Lightemerald/windows-user-space-emulator
2
0
Fork 0
mirror of https://github.com/momo5502/emulator.git synced 2026-01-19 03:33:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/main' into multi-platform-support

Browse Source 
# Conflicts:
#	src/analyzer/main.cpp
#	src/emulator/memory_region.hpp
#	src/windows-emulator/io_device.cpp
#	src/windows-emulator/module/module_mapping.cpp
#	src/windows-emulator/process_context.hpp
#	src/windows-emulator/syscalls.cpp
#	src/windows-emulator/windows_emulator.cpp
This commit is contained in:
momo5502
2025-01-05 14:44:17 +01:00
parent 24f53bc498 38f2f13fad
commit f75f95cc61
36 changed files with 2643 additions and 978 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
src/windows-emulator/syscall_dispatcher.cpp
View File

@@ -24,15 +24,16 @@ void syscall_dispatcher::deserialize(utils::buffer_deserializer& buffer)
}
void syscall_dispatcher::setup(const exported_symbols& ntdll_exports, const exported_symbols& win32u_exports)
void syscall_dispatcher::setup(const exported_symbols& ntdll_exports, std::span<const std::byte> ntdll_data,
const exported_symbols& win32u_exports, std::span<const std::byte> win32u_data)
{
this->handlers_ = {};
const auto ntdll_syscalls = find_syscalls(ntdll_exports);
const auto win32u_syscalls = find_syscalls(win32u_exports);
const auto ntdll_syscalls = find_syscalls(ntdll_exports, ntdll_data);
const auto win32u_syscalls = find_syscalls(win32u_exports, win32u_data);
map_syscalls(this->handlers_, ntdll_syscalls, 0);
map_syscalls(this->handlers_, win32u_syscalls, 0x1000);
map_syscalls(this->handlers_, ntdll_syscalls);
map_syscalls(this->handlers_, win32u_syscalls);
this->add_handlers();
}
@@ -99,10 +100,26 @@ void syscall_dispatcher::dispatch(windows_emulator& win_emu)
}
else
{
win_emu.logger.print(color::dark_gray, "Executing syscall: %s (0x%X) at 0x%llX\n",
entry->second.name.c_str(),
syscall_id,
address);
if (mod->is_within(context.previous_ip))
{
const auto rsp = c.emu.read_stack_pointer();
const auto return_address = c.emu.read_memory<uint64_t>(rsp);
const auto* mod_name = context.module_manager.find_name(return_address);
win_emu.logger.print(color::dark_gray, "Executing syscall: %s (0x%X) at 0x%llX via 0x%llX (%s) %lld\n",
entry->second.name.c_str(),
syscall_id, address, return_address, mod_name, c.proc.executed_instructions);
}
else
{
const auto* previous_mod = context.module_manager.find_by_address(context.previous_ip);
win_emu.logger.print(color::blue,
"Crafted out-of-line syscall: %s (0x%X) at 0x%llX (%s) via 0x%llX (%s)\n",
entry->second.name.c_str(),
syscall_id,
address, mod ? mod->name.c_str() : "<N/A>", context.previous_ip,
previous_mod ? previous_mod->name.c_str() : "<N/A>");
}
}
entry->second.handler(c);
@@ -121,8 +138,8 @@ void syscall_dispatcher::dispatch(windows_emulator& win_emu)
}
}
syscall_dispatcher::syscall_dispatcher(const exported_symbols& ntdll_exports,
const exported_symbols& win32u_exports)
syscall_dispatcher::syscall_dispatcher(const exported_symbols& ntdll_exports, std::span<const std::byte> ntdll_data,
const exported_symbols& win32u_exports, std::span<const std::byte> win32u_data)
{
this->setup(ntdll_exports, win32u_exports);
this->setup(ntdll_exports, ntdll_data, win32u_exports, win32u_data);
}