Lightemerald/windows-user-space-emulator
2
0
Fork 0
mirror of https://github.com/momo5502/emulator.git synced 2026-01-11 16:46:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/main' into multi-platform-support

Browse Source 
# Conflicts:
#	src/analyzer/main.cpp
#	src/emulator/memory_region.hpp
#	src/windows-emulator/io_device.cpp
#	src/windows-emulator/module/module_mapping.cpp
#	src/windows-emulator/process_context.hpp
#	src/windows-emulator/syscalls.cpp
#	src/windows-emulator/windows_emulator.cpp
This commit is contained in:
momo5502
2025-01-05 14:44:17 +01:00
parent 24f53bc498 38f2f13fad
commit f75f95cc61
36 changed files with 2643 additions and 978 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
README.md
View File

@@ -9,6 +9,8 @@
A high-performance Windows process emulator that operates at syscall level, providing full control over process execution through comprehensive hooking capabilities.
Perfect for security research, malware analysis, and DRM research where fine-grained control over process execution is required.
Built in C++ and powered by the Unicorn Engine.
## Key Features
@@ -28,8 +30,6 @@ Built in C++ and powered by the Unicorn Engine.
* 💻 __Debugging Interface__
* Implements GDB serial protocol for integration with common debugging tools (IDA Pro, GDB, LLDB, VS Code, ...)
Perfect for security research, malware analysis, and DRM research where fine-grained control over process execution is required.
##
> [!NOTE]
> The project is still in a very early, prototypy state. The code still needs a lot of cleanup and many features and syscalls need to be implemented. However, constant progress is being made :)
@@ -83,6 +83,12 @@ Release build:
cmake --workflow --preset=release
```
## Dumping the Registry
The emulator needs a registry dump to run, otherwise it will print `Bad hive file` errors.
You can create one by running the <a href="./src/grab-registry.bat">src/grab-registry.bat</a> script as administrator.
This will create a `registry` folder that needs to be placed in the working directory of the emulator.
## Running Tests
The project uses CTest for testing. Choose your preferred method:

2
deps/googletest vendored

Submodule deps/googletest updated: 35d0c36560...7d76a231b0

187
src/analyzer/main.cpp
View File

@@ -5,19 +5,24 @@
#include "object_watching.hpp"
bool use_gdb = false;
namespace
{
void watch_system_objects(windows_emulator& win_emu)
struct analysis_options
{
//watch_object(win_emu, *win_emu.current_thread().teb);
//watch_object(win_emu, win_emu.process().peb);
//watch_object(win_emu, win_emu.process().kusd);
auto* params_hook = watch_object(win_emu, win_emu.process().process_params);
bool use_gdb{false};
bool concise_logging{false};
};
void watch_system_objects(windows_emulator& win_emu, const bool cache_logging)
{
watch_object(win_emu, *win_emu.current_thread().teb, cache_logging);
watch_object(win_emu, win_emu.process().peb, cache_logging);
watch_object(win_emu, emulator_object<KUSER_SHARED_DATA64>{win_emu.emu(), kusd_mmio::address()}, cache_logging);
auto* params_hook = watch_object(win_emu, win_emu.process().process_params, cache_logging);
win_emu.emu().hook_memory_write(win_emu.process().peb.value() + offsetof(PEB64, ProcessParameters), 0x8,
[&](const uint64_t address, size_t, const uint64_t value)
[&, cache_logging](const uint64_t address, size_t, const uint64_t value)
{
const auto target_address = win_emu.process().peb.value() + offsetof(
PEB64, ProcessParameters);
@@ -29,18 +34,18 @@ namespace
};
win_emu.emu().delete_hook(params_hook);
params_hook = watch_object(win_emu, obj);
params_hook = watch_object(win_emu, obj, cache_logging);
}
});
}
void run_emulation(windows_emulator& win_emu)
void run_emulation(windows_emulator& win_emu, const analysis_options& options)
{
try
{
if (use_gdb)
if (options.use_gdb)
{
const auto* address = "0.0.0.0:28960";
const auto* address = "127.0.0.1:28960";
win_emu.logger.print(color::pink, "Waiting for GDB connection on %s...\n", address);
win_x64_gdb_stub_handler handler{win_emu};
@@ -51,6 +56,12 @@ namespace
win_emu.start();
}
}
catch (const std::exception& e)
{
win_emu.logger.print(color::red, "Emulation failed at: 0x%llX - %s\n",
win_emu.emu().read_instruction_pointer(), e.what());
throw;
}
catch (...)
{
win_emu.logger.print(color::red, "Emulation failed at: 0x%llX\n", win_emu.emu().read_instruction_pointer());
@@ -68,80 +79,158 @@ namespace
}
}
std::vector<std::u16string> parse_arguments(char* argv[], const size_t argc)
std::vector<std::u16string> parse_arguments(const std::span<const std::string_view> args)
{
std::vector<std::u16string> args{};
args.reserve(argc - 1);
std::vector<std::u16string> wide_args{};
wide_args.reserve(args.size() - 1);
for (size_t i = 1; i < argc; ++i)
for (size_t i = 1; i < args.size(); ++i)
{
std::string_view arg(argv[i]);
args.emplace_back(arg.begin(), arg.end());
const auto& arg = args[i];
wide_args.emplace_back(arg.begin(), arg.end());
}
return args;
return wide_args;
}
void run(char* argv[], const size_t argc)
void run(const analysis_options& options, const std::span<const std::string_view> args)
{
if (argc < 1)
if (args.empty())
{
return;
}
const emulator_settings settings{
.application = argv[0],
.arguments = parse_arguments(argv, argc),
emulator_settings settings{
.application = args[0],
.arguments = parse_arguments(args),
.silent_until_main = options.concise_logging,
};
windows_emulator win_emu{settings};
windows_emulator win_emu{std::move(settings)};
(void)&watch_system_objects;
//watch_system_objects(win_emu);
watch_system_objects(win_emu, options.concise_logging);
win_emu.buffer_stdout = true;
//win_emu.verbose_calls = true;
const auto& exe = *win_emu.process().executable;
const auto text_start = exe.image_base + 0x1000;
const auto text_end = exe.image_base + 0x52000;
constexpr auto scan_size = 0x100;
const auto concise_logging = options.concise_logging;
win_emu.emu().hook_memory_read(text_start, scan_size, [&](const uint64_t address, size_t, uint64_t)
for (const auto& section : exe.sections)
{
if ((section.region.permissions & memory_permission::exec) != memory_permission::exec)
{
continue;
}
auto read_handler = [&, section, concise_logging](const uint64_t address, size_t, uint64_t)
{
const auto rip = win_emu.emu().read_instruction_pointer();
if (rip >= text_start && rip < text_end)
if (win_emu.process().module_manager.find_by_address(rip) != win_emu.process().executable)
{
win_emu.logger.print(color::green, "Reading from executable .text: 0x%llX at 0x%llX\n", address, rip);
return;
}
});
run_emulation(win_emu);
if (concise_logging)
{
static uint64_t count{0};
++count;
if (count > 100 && count % 10000 != 0) return;
}
win_emu.logger.print(
color::green,
"Reading from executable section %s at 0x%llX via 0x%llX\n",
section.name.c_str(), address, rip);
};
const auto write_handler = [&, section, concise_logging](const uint64_t address, size_t, uint64_t)
{
const auto rip = win_emu.emu().read_instruction_pointer();
if (win_emu.process().module_manager.find_by_address(rip) != win_emu.process().executable)
{
return;
}
if (concise_logging)
{
static uint64_t count{0};
++count;
if (count > 100 && count % 10000 != 0) return;
}
win_emu.logger.print(
color::blue,
"Writing to executable section %s at 0x%llX via 0x%llX\n",
section.name.c_str(), address, rip);
};
win_emu.emu().hook_memory_read(section.region.start, section.region.length, std::move(read_handler));
win_emu.emu().hook_memory_write(section.region.start, section.region.length, std::move(write_handler));
}
run_emulation(win_emu, options);
}
std::vector<std::string_view> bundle_arguments(const int argc, char** argv)
{
std::vector<std::string_view> args{};
for (int i = 1; i < argc; ++i)
{
args.push_back(argv[i]);
}
return args;
}
analysis_options parse_options(std::vector<std::string_view>& args)
{
analysis_options options{};
while (!args.empty())
{
auto arg_it = args.begin();
const auto& arg = *arg_it;
if (arg == "-d")
{
options.use_gdb = true;
}
else if (arg == "-c")
{
options.concise_logging = true;
}
else
{
break;
}
args.erase(arg_it);
}
return options;
}
}
int main(const int argc, char** argv)
{
if (argc <= 1)
{
puts("Application not specified!");
return 1;
}
//setvbuf(stdout, nullptr, _IOFBF, 0x10000);
if (argc > 2 && argv[1] == "-d"sv)
{
use_gdb = true;
}
try
{
auto args = bundle_arguments(argc, argv);
const auto options = parse_options(args);
if (args.empty())
{
throw std::runtime_error("Application not specified!");
}
do
{
const auto offset = use_gdb ? 2 : 1;
run(argv + offset, static_cast<size_t>(argc - offset));
run(options, args);
}
while (use_gdb);
while (options.use_gdb);
return 0;
}

27
src/analyzer/object_watching.hpp
View File

@@ -3,19 +3,38 @@
#include "reflect_type_info.hpp"
template <typename T>
emulator_hook* watch_object(windows_emulator& emu, emulator_object<T> object)
emulator_hook* watch_object(windows_emulator& emu, emulator_object<T> object, const bool cache_logging = false)
{
const reflect_type_info<T> info{};
return emu.emu().hook_memory_read(object.value(), object.size(),
[i = std::move(info), object, &emu](const uint64_t address, size_t, uint64_t)
[i = std::move(info), object, &emu, cache_logging](
const uint64_t address, size_t, uint64_t)
{
const auto rip = emu.emu().read_instruction_pointer();
const auto* mod = emu.process().module_manager.find_by_address(rip);
const auto is_main_access = mod == emu.process().executable;
if (!emu.verbose_calls && !is_main_access)
{
return;
}
if (cache_logging)
{
static std::unordered_set<uint64_t> logged_addresses{};
if (is_main_access && !logged_addresses.insert(address).second)
{
return;
}
}
const auto offset = address - object.value();
emu.logger.log("Object access: %s - 0x%llX (%s) at 0x%llX (%s)\n", i.get_type_name().c_str(),
emu.logger.print(is_main_access ? color::green : color::dark_gray,
"Object access: %s - 0x%llX (%s) at 0x%llX (%s)\n",
i.get_type_name().c_str(),
offset,
i.get_member_name(offset).c_str(), rip,
emu.process().module_manager.find_name(rip));
mod ? mod->name.c_str() : "<N/A>");
});
}

68
src/common/platform/file_management.hpp
View File

@@ -63,6 +63,10 @@
#define PS_ATTRIBUTE_INPUT 0x00020000 // input only
#define PS_ATTRIBUTE_ADDITIVE 0x00040000 // "accumulated" e.g. bitmasks, counters, etc.
#define SL_RESTART_SCAN 0x01
#define SL_RETURN_SINGLE_ENTRY 0x02
#define SL_NO_CURSOR_UPDATE 0x10
typedef enum _FSINFOCLASS
{
FileFsVolumeInformation = 1, // q: FILE_FS_VOLUME_INFORMATION
@@ -267,6 +271,70 @@ typedef struct _FILE_STANDARD_INFORMATION
BOOLEAN Directory;
} FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;
typedef struct _FILE_NAME_INFORMATION
{
ULONG FileNameLength;
char16_t FileName[1];
} FILE_NAME_INFORMATION, * PFILE_NAME_INFORMATION;
typedef struct _FILE_BASIC_INFORMATION
{
LARGE_INTEGER CreationTime; // Specifies the time that the file was created.
LARGE_INTEGER LastAccessTime; // Specifies the time that the file was last accessed.
LARGE_INTEGER LastWriteTime; // Specifies the time that the file was last written to.
LARGE_INTEGER ChangeTime; // Specifies the last time the file was changed.
ULONG FileAttributes; // Specifies one or more FILE_ATTRIBUTE_XXX flags.
} FILE_BASIC_INFORMATION, * PFILE_BASIC_INFORMATION;
typedef struct _FILE_DIRECTORY_INFORMATION
{
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
char16_t FileName[1];
} FILE_DIRECTORY_INFORMATION, * PFILE_DIRECTORY_INFORMATION;
typedef struct _FILE_FULL_DIR_INFORMATION
{
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
ULONG EaSize;
char16_t FileName[1];
} FILE_FULL_DIR_INFORMATION, * PFILE_FULL_DIR_INFORMATION;
typedef struct _FILE_BOTH_DIR_INFORMATION
{
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
ULONG EaSize;
CCHAR ShortNameLength;
WCHAR ShortName[12];
char16_t FileName[1];
} FILE_BOTH_DIR_INFORMATION, * PFILE_BOTH_DIR_INFORMATION;
#ifndef OS_WINDOWS
typedef BOOLEAN SECURITY_CONTEXT_TRACKING_MODE,
* PSECURITY_CONTEXT_TRACKING_MODE;

47
src/common/platform/kernel_mapped.hpp
View File

@@ -825,3 +825,50 @@ typedef struct _PROCESS_BASIC_INFORMATION64
EMULATOR_CAST(std::uint64_t, HANDLE) UniqueProcessId;
EMULATOR_CAST(std::uint64_t, HANDLE) InheritedFromUniqueProcessId;
} PROCESS_BASIC_INFORMATION64, *PPROCESS_BASIC_INFORMATION64;
typedef struct _KERNEL_USER_TIMES
{
LARGE_INTEGER CreateTime;
LARGE_INTEGER ExitTime;
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
} KERNEL_USER_TIMES, * PKERNEL_USER_TIMES;
struct THREAD_TLS_INFO
{
ULONG Flags;
union
{
EmulatorTraits<Emu64>::PVOID* TlsVector;
PVOID TlsModulePointer;
};
EMULATOR_CAST(std::uint64_t, ULONG_PTR) ThreadId;
};
static_assert(sizeof(THREAD_TLS_INFO) == 0x18);
typedef enum _PROCESS_TLS_INFORMATION_TYPE
{
ProcessTlsReplaceIndex,
ProcessTlsReplaceVector,
MaxProcessTlsOperation
} PROCESS_TLS_INFORMATION_TYPE, * PPROCESS_TLS_INFORMATION_TYPE;
struct PROCESS_TLS_INFO
{
ULONG Unknown;
PROCESS_TLS_INFORMATION_TYPE TlsRequest;
ULONG ThreadDataCount;
union
{
ULONG TlsIndex;
ULONG TlsVectorLength;
};
THREAD_TLS_INFO ThreadData[1];
};
static_assert(sizeof(PROCESS_TLS_INFO) - sizeof(THREAD_TLS_INFO) == 0x10);

11
src/common/platform/process.hpp
View File

@@ -679,6 +679,17 @@ struct TOKEN_USER64 {
SID_AND_ATTRIBUTES64 User;
};
typedef struct _TOKEN_SECURITY_ATTRIBUTES_INFORMATION
{
USHORT Version;
USHORT Reserved;
ULONG AttributeCount;
union
{
EmulatorTraits<Emu64>::PVOID pAttributeV1;
} Attribute;
} TOKEN_SECURITY_ATTRIBUTES_INFORMATION, * PTOKEN_SECURITY_ATTRIBUTES_INFORMATION;
struct GDI_HANDLE_ENTRY64
{
union

5
src/common/platform/status.hpp
View File

@@ -16,10 +16,15 @@ using NTSTATUS = std::uint32_t;
#endif
#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)
#define STATUS_WAIT_1 ((NTSTATUS)0x00000001L)
#define STATUS_UNSUCCESSFUL ((NTSTATUS)0x00000001L)
#define STATUS_ALERTED ((NTSTATUS)0x00000101L)
#define STATUS_OBJECT_NAME_EXISTS ((NTSTATUS)0x40000000L)
#define STATUS_NO_MORE_FILES ((NTSTATUS)0x80000006L)
#define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L)
#define STATUS_BUFFER_TOO_SMALL ((NTSTATUS)0xC0000023L)
#define STATUS_OBJECT_NAME_NOT_FOUND ((NTSTATUS)0xC0000034L)

9
src/common/platform/synchronisation.hpp
View File

@@ -6,3 +6,12 @@ typedef enum _EVENT_TYPE
NotificationEvent,
SynchronizationEvent
} EVENT_TYPE;
typedef enum _WAIT_TYPE
{
WaitAll,
WaitAny,
WaitNotification,
WaitDequeue,
WaitDpc,
} WAIT_TYPE;

6
src/common/platform/unicode.hpp
View File

@@ -9,7 +9,7 @@ struct UNICODE_STRING {
EMULATOR_CAST(typename Traits::PVOID, char16_t*) Buffer;
};
inline std::string u16_to_u8(std::u16string_view u16_view) {
inline std::string u16_to_u8(const std::u16string_view u16_view) {
std::string utf8_str;
utf8_str.reserve(u16_view.size() * 2);
for (char16_t ch : u16_view) {
@@ -27,7 +27,7 @@ inline std::string u16_to_u8(std::u16string_view u16_view) {
return utf8_str;
}
inline std::string w_to_u8(std::wstring_view w_view) {
inline std::string w_to_u8(const std::wstring_view w_view) {
std::string utf8_str;
utf8_str.reserve(w_view.size() * 2);
for (char16_t ch : w_view) {
@@ -56,7 +56,7 @@ inline std::string w_to_u8(std::wstring_view w_view) {
return std::wstring(reinterpret_cast<const wchar_t*>(u16str.data()), u16str.size());
}
inline auto open_unicode(FILE** handle, std::u16string fileName, std::u16string mode)
inline auto open_unicode(FILE** handle, const std::u16string& fileName, const std::u16string& mode)
{
return _wfopen_s(handle, u16_to_w(fileName).c_str(), u16_to_w(mode).c_str());
}

50
src/common/utils/string.hpp Normal file
View File

@@ -0,0 +1,50 @@
#pragma once
#include <string>
#include <ranges>
#include <cwctype>
#include <algorithm>
namespace utils::string
{
inline char char_to_lower(const char val)
{
return static_cast<char>(std::tolower(static_cast<unsigned char>(val)));
}
inline char16_t char_to_lower(const char16_t val)
{
if (val >= u'A' && val <= u'Z')
{
return val + 32;
}
return val;
}
inline wchar_t char_to_lower(const wchar_t val)
{
return std::towlower(val);
}
template <class Elem, class Traits, class Alloc>
void to_lower_inplace(std::basic_string<Elem, Traits, Alloc>& str)
{
std::ranges::transform(str, str.begin(), [](const Elem e)
{
return char_to_lower(e);
});
}
template <class Elem, class Traits, class Alloc>
std::basic_string<Elem, Traits, Alloc> to_lower(std::basic_string<Elem, Traits, Alloc> str)
{
to_lower_inplace(str);
return str;
}
template <class Elem, class Traits, class Alloc>
std::basic_string<Elem, Traits, Alloc> to_lower_consume(std::basic_string<Elem, Traits, Alloc>& str)
{
return to_lower(std::move(str));
}
}

4
src/emulator/memory_manager.cpp
View File

@@ -445,7 +445,7 @@ region_info memory_manager::get_region_info(const uint64_t address)
region_info result{};
result.start = MIN_ALLOCATION_ADDRESS;
result.length = MAX_ALLOCATION_ADDRESS - result.start;
result.pemissions = memory_permission::none;
result.permissions = memory_permission::none;
result.allocation_base = {};
result.allocation_length = result.length;
result.is_committed = false;
@@ -506,7 +506,7 @@ region_info memory_manager::get_region_info(const uint64_t address)
result.is_committed = true;
result.start = committed_entry->first;
result.length = committed_entry->second.length;
result.pemissions = committed_entry->second.pemissions;
result.permissions = committed_entry->second.pemissions;
return result;
}

6
src/emulator/memory_manager.hpp
View File

@@ -71,6 +71,12 @@ public:
this->write_memory(address, &value, sizeof(value));
}
template <typename T>
void write_memory(void* address, const T& value)
{
this->write_memory(reinterpret_cast<uint64_t>(address), &value, sizeof(value));
}
void write_memory(void* address, const void* data, const size_t size)
{
this->write_memory(reinterpret_cast<uint64_t>(address), data, size);

2
src/emulator/memory_region.hpp
View File

@@ -6,7 +6,7 @@ struct basic_memory_region
{
uint64_t start{};
size_t length{};
memory_permission pemissions{};
memory_permission permissions{};
};
struct memory_region : basic_memory_region

4
src/fuzzer/main.cpp
View File

@@ -144,11 +144,11 @@ namespace
void run(const std::string_view application)
{
const emulator_settings settings{
emulator_settings settings{
.application = application,
};
windows_emulator win_emu{settings};
windows_emulator win_emu{std::move(settings)};
forward_emulator(win_emu);
run_fuzzer(win_emu);

119
src/test-sample/test.cpp
View File

@@ -6,6 +6,7 @@
#include <atomic>
#include <vector>
#include <optional>
#include <filesystem>
#include <string_view>
#include <Windows.h>
@@ -16,6 +17,18 @@ using namespace std::literals;
// to trick compiler optimizations
__declspec(dllexport) bool do_the_task = true;
struct tls_struct
{
DWORD num = 1337;
tls_struct()
{
num = GetCurrentThreadId();
}
};
thread_local tls_struct tls_var{};
// getenv is broken right now :(
std::string read_env(const char* env)
{
@@ -58,6 +71,50 @@ bool test_threads()
return counter == (thread_count * 3ULL);
}
bool test_tls()
{
std::atomic_bool kill{false};
std::atomic_uint32_t successes{0};
constexpr uint32_t thread_count = 2;
std::vector<std::thread> ts{};
kill = false;
for (size_t i = 0; i < thread_count; ++i)
{
ts.emplace_back([&]
{
while (!kill)
{
std::this_thread::yield();
}
if (tls_var.num == GetCurrentThreadId())
{
++successes;
}
});
}
LoadLibraryA("d3dcompiler_47.dll");
LoadLibraryA("dsound.dll");
/*LoadLibraryA("d3d9.dll");
LoadLibraryA("dxgi.dll");
LoadLibraryA("wlanapi.dll");*/
kill = true;
for (auto& t : ts)
{
if (t.joinable())
{
t.join();
}
}
return successes == thread_count;
}
bool test_env()
{
const auto computername = read_env("COMPUTERNAME");
@@ -97,6 +154,22 @@ bool test_io()
return text == buffer;
}
bool test_dir_io()
{
size_t count = 0;
for (auto i : std::filesystem::directory_iterator(R"(C:\Windows\System32\)"))
{
++count;
if (count > 30)
{
return true;
}
}
return count > 30;
}
std::optional<std::string> read_registry_string(const HKEY root, const char* path, const char* value)
{
HKEY key{};
@@ -161,7 +234,7 @@ bool test_exceptions()
}
}
void throw_native_exception()
void throw_access_violation()
{
if (do_the_task)
{
@@ -169,19 +242,55 @@ void throw_native_exception()
}
}
bool test_native_exceptions()
bool test_access_violation_exception()
{
__try
{
throw_native_exception();
throw_access_violation();
return false;
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
return true;
return GetExceptionCode() == STATUS_ACCESS_VIOLATION;
}
}
bool test_ud2_exception(void* address)
{
__try
{
static_cast<void(*)()>(address)();
return false;
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
return GetExceptionCode() == STATUS_ILLEGAL_INSTRUCTION;
}
}
bool test_illegal_instruction_exception()
{
const auto address = VirtualAlloc(nullptr, 0x1000, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (!address)
{
return false;
}
memcpy(address, "\x0F\x0B", 2); // ud2
const auto res = test_ud2_exception(address);
VirtualFree(address, 0x1000, MEM_RELEASE);
return res;
}
bool test_native_exceptions()
{
return test_access_violation_exception()
&& test_illegal_instruction_exception();
}
void print_time()
{
const auto epoch_time = std::chrono::system_clock::now().time_since_epoch();
@@ -207,11 +316,13 @@ int main(int argc, const char* argv[])
bool valid = true;
RUN_TEST(test_io, "I/O")
RUN_TEST(test_dir_io, "Dir I/O")
RUN_TEST(test_registry, "Registry")
RUN_TEST(test_threads, "Threads")
RUN_TEST(test_env, "Environment")
RUN_TEST(test_exceptions, "Exceptions")
RUN_TEST(test_native_exceptions, "Native Exceptions")
RUN_TEST(test_tls, "TLS")
return valid ? 0 : 1;
}

1
src/unicorn-emulator/unicorn_x64_emulator.cpp
View File

@@ -243,6 +243,7 @@ namespace unicorn
unicorn_x64_emulator()
{
uce(uc_open(UC_ARCH_X86, UC_MODE_64, &this->uc_));
uce(uc_ctl_set_tcg_buffer_size(this->uc_, 2 << 30 /* 2 gb */));
}
~unicorn_x64_emulator() override

6
src/windows-emulator-test/emulation_test_utils.hpp
View File

@@ -20,10 +20,10 @@
namespace test
{
inline windows_emulator create_sample_emulator(emulator_settings& settings)
inline windows_emulator create_sample_emulator(emulator_settings settings)
{
settings.application = "./test-sample.exe";
return windows_emulator{settings};
return windows_emulator{std::move(settings)};
}
inline windows_emulator create_sample_emulator()
@@ -34,6 +34,6 @@ namespace test
.use_relative_time = true,
};
return create_sample_emulator(settings);
return create_sample_emulator(std::move(settings));
}
}

13
src/windows-emulator/emulator_utils.hpp
View File

@@ -101,6 +101,14 @@ public:
this->emu_->write_memory(this->address_ + index * this->size(), &value, sizeof(value));
}
void write_if_valid(const T& value, const size_t index = 0) const
{
if (this->operator bool())
{
this->write(value, index);
}
}
template <typename F>
void access(const F& accessor, const size_t index = 0) const
{
@@ -122,6 +130,11 @@ public:
buffer.read(this->address_);
}
void set_address(const uint64_t address)
{
this->address_ = address;
}
private:
emulator* emu_{};
uint64_t address_{};

40
src/windows-emulator/handles.hpp
View File

@@ -15,6 +15,8 @@ struct handle_types
port,
thread,
registry,
mutant,
token,
};
};
@@ -24,7 +26,8 @@ struct handle_value
{
uint64_t id : 32;
uint64_t type : 16;
uint64_t padding : 15;
uint64_t padding : 14;
uint64_t is_system : 1;
uint64_t is_pseudo : 1;
};
#pragma pack(pop)
@@ -73,11 +76,19 @@ constexpr handle make_handle(const uint32_t id, const handle_types::type type, c
value.padding = 0;
value.id = id;
value.type = type;
value.is_system = false;
value.is_pseudo = is_pseudo;
return {value};
}
constexpr handle make_handle(const uint64_t value)
{
handle h{};
h.bits = value;
return h;
}
constexpr handle make_pseudo_handle(const uint32_t id, const handle_types::type type)
{
return make_handle(id, type, true);
@@ -97,9 +108,15 @@ namespace handle_detail
};
}
struct generic_handle_store
{
virtual ~generic_handle_store() = default;
virtual bool erase(const handle h) = 0;
};
template <handle_types::type Type, typename T, uint32_t IndexShift = 0>
requires(utils::Serializable<T>)
class handle_store
class handle_store : public generic_handle_store
{
public:
using index_type = uint32_t;
@@ -199,7 +216,7 @@ public:
return this->erase(entry);
}
bool erase(const handle h)
bool erase(const handle h) override
{
return this->erase(h.value);
}
@@ -328,10 +345,21 @@ private:
value_map store_{};
};
constexpr auto KNOWN_DLLS_DIRECTORY = make_pseudo_handle(0x1337, handle_types::directory);
constexpr auto KNOWN_DLLS_SYMLINK = make_pseudo_handle(0x1337, handle_types::symlink);
constexpr auto SHARED_SECTION = make_pseudo_handle(0x1337, handle_types::section);
constexpr auto KNOWN_DLLS_DIRECTORY = make_pseudo_handle(0x1, handle_types::directory);
constexpr auto BASE_NAMED_OBJECTS_DIRECTORY = make_pseudo_handle(0x2, handle_types::directory);
constexpr auto KNOWN_DLLS_SYMLINK = make_pseudo_handle(0x1, handle_types::symlink);
constexpr auto SHARED_SECTION = make_pseudo_handle(0x1, handle_types::section);
constexpr auto CONSOLE_HANDLE = make_pseudo_handle(0x1, handle_types::file);
constexpr auto STDOUT_HANDLE = make_pseudo_handle(0x2, handle_types::file);
constexpr auto STDIN_HANDLE = make_pseudo_handle(0x3, handle_types::file);
constexpr auto DUMMY_IMPERSONATION_TOKEN = make_pseudo_handle(0x1, handle_types::token);
constexpr auto CURRENT_PROCESS = make_handle(~0ULL);
constexpr auto CURRENT_THREAD = make_handle(~1ULL);
constexpr auto CURRENT_PROCESS_TOKEN = make_handle(~3ULL);
constexpr auto CURRENT_THREAD_TOKEN = make_handle(~4ULL);
constexpr auto CURRENT_THREAD_EFFECTIVE_TOKEN = make_handle(~5ULL);

1
src/windows-emulator/io_device.cpp
View File

@@ -16,6 +16,7 @@ std::unique_ptr<io_device> create_device(const std::u16string_view device)
{
if (device == u"CNG"
|| device == u"KsecDD"
|| device == u"PcwDrv"
|| device == u"DeviceApi\\CMApi"
|| device == u"ConDrv\\Server")
{

5
src/windows-emulator/logger.hpp
View File

@@ -54,6 +54,11 @@ public:
this->disable_output_ = value;
}
bool is_output_disabled() const
{
return this->disable_output_;
}
private:
bool disable_output_{false};
};

9
src/windows-emulator/module/mapped_module.hpp
View File

@@ -1,4 +1,5 @@
#pragma once
#include <memory_region.hpp>
struct exported_symbol
{
@@ -11,6 +12,12 @@ struct exported_symbol
using exported_symbols = std::vector<exported_symbol>;
using address_name_mapping = std::map<uint64_t, std::string>;
struct mapped_section
{
std::string name{};
basic_memory_region region{};
};
struct mapped_module
{
std::string name{};
@@ -23,6 +30,8 @@ struct mapped_module
exported_symbols exports{};
address_name_mapping address_names{};
std::vector<mapped_section> sections{};
bool is_within(const uint64_t address) const
{
return address >= this->image_base && address < (this->image_base + this->size_of_image);

62
src/windows-emulator/module/module_manager.cpp
View File

@@ -3,6 +3,22 @@
#include "module_mapping.hpp"
#include "windows-emulator/logger.hpp"
namespace
{
std::filesystem::path canonicalize_module_path(const std::filesystem::path& file)
{
constexpr std::u16string_view nt_prefix = u"\\??\\";
const auto wide_file = file.u16string();
if (!wide_file.starts_with(nt_prefix))
{
return canonical(absolute(file));
}
return canonicalize_module_path(wide_file.substr(nt_prefix.size()));
}
}
static void serialize(utils::buffer_serializer& buffer, const exported_symbol& sym)
{
buffer.write(sym.name);
@@ -22,7 +38,7 @@ static void deserialize(utils::buffer_deserializer& buffer, exported_symbol& sym
static void serialize(utils::buffer_serializer& buffer, const mapped_module& mod)
{
buffer.write_string(mod.name);
buffer.write_string(mod.path.wstring());
buffer.write(mod.path.u16string());
buffer.write(mod.image_base);
buffer.write(mod.size_of_image);
@@ -35,7 +51,7 @@ static void serialize(utils::buffer_serializer& buffer, const mapped_module& mod
static void deserialize(utils::buffer_deserializer& buffer, mapped_module& mod)
{
mod.name = buffer.read_string();
mod.path = buffer.read_string<wchar_t>();
mod.path = buffer.read_string<std::u16string::value_type>();
buffer.read(mod.image_base);
buffer.read(mod.size_of_image);
@@ -52,7 +68,7 @@ module_manager::module_manager(emulator& emu)
mapped_module* module_manager::map_module(const std::filesystem::path& file, logger& logger)
{
const auto canonical_file = canonical(absolute(file));
auto canonical_file = canonicalize_module_path(file);
for (auto& mod : this->modules_)
{
@@ -62,18 +78,26 @@ mapped_module* module_manager::map_module(const std::filesystem::path& file, log
}
}
auto mod = map_module_from_file(*this->emu_, std::move(canonical_file));
if (!mod)
try
{
logger.error("Failed to map %s\n", file.generic_string().c_str());
auto mod = map_module_from_file(*this->emu_, std::move(canonical_file));
logger.log("Mapped %s at 0x%llX\n", mod.path.generic_string().c_str(), mod.image_base);
const auto image_base = mod.image_base;
const auto entry = this->modules_.try_emplace(image_base, std::move(mod));
return &entry.first->second;
}
catch (const std::exception& e)
{
logger.error("Failed to map %s: %s\n", file.generic_string().c_str(), e.what());
return nullptr;
}
catch (...)
{
logger.error("Failed to map %s: Unknown error\n", file.generic_string().c_str());
return nullptr;
}
logger.log("Mapped %s at 0x%llX\n", mod->path.generic_string().c_str(), mod->image_base);
const auto image_base = mod->image_base;
const auto entry = this->modules_.try_emplace(image_base, std::move(*mod));
return &entry.first->second;
}
void module_manager::serialize(utils::buffer_serializer& buffer) const
@@ -85,3 +109,17 @@ void module_manager::deserialize(utils::buffer_deserializer& buffer)
{
buffer.read_map(this->modules_);
}
bool module_manager::unmap(const uint64_t address)
{
const auto mod = this->modules_.find(address);
if (mod == this->modules_.end())
{
return false;
}
unmap_module(*this->emu_, mod->second);
this->modules_.erase(mod);
return true;
}

2
src/windows-emulator/module/module_manager.hpp
View File

@@ -36,6 +36,8 @@ public:
void serialize(utils::buffer_serializer& buffer) const;
void deserialize(utils::buffer_deserializer& buffer);
bool unmap(const uint64_t address);
private:
emulator* emu_{};

58
src/windows-emulator/module/module_mapping.cpp
View File

@@ -19,7 +19,7 @@ namespace
return nt_headers_offset + (first_section_absolute - absolute_base);
}
std::vector<uint8_t> read_mapped_memory(emulator& emu, const mapped_module& binary)
std::vector<uint8_t> read_mapped_memory(const emulator& emu, const mapped_module& binary)
{
std::vector<uint8_t> memory{};
memory.resize(binary.size_of_image);
@@ -40,20 +40,24 @@ namespace
const auto export_directory = buffer.as<IMAGE_EXPORT_DIRECTORY>(export_directory_entry.
VirtualAddress).get();
//const auto function_count = export_directory->NumberOfFunctions;
const auto names_count = export_directory.NumberOfNames;
//const auto function_count = export_directory.NumberOfFunctions;
const auto names = buffer.as<DWORD>(export_directory.AddressOfNames);
const auto ordinals = buffer.as<WORD>(export_directory.AddressOfNameOrdinals);
const auto functions = buffer.as<DWORD>(export_directory.AddressOfFunctions);
binary.exports.reserve(names_count);
for (DWORD i = 0; i < names_count; i++)
{
const auto ordinal = ordinals.get(i);
exported_symbol symbol{};
symbol.ordinal = ordinals.get(i);
symbol.name = buffer.as_string(names.get(i));
symbol.rva = functions.get(symbol.ordinal);
symbol.ordinal = export_directory.Base + ordinal;
symbol.rva = functions.get(ordinal);
symbol.address = binary.image_base + symbol.rva;
symbol.name = buffer.as_string(names.get(i));
binary.exports.push_back(std::move(symbol));
}
@@ -137,7 +141,7 @@ namespace
}
}
void map_sections(emulator& emu, const mapped_module& binary,
void map_sections(emulator& emu, mapped_module& binary,
const utils::safe_buffer_accessor<const uint8_t> buffer,
const PENTHeaders_t<std::uint64_t>& nt_headers, const uint64_t nt_headers_offset)
{
@@ -176,10 +180,23 @@ namespace
const auto size_of_section = page_align_up(std::max(section.SizeOfRawData, section.Misc.VirtualSize));
emu.protect_memory(target_ptr, size_of_section, permissions, nullptr);
mapped_section section_info{};
section_info.region.start = target_ptr;
section_info.region.length = size_of_section;
section_info.region.permissions = permissions;
for (size_t j = 0; j < sizeof(section.Name) && section.Name[j]; ++j)
{
section_info.name.push_back(static_cast<char>(section.Name[j]));
}
binary.sections.push_back(std::move(section_info));
}
}
}
std::optional<mapped_module> map_module(emulator& emu, const std::span<const uint8_t> data,
mapped_module map_module_from_data(emulator& emu, const std::span<const uint8_t> data,
std::filesystem::path file)
{
mapped_module binary{};
@@ -194,8 +211,13 @@ namespace
const auto nt_headers = buffer.as<PENTHeaders_t<std::uint64_t>>(nt_headers_offset).get();
auto& optional_header = nt_headers.OptionalHeader;
if (nt_headers.FileHeader.Machine != PEMachineType::AMD64)
{
throw std::runtime_error("Unsupported architecture!");
}
binary.image_base = optional_header.ImageBase;
binary.size_of_image = optional_header.SizeOfImage; // TODO: Sanitize
binary.size_of_image = page_align_up(optional_header.SizeOfImage); // TODO: Sanitize
if (!emu.allocate_memory(binary.image_base, binary.size_of_image, memory_permission::read))
{
@@ -208,7 +230,7 @@ namespace
if (!is_relocatable || !emu.allocate_memory(binary.image_base, binary.size_of_image,
memory_permission::read))
{
return {};
throw std::runtime_error("Memory range not allocatable");
}
}
@@ -230,27 +252,13 @@ namespace
return binary;
}
}
std::optional<mapped_module> map_module_from_data(emulator& emu, const std::span<const uint8_t> data,
std::filesystem::path file)
{
try
{
return map_module(emu, data, std::move(file));
}
catch (...)
{
return {};
}
}
std::optional<mapped_module> map_module_from_file(emulator& emu, std::filesystem::path file)
mapped_module map_module_from_file(emulator& emu, std::filesystem::path file)
{
const auto data = utils::io::read_file(file);
if (data.empty())
{
return {};
throw std::runtime_error("Bad file data");
}
return map_module_from_data(emu, data, std::move(file));

4
src/windows-emulator/module/module_mapping.hpp
View File

@@ -3,8 +3,8 @@
#include <x64_emulator.hpp>
#include "mapped_module.hpp"
std::optional<mapped_module> map_module_from_data(emulator& emu, std::span<const uint8_t> data,
mapped_module map_module_from_data(emulator& emu, std::span<const uint8_t> data,
std::filesystem::path file);
std::optional<mapped_module> map_module_from_file(emulator& emu, std::filesystem::path file);
mapped_module map_module_from_file(emulator& emu, std::filesystem::path file);
bool unmap_module(emulator& emu, const mapped_module& mod);

161
src/windows-emulator/process_context.hpp
View File

@@ -84,25 +84,159 @@ struct event : ref_counted_object
}
};
struct mutant : ref_counted_object
{
uint32_t locked_count{0};
uint32_t owning_thread_id{};
std::u16string name{};
bool try_lock(const uint32_t thread_id)
{
if (this->locked_count == 0)
{
++this->locked_count;
this->owning_thread_id = thread_id;
return true;
}
if (this->owning_thread_id != thread_id)
{
return false;
}
++this->locked_count;
return true;
}
uint32_t release()
{
const auto old_count = this->locked_count;
if (this->locked_count <= 0)
{
return old_count;
}
--this->locked_count;
return old_count;
}
void serialize(utils::buffer_serializer& buffer) const
{
buffer.write(this->locked_count);
buffer.write(this->owning_thread_id);
buffer.write(this->name);
ref_counted_object::serialize(buffer);
}
void deserialize(utils::buffer_deserializer& buffer)
{
buffer.read(this->locked_count);
buffer.read(this->owning_thread_id);
buffer.read(this->name);
ref_counted_object::deserialize(buffer);
}
};
struct file_entry
{
std::filesystem::path file_path{};
void serialize(utils::buffer_serializer& buffer) const
{
buffer.write(this->file_path);
}
void deserialize(utils::buffer_deserializer& buffer)
{
buffer.read(this->file_path);
}
};
struct file_enumeration_state
{
size_t current_index{0};
std::vector<file_entry> files{};
void serialize(utils::buffer_serializer& buffer) const
{
buffer.write(this->current_index);
buffer.write_vector(this->files);
}
void deserialize(utils::buffer_deserializer& buffer)
{
buffer.read(this->current_index);
buffer.read_vector(this->files);
}
};
struct file
{
utils::file_handle handle{};
std::u16string name{};
std::optional<file_enumeration_state> enumeration_state{};
bool is_file() const
{
return this->handle;
}
bool is_directory() const
{
return !this->is_file();
}
void serialize(utils::buffer_serializer& buffer) const
{
buffer.write(this->name);
// TODO: Serialize handle
buffer.write(this->name);
buffer.write_optional(this->enumeration_state);
}
void deserialize(utils::buffer_deserializer& buffer)
{
buffer.read(this->name);
buffer.read_optional(this->enumeration_state);
this->handle = {};
}
};
struct semaphore
struct section
{
std::u16string name{};
std::u16string file_name{};
uint64_t maximum_size{};
uint32_t section_page_protection{};
uint32_t allocation_attributes{};
bool is_image() const
{
return this->allocation_attributes & SEC_IMAGE;
}
void serialize(utils::buffer_serializer& buffer) const
{
buffer.write(this->name);
buffer.write(this->file_name);
buffer.write(this->maximum_size);
buffer.write(this->section_page_protection);
buffer.write(this->allocation_attributes);
}
void deserialize(utils::buffer_deserializer& buffer)
{
buffer.read(this->name);
buffer.read(this->file_name);
buffer.read(this->maximum_size);
buffer.read(this->section_page_protection);
buffer.read(this->allocation_attributes);
}
};
struct semaphore : ref_counted_object
{
std::u16string name{};
volatile uint32_t current_count{};
@@ -113,6 +247,8 @@ struct semaphore
buffer.write(this->name);
buffer.write(this->current_count);
buffer.write(this->max_count);
ref_counted_object::serialize(buffer);
}
void deserialize(utils::buffer_deserializer& buffer)
@@ -120,6 +256,8 @@ struct semaphore
buffer.read(this->name);
buffer.read(this->current_count);
buffer.read(this->max_count);
ref_counted_object::deserialize(buffer);
}
};
@@ -221,7 +359,8 @@ public:
std::u16string name{};
std::optional<NTSTATUS> exit_status{};
std::optional<handle> await_object{};
std::vector<handle> await_objects{};
bool await_any{false};
bool waiting_for_alert{false};
bool alerted{false};
std::optional<std::chrono::steady_clock::time_point> await_time{};
@@ -285,7 +424,8 @@ public:
buffer.write_string(this->name);
buffer.write_optional(this->exit_status);
buffer.write_optional(this->await_object);
buffer.write_vector(this->await_objects);
buffer.write(this->await_any);
buffer.write(this->waiting_for_alert);
buffer.write(this->alerted);
@@ -317,7 +457,8 @@ public:
buffer.read_string(this->name);
buffer.read_optional(this->exit_status);
buffer.read_optional(this->await_object);
buffer.read_vector(this->await_objects);
buffer.read(this->await_any);
buffer.read(this->waiting_for_alert);
buffer.read(this->alerted);
@@ -395,13 +536,13 @@ struct process_context
uint64_t rtl_user_thread_start{};
uint64_t ki_user_exception_dispatcher{};
uint64_t shared_section_size{};
handle_store<handle_types::event, event> events{};
handle_store<handle_types::file, file> files{};
handle_store<handle_types::section, section> sections{};
handle_store<handle_types::device, io_device_container> devices{};
handle_store<handle_types::semaphore, semaphore> semaphores{};
handle_store<handle_types::port, port> ports{};
handle_store<handle_types::mutant, mutant> mutants{};
handle_store<handle_types::registry, registry_key, 2> registry_keys{};
std::map<uint16_t, std::wstring> atoms{};
@@ -433,12 +574,13 @@ struct process_context
buffer.write(this->rtl_user_thread_start);
buffer.write(this->ki_user_exception_dispatcher);
buffer.write(this->shared_section_size);
buffer.write(this->events);
buffer.write(this->files);
buffer.write(this->sections);
buffer.write(this->devices);
buffer.write(this->semaphores);
buffer.write(this->ports);
buffer.write(this->mutants);
buffer.write(this->registry_keys);
buffer.write_map(this->atoms);
@@ -475,12 +617,13 @@ struct process_context
buffer.read(this->rtl_user_thread_start);
buffer.read(this->ki_user_exception_dispatcher);
buffer.read(this->shared_section_size);
buffer.read(this->events);
buffer.read(this->files);
buffer.read(this->sections);
buffer.read(this->devices);
buffer.read(this->semaphores);
buffer.read(this->ports);
buffer.read(this->mutants);
buffer.read(this->registry_keys);
buffer.read_map(this->atoms);

10
src/windows-emulator/registry/hive_parser.cpp
View File

@@ -1,4 +1,5 @@
#include "hive_parser.hpp"
#include <utils/string.hpp>
// Based on this implementation: https://github.com/reahly/windows-hive-parser
@@ -130,11 +131,6 @@ namespace
throw std::runtime_error("Bad hive file '" + file_path.string() + "': " + e.what());
}
}
char char_to_lower(const char val)
{
return static_cast<char>(std::tolower(static_cast<unsigned char>(val)));
}
}
const hive_value* hive_key::get_value(std::ifstream& file, const std::string_view name)
@@ -188,7 +184,7 @@ void hive_key::parse(std::ifstream& file)
raw_value.data_offset = offset + static_cast<int>(offsetof(value_block_t, offset));
}
std::ranges::transform(value_name, value_name.begin(), char_to_lower);
utils::string::to_lower_inplace(value_name);
this->values_[std::move(value_name)] = std::move(raw_value);
}
@@ -211,7 +207,7 @@ void hive_key::parse(std::ifstream& file)
const auto subkey = read_file_object<key_block_t>(file, subkey_block_offset);
std::string subkey_name(subkey.name, std::min(subkey.len, static_cast<short>(sizeof(subkey.name))));
std::ranges::transform(subkey_name, subkey_name.begin(), char_to_lower);
utils::string::to_lower_inplace(subkey_name);
this->sub_keys_.emplace(std::move(subkey_name), hive_key{subkey.subkeys, subkey.value_count, subkey.offsets});
}

15
src/windows-emulator/registry/registry_manager.cpp
View File

@@ -1,25 +1,16 @@
#include "registry_manager.hpp"
#include <cwctype>
#include <serialization_helper.hpp>
#include "hive_parser.hpp"
#include <utils/string.hpp>
namespace
{
void string_to_lower(std::string& str)
{
std::ranges::transform(str, str.begin(), [](const char val)
{
return static_cast<char>(std::tolower(static_cast<unsigned char>(val)));
});
}
std::filesystem::path canonicalize_path(const std::filesystem::path& key)
{
auto path = key.lexically_normal().wstring();
std::ranges::transform(path, path.begin(), std::towlower);
return {std::move(path)};
return utils::string::to_lower_consume(path);
}
bool is_subpath(const std::filesystem::path& root, const std::filesystem::path& p)
@@ -144,7 +135,7 @@ std::optional<registry_key> registry_manager::get_key(const std::filesystem::pat
std::optional<registry_value> registry_manager::get_value(const registry_key& key, std::string name)
{
string_to_lower(name);
utils::string::to_lower_inplace(name);
const auto iterator = this->hives_.find(key.hive);
if (iterator == this->hives_.end())

37
src/windows-emulator/syscall_dispatcher.cpp
View File

@@ -24,15 +24,16 @@ void syscall_dispatcher::deserialize(utils::buffer_deserializer& buffer)
}
void syscall_dispatcher::setup(const exported_symbols& ntdll_exports, const exported_symbols& win32u_exports)
void syscall_dispatcher::setup(const exported_symbols& ntdll_exports, std::span<const std::byte> ntdll_data,
const exported_symbols& win32u_exports, std::span<const std::byte> win32u_data)
{
this->handlers_ = {};
const auto ntdll_syscalls = find_syscalls(ntdll_exports);
const auto win32u_syscalls = find_syscalls(win32u_exports);
const auto ntdll_syscalls = find_syscalls(ntdll_exports, ntdll_data);
const auto win32u_syscalls = find_syscalls(win32u_exports, win32u_data);
map_syscalls(this->handlers_, ntdll_syscalls, 0);
map_syscalls(this->handlers_, win32u_syscalls, 0x1000);
map_syscalls(this->handlers_, ntdll_syscalls);
map_syscalls(this->handlers_, win32u_syscalls);
this->add_handlers();
}
@@ -99,10 +100,26 @@ void syscall_dispatcher::dispatch(windows_emulator& win_emu)
}
else
{
win_emu.logger.print(color::dark_gray, "Executing syscall: %s (0x%X) at 0x%llX\n",
if (mod->is_within(context.previous_ip))
{
const auto rsp = c.emu.read_stack_pointer();
const auto return_address = c.emu.read_memory<uint64_t>(rsp);
const auto* mod_name = context.module_manager.find_name(return_address);
win_emu.logger.print(color::dark_gray, "Executing syscall: %s (0x%X) at 0x%llX via 0x%llX (%s) %lld\n",
entry->second.name.c_str(),
syscall_id, address, return_address, mod_name, c.proc.executed_instructions);
}
else
{
const auto* previous_mod = context.module_manager.find_by_address(context.previous_ip);
win_emu.logger.print(color::blue,
"Crafted out-of-line syscall: %s (0x%X) at 0x%llX (%s) via 0x%llX (%s)\n",
entry->second.name.c_str(),
syscall_id,
address);
address, mod ? mod->name.c_str() : "<N/A>", context.previous_ip,
previous_mod ? previous_mod->name.c_str() : "<N/A>");
}
}
entry->second.handler(c);
@@ -121,8 +138,8 @@ void syscall_dispatcher::dispatch(windows_emulator& win_emu)
}
}
syscall_dispatcher::syscall_dispatcher(const exported_symbols& ntdll_exports,
const exported_symbols& win32u_exports)
syscall_dispatcher::syscall_dispatcher(const exported_symbols& ntdll_exports, std::span<const std::byte> ntdll_data,
const exported_symbols& win32u_exports, std::span<const std::byte> win32u_data)
{
this->setup(ntdll_exports, win32u_exports);
this->setup(ntdll_exports, ntdll_data, win32u_exports, win32u_data);
}

6
src/windows-emulator/syscall_dispatcher.hpp
View File

@@ -17,14 +17,16 @@ class syscall_dispatcher
{
public:
syscall_dispatcher() = default;
syscall_dispatcher(const exported_symbols& ntdll_exports, const exported_symbols& win32u_exports);
syscall_dispatcher(const exported_symbols& ntdll_exports, std::span<const std::byte> ntdll_data,
const exported_symbols& win32u_exports, std::span<const std::byte> win32u_data);
void dispatch(windows_emulator& win_emu);
void serialize(utils::buffer_serializer& buffer) const;
void deserialize(utils::buffer_deserializer& buffer);
void setup(const exported_symbols& ntdll_exports, const exported_symbols& win32u_exports);
void setup(const exported_symbols& ntdll_exports, std::span<const std::byte> ntdll_data,
const exported_symbols& win32u_exports, std::span<const std::byte> win32u_data);
std::string get_syscall_name(const uint64_t id)
{

78
src/windows-emulator/syscall_utils.hpp
View File

@@ -38,32 +38,51 @@ inline bool is_syscall(const std::string_view name)
return name.starts_with("Nt") && name.size() > 3 && is_uppercase(name[2]);
}
inline std::vector<std::string> find_syscalls(const exported_symbols& exports)
inline std::optional<uint32_t> extract_syscall_id(const exported_symbol& symbol, std::span<const std::byte> data)
{
// Makes use of the fact that order of Nt* function addresses
// is equal to the order of syscall IDs.
// So first Nt* function is the first syscall with ID 0
if (!is_syscall(symbol.name))
{
return std::nullopt;
}
std::map<uint64_t, size_t> reference_count{};
std::map<uint64_t, std::string> ordered_syscalls{};
constexpr auto instruction_size = 5;
constexpr auto instruction_offset = 3;
constexpr auto instruction_operand_offset = 1;
constexpr auto instruction_opcode = static_cast<std::byte>(0xB8);
const auto instruction_rva = symbol.rva + instruction_offset;
if (data.size() < (instruction_rva + instruction_size) || data[instruction_rva] != instruction_opcode)
{
return std::nullopt;
}
uint32_t syscall_id{0};
static_assert(sizeof(syscall_id) <= (instruction_size - instruction_operand_offset));
memcpy(&syscall_id, data.data() + instruction_rva + instruction_operand_offset, sizeof(syscall_id));
return syscall_id;
}
inline std::map<uint64_t, std::string> find_syscalls(const exported_symbols& exports, std::span<const std::byte> data)
{
std::map<uint64_t, std::string> syscalls{};
for (const auto& symbol : exports)
{
if (is_syscall(symbol.name))
const auto id = extract_syscall_id(symbol, data);
if (id)
{
++reference_count[symbol.address];
ordered_syscalls[symbol.address] = symbol.name;
}
auto& entry = syscalls[*id];
if (!entry.empty())
{
throw std::runtime_error(
"Syscall with id " + std::to_string(*id) + ", which is mapping to " + symbol.name +
", was already mapped to " + entry);
}
std::vector<std::string> syscalls{};
syscalls.reserve(ordered_syscalls.size());
for (auto& syscall : ordered_syscalls)
{
if (reference_count[syscall.first] == 1)
{
syscalls.push_back(std::move(syscall.second));
entry = symbol.name;
}
}
@@ -71,14 +90,20 @@ inline std::vector<std::string> find_syscalls(const exported_symbols& exports)
}
inline void map_syscalls(std::map<uint64_t, syscall_handler_entry>& handlers,
const std::vector<std::string>& syscalls, const uint64_t base_index)
std::map<uint64_t, std::string> syscalls)
{
for (size_t i = 0; i < syscalls.size(); ++i)
for (auto& [id, name] : syscalls)
{
const auto& syscall = syscalls[i];
auto& entry = handlers[id];
auto& entry = handlers[base_index + i];
entry.name = syscall;
if (!entry.name.empty())
{
throw std::runtime_error(
"Syscall with id " + std::to_string(id) + ", which is mapping to " + name +
", was previously mapped to " + entry.name);
}
entry.name = std::move(name);
entry.handler = nullptr;
}
}
@@ -243,3 +268,10 @@ inline std::chrono::system_clock::time_point convert_from_ksystem_time(const vol
{
return convert_from_ksystem_time(*const_cast<const KSYSTEM_TIME*>(&time));
}
inline LARGE_INTEGER convert_unix_to_windows_time(const __time64_t unix_time)
{
LARGE_INTEGER windows_time{};
windows_time.QuadPart = (unix_time + EPOCH_DIFFERENCE_1601_TO_1970_SECONDS) * HUNDRED_NANOSECONDS_IN_ONE_SECOND;
return windows_time;
}

1105
src/windows-emulator/syscalls.cpp
View File

File diff suppressed because it is too large Load Diff

230
src/windows-emulator/windows_emulator.cpp
View File

@@ -175,7 +175,7 @@ namespace
std::filesystem::path canonicalize_path(const std::filesystem::path& path)
{
return canonical(absolute(path).parent_path()).make_preferred();
return canonical(absolute(path)).make_preferred();
}
void setup_context(windows_emulator& win_emu, const emulator_settings& settings)
@@ -268,6 +268,10 @@ namespace
peb.HeapDeCommitFreeBlockThreshold = 0x0000000000001000;
peb.NumberOfHeaps = 0x00000000;
peb.MaximumNumberOfHeaps = 0x00000010;
peb.OSPlatformId = 2;
peb.OSMajorVersion = 0x0000000a;
peb.OSBuildNumber = 0x00006c51;
});
}
@@ -426,6 +430,27 @@ namespace
dispatch_exception_pointers(emu, dispatcher, pointers);
}
void dispatch_illegal_instruction_violation(x64_emulator& emu, const uint64_t dispatcher)
{
CONTEXT64 ctx{};
ctx.ContextFlags = CONTEXT64_ALL;
context_frame::save(emu, ctx);
EXCEPTION_RECORD record{};
memset(&record, 0, sizeof(record));
record.ExceptionCode = static_cast<DWORD>(STATUS_ILLEGAL_INSTRUCTION);
record.ExceptionFlags = 0;
record.ExceptionRecord = nullptr;
record.ExceptionAddress = reinterpret_cast<void*>(emu.read_instruction_pointer());
record.NumberParameters = 0;
EMU_EXCEPTION_POINTERS<EmulatorTraits<Emu64>> pointers{};
pointers.ContextRecord = reinterpret_cast<EmulatorTraits<Emu64>::PVOID>(&ctx);
pointers.ExceptionRecord = reinterpret_cast<EmulatorTraits<Emu64>::PVOID>(&record);
dispatch_exception_pointers(emu, dispatcher, pointers);
}
void perform_context_switch_work(windows_emulator& win_emu)
{
auto& devices = win_emu.process().devices;
@@ -463,7 +488,7 @@ namespace
if (active_thread)
{
win_emu.logger.print(color::green, "Performing thread switch...\n");
win_emu.logger.print(color::dark_gray, "Performing thread switch...\n");
active_thread->save(emu);
}
@@ -524,7 +549,7 @@ namespace
return false;
}
bool is_object_signaled(process_context& c, const handle h)
bool is_object_signaled(process_context& c, const handle h, uint32_t current_thread_id)
{
const auto type = h.value.type;
@@ -544,6 +569,17 @@ namespace
break;
}
case handle_types::mutant:
{
auto* e = c.mutants.get(h);
if (e)
{
return e->try_lock(current_thread_id);
}
break;
}
case handle_types::thread:
{
const auto* t = c.threads.get(h);
@@ -596,7 +632,7 @@ void emulator_thread::mark_as_ready(const NTSTATUS status)
{
this->pending_status = status;
this->await_time = {};
this->await_object = {};
this->await_objects = {};
// TODO: Find out if this is correct
if (this->waiting_for_alert)
@@ -630,11 +666,26 @@ bool emulator_thread::is_thread_ready(windows_emulator& win_emu)
return false;
}
if (this->await_object.has_value())
if (!this->await_objects.empty())
{
if (is_object_signaled(win_emu.process(), *this->await_object))
bool all_signaled = true;
for (uint32_t i = 0; i < this->await_objects.size(); ++i)
{
this->mark_as_ready(STATUS_WAIT_0);
const auto& obj = this->await_objects[i];
const auto signaled = is_object_signaled(win_emu.process(), obj, this->id);
all_signaled &= signaled;
if (signaled && this->await_any)
{
this->mark_as_ready(STATUS_WAIT_0 + i);
return true;
}
}
if (!this->await_any && all_signaled)
{
this->mark_as_ready(STATUS_SUCCESS);
return true;
}
@@ -691,13 +742,14 @@ std::unique_ptr<x64_emulator> create_default_x64_emulator()
return unicorn::create_x64_emulator();
}
windows_emulator::windows_emulator(const emulator_settings& settings,
windows_emulator::windows_emulator(emulator_settings settings,
std::unique_ptr<x64_emulator> emu)
: windows_emulator(std::move(emu))
{
this->silent_until_main_ = settings.silent_until_main && !settings.disable_logging;
this->stdout_callback_ = std::move(settings.stdout_callback);
this->use_relative_time_ = settings.use_relative_time;
this->logger.disable_output(settings.disable_logging);
this->logger.disable_output(settings.disable_logging || this->silent_until_main_);
this->setup_process(settings);
}
@@ -727,7 +779,10 @@ void windows_emulator::setup_process(const emulator_settings& settings)
context.ntdll = context.module_manager.map_module(R"(C:\Windows\System32\ntdll.dll)", this->logger);
context.win32u = context.module_manager.map_module(R"(C:\Windows\System32\win32u.dll)", this->logger);
this->dispatcher_.setup(context.ntdll->exports, context.win32u->exports);
const auto ntdll_data = emu.read_memory(context.ntdll->image_base, context.ntdll->size_of_image);
const auto win32u_data = emu.read_memory(context.win32u->image_base, context.win32u->size_of_image);
this->dispatcher_.setup(context.ntdll->exports, ntdll_data, context.win32u->exports, win32u_data);
context.ldr_initialize_thunk = context.ntdll->find_export("LdrInitializeThunk");
context.rtl_user_thread_start = context.ntdll->find_export("RtlUserThreadStart");
@@ -755,6 +810,75 @@ void windows_emulator::perform_thread_switch()
}
}
void windows_emulator::on_instruction_execution(uint64_t address)
{
auto& process = this->process();
auto& thread = this->current_thread();
++process.executed_instructions;
const auto thread_insts = ++thread.executed_instructions;
if (thread_insts % MAX_INSTRUCTIONS_PER_TIME_SLICE == 0)
{
this->switch_thread = true;
this->emu().stop();
}
process.previous_ip = process.current_ip;
process.current_ip = this->emu().read_instruction_pointer();
const auto is_main_exe = process.executable->is_within(address);
const auto is_interesting_call = process.executable->is_within(process.previous_ip) || is_main_exe;
if (this->silent_until_main_ && is_main_exe)
{
this->silent_until_main_ = false;
this->logger.disable_output(false);
}
if (!this->verbose && !this->verbose_calls && !is_interesting_call)
{
return;
}
const auto* binary = this->process().module_manager.find_by_address(address);
if (binary)
{
const auto export_entry = binary->address_names.find(address);
if (export_entry != binary->address_names.end())
{
logger.print(is_interesting_call ? color::yellow : color::dark_gray,
"Executing function: %s - %s (0x%llX)\n",
binary->name.c_str(),
export_entry->second.c_str(), address);
}
else if (address == binary->entry_point)
{
logger.print(is_interesting_call ? color::yellow : color::gray,
"Executing entry point: %s (0x%llX)\n",
binary->name.c_str(),
address);
}
}
if (!this->verbose)
{
return;
}
auto& emu = this->emu();
printf(
"Inst: %16llX - RAX: %16llX - RBX: %16llX - RCX: %16llX - RDX: %16llX - R8: %16llX - R9: %16llX - RDI: %16llX - RSI: %16llX - %s\n",
address,
emu.reg(x64_register::rax), emu.reg(x64_register::rbx),
emu.reg(x64_register::rcx),
emu.reg(x64_register::rdx), emu.reg(x64_register::r8),
emu.reg(x64_register::r9),
emu.reg(x64_register::rdi), emu.reg(x64_register::rsi),
binary ? binary->name.c_str() : "<N/A>");
}
void windows_emulator::setup_hooks()
{
this->emu().hook_instruction(x64_hookable_instructions::syscall, [&]
@@ -782,16 +906,24 @@ void windows_emulator::setup_hooks()
this->emu().hook_instruction(x64_hookable_instructions::invalid, [&]
{
const auto ip = this->emu().read_instruction_pointer();
printf("Invalid instruction at: 0x%zX\n", ip);
printf("Invalid instruction at: 0x%llX\n", ip);
return instruction_hook_continuation::skip_instruction;
});
this->emu().hook_interrupt([&](const int interrupt)
{
if (interrupt == 6)
{
dispatch_illegal_instruction_violation(this->emu(), this->process().ki_user_exception_dispatcher);
return;
}
const auto rip = this->emu().read_instruction_pointer();
printf("Interrupt: %i 0x%zX\n", interrupt, rip);
if (this->fuzzing)
if (this->fuzzing || true) // TODO: Fix
{
this->process().exception_rip = rip;
this->emu().stop();
@@ -829,79 +961,11 @@ void windows_emulator::setup_hooks()
return memory_violation_continuation::resume;
});
this->emu().hook_memory_execution(0, std::numeric_limits<size_t>::max(),
this->emu().hook_memory_execution(
0, std::numeric_limits<size_t>::max(),
[&](const uint64_t address, const size_t, const uint64_t)
{
auto& process = this->process();
auto& thread = this->current_thread();
++process.executed_instructions;
const auto thread_insts = ++thread.executed_instructions;
if (thread_insts % MAX_INSTRUCTIONS_PER_TIME_SLICE == 0)
{
this->switch_thread = true;
this->emu().stop();
}
process.previous_ip = process.current_ip;
process.current_ip = this->emu().read_instruction_pointer();
const auto is_interesting_call = process.executable->is_within(
process.previous_ip) || process.executable->is_within(address);
/*if (address == 0x180038B65)
{
puts("!!! DLL init failed");
}
if (address == 0x180038A20)
{
const auto* name = this->process().module_manager.find_name(
this->emu().reg(x64_register::rcx));
printf("!!! DLL init: %s\n", name);
}*/
if (!this->verbose && !this->verbose_calls && !is_interesting_call)
{
return;
}
const auto* binary = this->process().module_manager.find_by_address(address);
if (binary)
{
const auto export_entry = binary->address_names.find(address);
if (export_entry != binary->address_names.end())
{
logger.print(is_interesting_call ? color::yellow : color::dark_gray,
"Executing function: %s - %s (0x%llX)\n",
binary->name.c_str(),
export_entry->second.c_str(), address);
}
else if (address == binary->entry_point)
{
logger.print(is_interesting_call ? color::yellow : color::gray,
"Executing entry point: %s (0x%llX)\n",
binary->name.c_str(),
address);
}
}
if (!this->verbose)
{
return;
}
auto& emu = this->emu();
printf(
"Inst: %16zX - RAX: %16zX - RBX: %16zX - RCX: %16zX - RDX: %16zX - R8: %16zX - R9: %16zX - RDI: %16zX - RSI: %16zX - %s\n",
address,
emu.reg(x64_register::rax), emu.reg(x64_register::rbx),
emu.reg(x64_register::rcx),
emu.reg(x64_register::rdx), emu.reg(x64_register::r8),
emu.reg(x64_register::r9),
emu.reg(x64_register::rdi), emu.reg(x64_register::rsi),
binary ? binary->name.c_str() : "<N/A>");
this->on_instruction_execution(address);
});
}

5
src/windows-emulator/windows_emulator.hpp
View File

@@ -18,6 +18,7 @@ struct emulator_settings
std::vector<std::u16string> arguments{};
std::function<void(std::string_view)> stdout_callback{};
bool disable_logging{false};
bool silent_until_main{false};
bool use_relative_time{false};
};
@@ -25,7 +26,7 @@ class windows_emulator
{
public:
windows_emulator(std::unique_ptr<x64_emulator> emu = create_default_x64_emulator());
windows_emulator(const emulator_settings& settings,
windows_emulator(emulator_settings settings,
std::unique_ptr<x64_emulator> emu = create_default_x64_emulator());
windows_emulator(windows_emulator&&) = delete;
@@ -113,6 +114,7 @@ public:
private:
bool use_relative_time_{false};
bool silent_until_main_{false};
std::unique_ptr<x64_emulator> emu_{};
std::vector<instruction_hook_callback> syscall_hooks_{};
std::function<void(std::string_view)> stdout_callback_{};
@@ -125,4 +127,5 @@ private:
void setup_hooks();
void setup_process(const emulator_settings& settings);
void on_instruction_execution(uint64_t address);
};