#pragma once #include "emulator_utils.hpp" #include "handles.hpp" #include "registry/registry_manager.hpp" #include "module/module_manager.hpp" #include #include #include "io_device.hpp" #include "kusd_mmio.hpp" #include "windows_objects.hpp" #include "emulator_thread.hpp" #include "apiset/apiset.hpp" #define PEB_SEGMENT_SIZE (20 << 20) // 20 MB #define GS_SEGMENT_SIZE (1 << 20) // 1 MB #define STACK_SIZE 0x40000ULL #define GDT_ADDR 0x30000 #define GDT_LIMIT 0x1000 #define GDT_ENTRY_SIZE 0x8 struct emulator_settings; struct application_settings; struct process_context_common { struct callbacks { utils::optional_function on_create_thread{}; utils::optional_function on_thread_terminated{}; }; struct atom_entry { std::u16string name; uint32_t ref_count = 0; atom_entry(std::u16string n, uint32_t count) : name(std::move(n)), ref_count(count) { } atom_entry() = default; }; std::map atoms{}; uint16_t add_or_find_atom(std::u16string name); bool delete_atom(const std::u16string& name); bool delete_atom(uint16_t atom_id); const std::u16string* get_atom_name(uint16_t atom_id) const; uint64_t current_ip{0}; uint64_t previous_ip{0}; uint64_t shared_section_address{0}; uint64_t shared_section_size{0}; uint64_t dbwin_buffer{0}; uint64_t dbwin_buffer_size{0}; std::optional exit_status{}; uint64_t ntdll_image_base{}; uint64_t ldr_initialize_thunk{}; uint64_t rtl_user_thread_start{}; uint64_t ki_user_apc_dispatcher{}; uint64_t ki_user_exception_dispatcher{}; std::optional exception_ip{}; handle_store events{}; handle_store files{}; handle_store sections{}; handle_store semaphores{}; handle_store ports{}; handle_store mutants{}; handle_store registry_keys{}; std::vector default_register_set{}; }; struct process_context64 final : process_context_common { process_context64(x86_64_emulator& emu, memory_manager& memory, utils::clock& clock, callbacks& cb) : callbacks_(&cb), base_allocator(emu), peb(emu), process_params(emu), kusd(memory, clock) { } void setup(x86_64_emulator& emu, memory_manager& memory, const application_settings& app_settings, const mapped_module& executable, const mapped_module& ntdll, const apiset::container& apiset_container); handle create_thread(memory_manager& memory, uint64_t start_address, uint64_t argument, uint64_t stack_size, bool suspended); void serialize(utils::buffer_serializer& buffer) const; void deserialize(utils::buffer_deserializer& buffer); generic_handle_store* get_handle_store(handle handle); callbacks* callbacks_{}; emulator_allocator base_allocator; emulator_object peb; emulator_object process_params; kusd_mmio kusd; handle_store devices{}; uint32_t spawned_thread_count{0}; handle_store threads{}; emulator_thread* active_thread{nullptr}; };