diff --git a/src/windows-emulator/syscalls.cpp b/src/windows-emulator/syscalls.cpp index 622cd4b9..5ebaa267 100644 --- a/src/windows-emulator/syscalls.cpp +++ b/src/windows-emulator/syscalls.cpp @@ -496,6 +496,11 @@ namespace syscalls return STATUS_NOT_SUPPORTED; } + NTSTATUS handle_NtCreateUserProcess() + { + return STATUS_NOT_SUPPORTED; + } + NTSTATUS handle_NtAddAtomEx(const syscall_context& c, const uint64_t atom_name, const ULONG length, const emulator_object atom, const ULONG /*flags*/) { @@ -763,6 +768,7 @@ void syscall_dispatcher::add_handlers(std::map& ha add_handler(NtQueueApcThreadEx2); add_handler(NtQueueApcThreadEx); add_handler(NtQueueApcThread); + add_handler(NtCreateUserProcess); #undef add_handler } \ No newline at end of file diff --git a/src/windows-emulator/windows_emulator.cpp b/src/windows-emulator/windows_emulator.cpp index 1178b449..30bf3123 100644 --- a/src/windows-emulator/windows_emulator.cpp +++ b/src/windows-emulator/windows_emulator.cpp @@ -460,16 +460,6 @@ void windows_emulator::on_instruction_execution(const uint64_t address) log.print(is_interesting_call ? color::yellow : color::dark_gray, "Executing function: %s - %s (0x%" PRIx64 ") via (0x%" PRIx64 ") %s\n", binary->name.c_str(), export_entry->second.c_str(), address, return_address, mod_name); - - if (export_entry->second == "MessageBoxW") - { - log.log("--> %s\n", - u16_to_u8(read_string(this->memory, this->emu().reg(x64_register::rdx))).c_str()); - } - else if (export_entry->second == "MessageBoxA") - { - log.log("--> %s\n", read_string(this->memory, this->emu().reg(x64_register::rdx)).c_str()); - } } else if (address == binary->entry_point) {