Support SameTebFlags.InitialThread

This flag is needed to suport emulation of .net executables
that don't have an entry point set in PE header. This applies
to both PE32 and PE64 executables. If InitialThread is set
the loader substitutes an entry point of the .net executable
with mscoree.dll!_CorExeMain.
This commit is contained in:
ssvine
2025-12-30 13:44:21 +03:00
parent d3cb3f4995
commit fea27338bb
5 changed files with 11 additions and 6 deletions

View File

@@ -116,7 +116,8 @@ namespace
}
emulator_thread::emulator_thread(memory_manager& memory, const process_context& context, const uint64_t start_address,
const uint64_t argument, const uint64_t stack_size, const bool suspended, const uint32_t id)
const uint64_t argument, const uint64_t stack_size, const bool suspended, const uint32_t id,
const bool initial_thread)
: memory_ptr(&memory),
// stack_size(page_align_up(std::max(stack_size, static_cast<uint64_t>(STACK_SIZE)))),
start_address(start_address),
@@ -152,6 +153,7 @@ emulator_thread::emulator_thread(memory_manager& memory, const process_context&
teb_obj.NtTib.Self = this->teb64->value();
teb_obj.CurrentLocale = 0x409;
teb_obj.ProcessEnvironmentBlock = context.peb64.value();
teb_obj.SameTebFlags.InitialThread = initial_thread;
});
return;
@@ -209,6 +211,7 @@ emulator_thread::emulator_thread(memory_manager& memory, const process_context&
teb_obj.CurrentLocale = 0x409;
teb_obj.ProcessEnvironmentBlock = context.peb64.value();
teb_obj.SameTebFlags.InitialThread = initial_thread;
teb_obj.StaticUnicodeString.MaximumLength = sizeof(teb_obj.StaticUnicodeBuffer);
teb_obj.StaticUnicodeString.Buffer = this->teb64->value() + offsetof(TEB64, StaticUnicodeBuffer);
@@ -264,6 +267,7 @@ emulator_thread::emulator_thread(memory_manager& memory, const process_context&
}
teb32_obj.WowTebOffset = -0x2000;
teb32_obj.InitialThread = initial_thread;
// Note: CurrentLocale and other fields will be initialized by WOW64 runtime
});

View File

@@ -49,7 +49,7 @@ class emulator_thread : public ref_counted_object
}
emulator_thread(memory_manager& memory, const process_context& context, uint64_t start_address, uint64_t argument, uint64_t stack_size,
bool suspended, uint32_t id);
bool suspended, uint32_t id, bool initial_thread);
emulator_thread(const emulator_thread&) = delete;
emulator_thread& operator=(const emulator_thread&) = delete;

View File

@@ -525,9 +525,9 @@ generic_handle_store* process_context::get_handle_store(const handle handle)
}
handle process_context::create_thread(memory_manager& memory, const uint64_t start_address, const uint64_t argument,
const uint64_t stack_size, const bool suspended)
const uint64_t stack_size, const bool suspended, const bool initial_thread)
{
emulator_thread t{memory, *this, start_address, argument, stack_size, suspended, ++this->spawned_thread_count};
emulator_thread t{memory, *this, start_address, argument, stack_size, suspended, ++this->spawned_thread_count, initial_thread};
auto [h, thr] = this->threads.store_and_get(std::move(t));
this->callbacks_->on_thread_create(h, *thr);
return h;

View File

@@ -74,7 +74,8 @@ struct process_context
const mapped_module& executable, const mapped_module& ntdll, const apiset::container& apiset_container,
const mapped_module* ntdll32 = nullptr);
handle create_thread(memory_manager& memory, uint64_t start_address, uint64_t argument, uint64_t stack_size, bool suspended);
handle create_thread(memory_manager& memory, uint64_t start_address, uint64_t argument, uint64_t stack_size, bool suspended,
bool initial_thread = false);
std::optional<uint16_t> find_atom(std::u16string_view name);
uint16_t add_or_find_atom(std::u16string name);

View File

@@ -371,7 +371,7 @@ void windows_emulator::setup_process(const application_settings& app_settings)
this->dispatcher.setup(ntdll->exports, ntdll_data, win32u->exports, win32u_data);
const auto main_thread_id = context.create_thread(this->memory, this->mod_manager.executable->entry_point, 0,
this->mod_manager.executable->size_of_stack_commit, false);
this->mod_manager.executable->size_of_stack_commit, false, true);
switch_to_thread(*this, main_thread_id);
}