/src/windows_emulator/syscalls.hpp +++ b/src/windows_emulator/syscalls.hpp @@ -1,8 +1,6 @@ #pragma once -#include #include "process_context.hpp" -#include "handles.hpp" struct syscall_context; using syscall_handler = void(*)(const syscall_context& c); diff --git a/src/windows_emulator/windows_emulator.cpp b/src/windows_emulator/windows_emulator.cpp index b2fa3ec3..9771d508 100644 --- a/src/windows_emulator/windows_emulator.cpp +++ b/src/windows_emulator/windows_emulator.cpp @@ -565,11 +565,13 @@ void windows_emulator::setup_hooks() if (type == memory_violation_type::protection) { - printf("Protection violation: 0x%llX (%zX) - %s at 0x%llX (%s)\n", address, size, permission.c_str(), ip, name); + printf("Protection violation: 0x%llX (%zX) - %s at 0x%llX (%s)\n", address, size, permission.c_str(), ip, + name); } else if (type == memory_violation_type::unmapped) { - printf("Mapping violation: 0x%llX (%zX) - %s at 0x%llX (%s)\n", address, size, permission.c_str(), ip, name); + printf("Mapping violation: 0x%llX (%zX) - %s at 0x%llX (%s)\n", address, size, permission.c_str(), ip, + name); } dispatch_access_violation(this->emu(), this->process().ki_user_exception_dispatcher, address, operation); @@ -612,13 +614,17 @@ void windows_emulator::setup_hooks() const auto export_entry = binary->address_names.find(address); if (export_entry != binary->address_names.end()) { - logger.print(is_interesting_call ? color::yellow : color::gray, "Executing function: %s - %s (0x%llX)\n", binary->name.c_str(), - export_entry->second.c_str(), address); + logger.print(is_interesting_call ? color::yellow : color::gray, + "Executing function: %s - %s (0x%llX)\n", + binary->name.c_str(), + export_entry->second.c_str(), address); } else if (address == binary->entry_point) { - logger.print(is_interesting_call ? color::yellow : color::gray, "Executing entry point: %s (0x%llX)\n", binary->name.c_str(), - address); + logger.print(is_interesting_call ? color::yellow : color::gray, + "Executing entry point: %s (0x%llX)\n", + binary->name.c_str(), + address); } } diff --git a/src/windows_emulator/windows_emulator.hpp b/src/windows_emulator/windows_emulator.hpp index e0fdadb6..d7008674 100644 --- a/src/windows_emulator/windows_emulator.hpp +++ b/src/windows_emulator/windows_emulator.hpp @@ -19,6 +19,8 @@ public: windows_emulator& operator=(windows_emulator&&) = delete; windows_emulator& operator=(const windows_emulator&) = delete; + ~windows_emulator() = default; + x64_emulator& emu() { return *this->emu_;