Various fixes, update to create-root.bat and a new syscall (#232)

This PR aims to:
- [Update
`create-root.bat`](21fc460db8)
with more dlls and NLS-related files.
- [Retry loading using normal path when wow6432node path is not
found](16e7cac48a),
I'm not sure if this is the right thing to do, but I guess Windows does
something like this behind the scenes because the saved `wow6432node`
doesn't contain all the keys that exist when you look at it in regedit.
- [Add stub for NtAreMappedFilesTheSame and modify NtSetInformationKey
to return
success](8dfcf2755c).
- [Simplify the TimeZone query
fix](39d40a7f2f),
this was necessary because... turns out all the stuff I wrote in
NtConnectPort was unnecessary and caused some regressions, all I needed
to change was `NtMapViewOfSection`.
- [Fix vm crash when teb.ThreadLocalStoragePointer is
null](134b45d1e8),
but I'm not sure if this was a small oversight or something more
fundamentally wrong.
This commit is contained in:
Maurice Heumann
2025-04-23 08:01:32 +02:00
committed by GitHub
7 changed files with 45 additions and 42 deletions

View File

@@ -118,8 +118,18 @@ CALL :collect wintypes.dll
CALL :collect slwga.dll
CALL :collect sppc.dll
CALL :collect kernel.appcore.dll
CALL :collect winnlsres.dll
CALL :collect nlsbres.dll
CALL :collect netutils.dll
CALL :collect dinput8.dll
CALL :collect d3d10.dll
CALL :collect d3d10core.dll
CALL :collect cabinet.dll
CALL :collect msacm32.dll
CALL :collect locale.nls
CALL :collect c_1252.nls
CALL :collect c_850.nls
EXIT /B 0

View File

@@ -105,7 +105,22 @@ std::optional<registry_key> registry_manager::get_key(const utils::path_key& key
return {std::move(reg_key)};
}
const auto* entry = iterator->second->get_sub_key(reg_key.path.get());
auto path = reg_key.path.get();
const auto* entry = iterator->second->get_sub_key(path);
if (!entry)
{
constexpr std::wstring_view wowPrefix = L"wow6432node\\";
const auto pathStr = path.wstring();
if (pathStr.starts_with(wowPrefix))
{
path = pathStr.substr(wowPrefix.size());
reg_key.path = path;
entry = iterator->second->get_sub_key(path);
}
}
if (!entry)
{
return std::nullopt;

View File

@@ -259,6 +259,7 @@ namespace syscalls
NTSTATUS handle_NtUnmapViewOfSection(const syscall_context& c, handle process_handle, uint64_t base_address);
NTSTATUS handle_NtUnmapViewOfSectionEx(const syscall_context& c, handle process_handle, uint64_t base_address,
ULONG /*flags*/);
NTSTATUS handle_NtAreMappedFilesTheSame();
// syscalls/semaphore.cpp:
NTSTATUS handle_NtOpenSemaphore(const syscall_context& c, emulator_object<handle> semaphore_handle,
@@ -866,6 +867,7 @@ void syscall_dispatcher::add_handlers(std::map<std::string, syscall_handler>& ha
add_handler(NtFsControlFile);
add_handler(NtQueryFullAttributesFile);
add_handler(NtFlushBuffersFile);
add_handler(NtAreMappedFilesTheSame);
add_handler(NtUserGetProcessWindowStation);
add_handler(NtUserRegisterClassExWOW);
add_handler(NtUserUnregisterClass);

View File

@@ -4,18 +4,6 @@
namespace syscalls
{
struct CSR_API_CONNECTINFO
{
uint64_t SharedSectionBase;
uint64_t SharedStaticServerData;
uint64_t SharedSectionHeap;
ULONG DebugFlags;
ULONG SizeOfPebData;
ULONG SizeOfTebData;
ULONG NumberOfServerDllNames;
EMULATOR_CAST(uint64_t, HANDLE) ServerProcessId;
};
NTSTATUS handle_NtConnectPort(const syscall_context& c, const emulator_object<handle> client_port_handle,
const emulator_object<UNICODE_STRING<EmulatorTraits<Emu64>>> server_port_name,
const emulator_object<SECURITY_QUALITY_OF_SERVICE> /*security_qos*/,
@@ -33,34 +21,9 @@ namespace syscalls
if (connection_info)
{
if (p.name == u"\\Windows\\ApiPort")
{
CSR_API_CONNECTINFO connect_info{};
const auto expected_connect_length = connection_info_length.read();
if (expected_connect_length < sizeof(CSR_API_CONNECTINFO))
{
return STATUS_BUFFER_TOO_SMALL;
}
// TODO: Use client_shared_memory to get the section entry and get the address from it?
connect_info.SharedSectionBase = c.proc.shared_section_address;
c.emu.write_memory(c.proc.shared_section_address + 2504,
0xFFFFFFFF); // BaseStaticServerData->TermsrvClientTimeZoneId
const auto static_server_data =
c.win_emu.memory.allocate_memory(0x10000, memory_permission::read_write);
connect_info.SharedStaticServerData = static_server_data;
c.emu.write_memory(static_server_data + 8, connect_info.SharedSectionBase);
c.emu.write_memory(connection_info, &connect_info, sizeof(connect_info));
}
else
{
std::vector<uint8_t> zero_mem{};
zero_mem.resize(connection_info_length.read(), 0);
c.emu.write_memory(connection_info, zero_mem.data(), zero_mem.size());
}
std::vector<uint8_t> zero_mem{};
zero_mem.resize(connection_info_length.read(), 0);
c.emu.write_memory(connection_info, zero_mem.data(), zero_mem.size());
}
client_shared_memory.access([&](PORT_VIEW64& view) {

View File

@@ -309,6 +309,11 @@ namespace syscalls
const auto tls_vector = teb.ThreadLocalStoragePointer;
constexpr auto ptr_size = sizeof(EmulatorTraits<Emu64>::PVOID);
if (!tls_vector)
{
return;
}
if (tls_info.TlsRequest == ProcessTlsReplaceIndex)
{
const auto tls_entry_ptr = tls_vector + (tls_info.TlsIndex * ptr_size);

View File

@@ -239,7 +239,7 @@ namespace syscalls
NTSTATUS handle_NtSetInformationKey()
{
return STATUS_NOT_SUPPORTED;
return STATUS_SUCCESS;
}
NTSTATUS handle_NtEnumerateKey(const syscall_context& c, const handle key_handle, const ULONG index,

View File

@@ -143,6 +143,7 @@ namespace syscalls
constexpr auto windows_dir_offset = 0x10;
c.emu.write_memory(address + 8, windows_dir_offset);
// aka. BaseStaticServerData (BASE_STATIC_SERVER_DATA)
const auto obj_address = address + windows_dir_offset;
const emulator_object<UNICODE_STRING<EmulatorTraits<Emu64>>> windir_obj{c.emu, obj_address};
@@ -168,6 +169,8 @@ namespace syscalls
ucs.Buffer = ucs.Buffer - obj_address;
});
c.emu.write_memory(obj_address + 0x9C8, 0xFFFFFFFF); // TIME_ZONE_ID_INVALID
if (view_size)
{
view_size.write(shared_section_size);
@@ -304,4 +307,9 @@ namespace syscalls
{
return handle_NtUnmapViewOfSection(c, process_handle, base_address);
}
NTSTATUS handle_NtAreMappedFilesTheSame()
{
return STATUS_NOT_SUPPORTED;
}
}