Use std::map instead of std::unordered_map for data that will be serialized

This commit is contained in:
ahm3dgg
2026-01-09 03:09:42 +02:00
parent 833fd610da
commit 8481cdfb5d
6 changed files with 18 additions and 14 deletions

View File

@@ -531,7 +531,7 @@ mapped_module* module_manager::map_memory_module(uint64_t base_address, uint64_t
void module_manager::serialize(utils::buffer_serializer& buffer) const
{
buffer.write_map(this->modules_);
//buffer.write_map(this->module_load_count);
buffer.write_map(this->module_load_count);
buffer.write(this->executable ? this->executable->image_base : 0);
buffer.write(this->ntdll ? this->ntdll->image_base : 0);
@@ -549,7 +549,7 @@ void module_manager::serialize(utils::buffer_serializer& buffer) const
void module_manager::deserialize(utils::buffer_deserializer& buffer)
{
buffer.read_map(this->modules_);
//buffer.read_map(this->module_load_count);
buffer.read_map(this->module_load_count);
this->last_module_cache_ = this->modules_.end();
const auto executable_base = buffer.read<uint64_t>();

View File

@@ -159,7 +159,7 @@ class module_manager
mapped_module* executable{};
mapped_module* ntdll{};
mapped_module* win32u{};
std::unordered_map<windows_path, uint64_t> module_load_count;
std::map<windows_path, uint64_t> module_load_count;
// WOW64-specific modules (for validation and future use)
struct wow64_modules

View File

@@ -576,11 +576,10 @@ void process_context::setup(x86_64_emulator& emu, memory_manager& memory, regist
}
}
(void)file_system;
//const auto* api_set_data = reinterpret_cast<const API_SET_NAMESPACE*>(apiset_container.data.data());
//auto apiset = get_apiset_namespace_table(api_set_data);
//create_known_dlls_section_objects<uint32_t>(this->knowndlls32_sections, apiset, registry, file_system, true);
//create_known_dlls_section_objects<uint64_t>(this->knowndlls64_sections, apiset, registry, file_system, false);
const auto* api_set_data = reinterpret_cast<const API_SET_NAMESPACE*>(apiset_container.data.data());
auto apiset = get_apiset_namespace_table(api_set_data);
create_known_dlls_section_objects<uint32_t>(this->knowndlls32_sections, apiset, registry, file_system, true);
create_known_dlls_section_objects<uint64_t>(this->knowndlls64_sections, apiset, registry, file_system, false);
this->ntdll_image_base = ntdll.image_base;
this->ldr_initialize_thunk = ntdll.find_export("LdrInitializeThunk");
@@ -657,8 +656,8 @@ void process_context::serialize(utils::buffer_serializer& buffer) const
buffer.write(this->timers);
buffer.write(this->registry_keys);
buffer.write_map(this->atoms);
//buffer.write_map(this->knowndlls32_sections);
//buffer.write_map(this->knowndlls64_sections);
buffer.write_map(this->knowndlls32_sections);
buffer.write_map(this->knowndlls64_sections);
buffer.write(this->last_extended_params_numa_node);
buffer.write(this->last_extended_params_attributes);
@@ -708,8 +707,8 @@ void process_context::deserialize(utils::buffer_deserializer& buffer)
buffer.read(this->timers);
buffer.read(this->registry_keys);
buffer.read_map(this->atoms);
//buffer.read_map(this->knowndlls32_sections);
//buffer.read_map(this->knowndlls64_sections);
buffer.read_map(this->knowndlls32_sections);
buffer.read_map(this->knowndlls64_sections);
buffer.read(this->last_extended_params_numa_node);
buffer.read(this->last_extended_params_attributes);

View File

@@ -34,7 +34,7 @@
struct emulator_settings;
struct application_settings;
using knowndlls_map = std::unordered_map<std::u16string, section>;
using knowndlls_map = std::map<std::u16string, section>;
struct process_context
{
struct callbacks

View File

@@ -119,7 +119,7 @@ namespace syscalls
}
utils::string::to_lower_inplace(filename);
if (is_known_dll && filename.starts_with(u"win32u.dll"))
if (is_known_dll && (filename.starts_with(u"win32u.dll") || filename.starts_with(u"ntdll.dll")))
{
return STATUS_OBJECT_NAME_NOT_FOUND;
}

View File

@@ -256,6 +256,11 @@ class windows_path
return !this->operator==(other);
}
bool operator<(const windows_path& other) const
{
return this->string().length() < other.string().length();
}
bool empty() const
{
return this->is_relative() && this->folders_.empty();