#pragma once #include "emulator_utils.hpp" #include "handles.hpp" #include "registry/registry_manager.hpp" #include "module/module_manager.hpp" #include #include #include "io_device.hpp" #include "kusd_mmio.hpp" #include "windows_objects.hpp" #include "emulator_thread.hpp" #include "port.hpp" #include "user_handle_table.hpp" #include "apiset/apiset.hpp" #define PEB_SEGMENT_SIZE (20 << 20) // 20 MB #define GS_SEGMENT_SIZE (1 << 20) // 1 MB #define STACK_SIZE 0x40000ULL // 256KB #define GDT_ADDR 0x35000 #define GDT_LIMIT 0x1000 #define GDT_ENTRY_SIZE 0x8 // TODO: Get rid of that #define WOW64_NATIVE_STACK_SIZE 0x8000 #define WOW64_32BIT_STACK_SIZE (1 << 20) struct emulator_settings; struct application_settings; using knowndlls_map = std::map; using apiset_map = std::map; struct process_context { struct callbacks { utils::optional_function on_thread_create{}; utils::optional_function on_thread_terminated{}; utils::optional_function on_thread_switch{}; utils::optional_function on_thread_set_name{}; }; struct atom_entry { std::u16string name{}; uint32_t ref_count = 0; void serialize(utils::buffer_serializer& buffer) const { buffer.write(this->name); buffer.write(this->ref_count); } void deserialize(utils::buffer_deserializer& buffer) { buffer.read(this->name); buffer.read(this->ref_count); } }; process_context(x86_64_emulator& emu, memory_manager& memory, utils::clock& clock, callbacks& cb) : callbacks_(&cb), base_allocator(emu), peb64(emu), process_params64(emu), kusd(memory, clock), user_handles(memory) { } void setup(x86_64_emulator& emu, memory_manager& memory, registry_manager& registry, const file_system& file_system, const application_settings& app_settings, const mapped_module& executable, const mapped_module& ntdll, const apiset::container& apiset_container, const mapped_module* ntdll32 = nullptr); void setup_callback_hook(windows_emulator& win_emu, memory_manager& memory); handle create_thread(memory_manager& memory, uint64_t start_address, uint64_t argument, uint64_t stack_size, uint32_t create_flags, bool initial_thread = false); std::optional find_atom(std::u16string_view name); uint16_t add_or_find_atom(std::u16string name); bool delete_atom(const std::u16string& name); bool delete_atom(uint16_t atom_id); const std::u16string* get_atom_name(uint16_t atom_id) const; template void build_knowndlls_section_table(registry_manager& registry, const file_system& file_system, bool is_32bit); std::optional
get_knowndll_section_by_name(const std::u16string& name, bool is_32bit) const; void add_knowndll_section(const std::u16string& name, const section& section, bool is_32bit); bool has_knowndll_section(const std::u16string& name, bool is_32bit) const; void serialize(utils::buffer_serializer& buffer) const; void deserialize(utils::buffer_deserializer& buffer); generic_handle_store* get_handle_store(handle handle); // WOW64 support flag - set during process setup based on executable architecture bool is_wow64_process{false}; uint32_t windows_build_number{0}; bool is_older_windows_build() const { return windows_build_number < 26040; } callbacks* callbacks_{}; uint64_t shared_section_address{0}; uint64_t shared_section_size{0}; uint64_t dbwin_buffer{0}; uint64_t dbwin_buffer_size{0}; std::optional exit_status{}; emulator_allocator base_allocator; emulator_object peb64; emulator_object process_params64; kusd_mmio kusd; uint64_t ntdll_image_base{}; uint64_t ldr_initialize_thunk{}; uint64_t rtl_user_thread_start{}; uint64_t ki_user_apc_dispatcher{}; uint64_t ki_user_exception_dispatcher{}; uint64_t instrumentation_callback{}; // For WOW64 processes std::optional> peb32; std::optional> process_params32; std::optional rtl_user_thread_start32{}; user_handle_table user_handles; handle default_monitor_handle{}; handle_store events{}; handle_store files{}; handle_store sections{}; handle_store devices{}; handle_store semaphores{}; handle_store ports{}; handle_store mutants{}; user_handle_store windows{user_handles}; handle_store timers{}; handle_store registry_keys{}; std::map atoms{}; apiset_map apiset; knowndlls_map knowndlls32_sections; knowndlls_map knowndlls64_sections; std::vector default_register_set{}; uint32_t spawned_thread_count{0}; handle_store threads{}; emulator_thread* active_thread{nullptr}; emulator_pointer callback_sentinel_addr{0}; // Extended parameters from last NtMapViewOfSectionEx call // These can be used by other syscalls like NtAllocateVirtualMemoryEx uint64_t last_extended_params_numa_node{0}; uint32_t last_extended_params_attributes{0}; uint16_t last_extended_params_image_machine{IMAGE_FILE_MACHINE_UNKNOWN}; };