This commit is contained in:
RektInator
2025-04-14 12:23:08 +02:00
parent 45b5b035d7
commit 7bf0b67167
9 changed files with 153 additions and 36 deletions

View File

@@ -24,10 +24,9 @@ namespace syscalls
return STATUS_SUCCESS;
}
NTSTATUS handle_NtRaiseException(const syscall_context& c,
const emulator_object<EMU_EXCEPTION_RECORD<EmulatorTraits<Emu64>>>
/*exception_record*/,
const emulator_object<CONTEXT64> thread_context, const BOOLEAN handle_exception)
NTSTATUS handle_NtRaiseException(
const syscall_context& c, const emulator_object<EMU_EXCEPTION_RECORD<EmulatorTraits<Emu64>>> exception_record,
const emulator_object<CONTEXT64> thread_context, const BOOLEAN handle_exception)
{
if (handle_exception)
{
@@ -36,6 +35,13 @@ namespace syscalls
return STATUS_NOT_SUPPORTED;
}
const auto& exception_data = exception_record.read();
if (exception_data.ExceptionCode == 0xC0000602) // STATUS_FAIL_FAST_EXCEPTION
{
c.emu.stop();
return STATUS_SUCCESS;
}
c.proc.exception_rip = thread_context.read().Rip;
c.emu.stop();

View File

@@ -1,6 +1,7 @@
#include "../std_include.hpp"
#include "../emulator_utils.hpp"
#include "../syscall_utils.hpp"
#include "utils/io.hpp"
#include <iostream>
#include <utils/finally.hpp>
@@ -660,6 +661,47 @@ namespace syscalls
return STATUS_SUCCESS;
}
NTSTATUS handle_NtQueryFullAttributesFile(
const syscall_context& c, const emulator_object<OBJECT_ATTRIBUTES<EmulatorTraits<Emu64>>> object_attributes,
const emulator_object<FILE_NETWORK_OPEN_INFORMATION> file_information)
{
if (!object_attributes)
{
return STATUS_INVALID_PARAMETER;
}
const auto attributes = object_attributes.read();
if (!attributes.ObjectName)
{
return STATUS_INVALID_PARAMETER;
}
const auto filename = read_unicode_string(
c.emu, emulator_object<UNICODE_STRING<EmulatorTraits<Emu64>>>{c.emu, attributes.ObjectName});
c.win_emu.log.print(color::dark_gray, "--> Querying file attributes: %s\n", u16_to_u8(filename).c_str());
const auto local_filename = c.win_emu.file_sys.translate(filename).string();
struct _stat64 file_stat{};
if (_stat64(local_filename.c_str(), &file_stat) != 0)
{
return STATUS_OBJECT_NAME_NOT_FOUND;
}
file_information.access([&](FILE_NETWORK_OPEN_INFORMATION& info) {
info.CreationTime = utils::convert_unix_to_windows_time(file_stat.st_atime);
info.LastAccessTime = utils::convert_unix_to_windows_time(file_stat.st_atime);
info.LastWriteTime = utils::convert_unix_to_windows_time(file_stat.st_mtime);
info.AllocationSize.QuadPart = file_stat.st_size;
info.EndOfFile.QuadPart = file_stat.st_size;
info.ChangeTime = info.LastWriteTime;
info.FileAttributes = FILE_ATTRIBUTE_NORMAL;
});
return STATUS_SUCCESS;
}
NTSTATUS handle_NtQueryAttributesFile(
const syscall_context& c, const emulator_object<OBJECT_ATTRIBUTES<EmulatorTraits<Emu64>>> object_attributes,
const emulator_object<FILE_BASIC_INFORMATION> file_information)

View File

@@ -28,9 +28,9 @@ namespace syscalls
return_length.write(sizeof(EMU_MEMORY_BASIC_INFORMATION64));
}
if (memory_information_length != sizeof(EMU_MEMORY_BASIC_INFORMATION64))
if (memory_information_length < sizeof(EMU_MEMORY_BASIC_INFORMATION64))
{
return STATUS_BUFFER_OVERFLOW;
return STATUS_BUFFER_TOO_SMALL;
}
const emulator_object<EMU_MEMORY_BASIC_INFORMATION64> info{c.emu, memory_information};
@@ -198,7 +198,7 @@ namespace syscalls
const bool reserve = allocation_type & MEM_RESERVE;
const bool commit = allocation_type & MEM_COMMIT;
if ((allocation_type & ~(MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN)) || (!commit && !reserve))
if ((allocation_type & ~(MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN | MEM_WRITE_WATCH)) || (!commit && !reserve))
{
throw std::runtime_error("Unsupported allocation type!");
}

View File

@@ -109,7 +109,7 @@ namespace syscalls
const syscall_context& c, const handle section_handle, const handle process_handle,
const emulator_object<uint64_t> base_address,
const EMULATOR_CAST(EmulatorTraits<Emu64>::ULONG_PTR, ULONG_PTR) /*zero_bits*/,
const EMULATOR_CAST(EmulatorTraits<Emu64>::SIZE_T, SIZE_T) /*commit_size*/,
const EMULATOR_CAST(EmulatorTraits<Emu64>::SIZE_T, SIZE_T) commit_size,
const emulator_object<LARGE_INTEGER> /*section_offset*/,
const emulator_object<EMULATOR_CAST(EmulatorTraits<Emu64>::SIZE_T, SIZE_T)> view_size,
const SECTION_INHERIT /*inherit_disposition*/, const ULONG /*allocation_type*/, const ULONG /*win32_protect*/)
@@ -225,10 +225,11 @@ namespace syscalls
size = page_align_up(file_data.size());
}
const auto reserve_only = section_entry->allocation_attributes == SEC_RESERVE;
const auto protection = map_nt_to_emulator_protection(section_entry->section_page_protection);
const auto address = c.win_emu.memory.allocate_memory(size, protection);
const auto address = c.win_emu.memory.allocate_memory(size, protection, reserve_only);
if (!file_data.empty())
if (!reserve_only && !file_data.empty())
{
c.emu.write_memory(address, file_data.data(), file_data.size());
}
@@ -263,19 +264,24 @@ namespace syscalls
}
const auto* mod = c.win_emu.mod_manager.find_by_address(base_address);
if (!mod)
if (mod != nullptr)
{
c.win_emu.log.error("Unmapping non-module section not supported!\n");
c.emu.stop();
return STATUS_NOT_SUPPORTED;
if (c.win_emu.mod_manager.unmap(base_address, c.win_emu.log))
{
return STATUS_SUCCESS;
}
return STATUS_INVALID_PARAMETER;
}
if (c.win_emu.mod_manager.unmap(base_address, c.win_emu.log))
if (c.win_emu.memory.release_memory(base_address, 0))
{
return STATUS_SUCCESS;
}
return STATUS_INVALID_PARAMETER;
c.win_emu.log.error("Unmapping non-module/non-memory section not supported!\n");
c.emu.stop();
return STATUS_NOT_SUPPORTED;
}
NTSTATUS handle_NtUnmapViewOfSectionEx(const syscall_context& c, const handle process_handle,

View File

@@ -578,8 +578,8 @@ namespace syscalls
if (apc_flags)
{
c.win_emu.log.error("Unsupported APC flags: %X\n", apc_flags);
c.emu.stop();
return STATUS_NOT_SUPPORTED;
// c.emu.stop();
// return STATUS_NOT_SUPPORTED;
}
thread->pending_apcs.push_back({
@@ -590,7 +590,7 @@ namespace syscalls
.apc_argument3 = apc_argument3,
});
return STATUS_NOT_SUPPORTED;
return STATUS_SUCCESS;
}
NTSTATUS handle_NtQueueApcThreadEx(const syscall_context& c, const handle thread_handle,

View File

@@ -75,6 +75,24 @@ namespace syscalls
return STATUS_SUCCESS;
}
if (token_information_class == TokenOwner)
{
constexpr auto required_size = sizeof(sid) + sizeof(TOKEN_OWNER64);
return_length.write(required_size);
if (required_size > token_information_length)
{
return STATUS_BUFFER_TOO_SMALL;
}
TOKEN_OWNER64 owner{};
owner.Owner = token_information + sizeof(TOKEN_OWNER64);
emulator_object<TOKEN_OWNER64>{c.emu, token_information}.write(owner);
c.emu.write_memory(token_information + sizeof(TOKEN_OWNER64), sid, sizeof(sid));
return STATUS_SUCCESS;
}
if (token_information_class == TokenType)
{
constexpr auto required_size = sizeof(TOKEN_TYPE);