Lightemerald/windows-user-space-emulator
2
0
Fork 0
mirror of https://github.com/momo5502/emulator.git synced 2026-01-18 11:13:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Extract sus activity logging

Browse Source
This commit is contained in:
momo5502
2025-06-04 19:28:50 +02:00
parent 5609de9dde
commit 84e8e86b94
5 changed files with 31 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
src/analyzer/analysis.cpp
View File

@@ -1,8 +1,25 @@
#include "analysis.hpp"
#include "windows_emulator.hpp"
#define STR_VIEW_VA(str) static_cast<int>((str).size()), (str).data()
namespace
{
template <typename Return, typename... Args>
std::function<Return(Args...)> make_callback(windows_emulator& win_emu,
Return (*callback)(windows_emulator&, Args...))
{
return [&win_emu, callback](Args... args) {
return callback(win_emu, std::forward<Args>(args)...); //
};
}
void handle_suspicious_activity(windows_emulator& win_emu, const std::string_view details)
{
const auto rip = win_emu.emu().read_instruction_pointer();
win_emu.log.print(color::pink, "Suspicious: %.*s (0x" PRIX64 ")\n", STR_VIEW_VA(details), rip);
}
emulator_callbacks::continuation handle_syscall(windows_emulator& win_emu, const uint32_t syscall_id,
const std::string_view syscall_name)
{
@@ -15,8 +32,7 @@ namespace
if (is_sus_module)
{
win_emu.log.print(color::blue, "Executing inline syscall: %.*s (0x%X) at 0x%" PRIx64 " (%s)\n",
static_cast<int>(syscall_name.size()), syscall_name.data(), syscall_id, address,
mod ? mod->name.c_str() : "<N/A>");
STR_VIEW_VA(syscall_name), syscall_id, address, mod ? mod->name.c_str() : "<N/A>");
}
else if (mod->is_within(win_emu.process.previous_ip))
{
@@ -29,8 +45,7 @@ namespace
win_emu.log.print(color::dark_gray,
"Executing syscall: %.*s (0x%X) at 0x%" PRIx64 " via 0x%" PRIx64 " (%s)\n",
static_cast<int>(syscall_name.size()), syscall_name.data(), syscall_id, address,
return_address, caller_mod_name);
STR_VIEW_VA(syscall_name), syscall_id, address, return_address, caller_mod_name);
}
else
{
@@ -38,22 +53,12 @@ namespace
win_emu.log.print(color::blue,
"Crafted out-of-line syscall: %.*s (0x%X) at 0x%" PRIx64 " (%s) via 0x%" PRIx64 " (%s)\n",
static_cast<int>(syscall_name.size()), syscall_name.data(), syscall_id, address,
mod ? mod->name.c_str() : "<N/A>", win_emu.process.previous_ip,
previous_mod ? previous_mod->name.c_str() : "<N/A>");
STR_VIEW_VA(syscall_name), syscall_id, address, mod ? mod->name.c_str() : "<N/A>",
win_emu.process.previous_ip, previous_mod ? previous_mod->name.c_str() : "<N/A>");
}
return instruction_hook_continuation::run_instruction;
}
template <typename Return, typename... Args>
std::function<Return(Args...)> make_callback(windows_emulator& win_emu,
Return (*callback)(windows_emulator&, Args...))
{
return [&win_emu, callback](Args... args) {
return callback(win_emu, std::forward<Args>(args)...); //
};
}
}
void register_analysis_callbacks(windows_emulator& win_emu)
@@ -61,4 +66,5 @@ void register_analysis_callbacks(windows_emulator& win_emu)
auto& cb = win_emu.callbacks;
cb.on_syscall = make_callback(win_emu, handle_syscall);
cb.on_suspicious_activity = make_callback(win_emu, handle_suspicious_activity);
}