Exemple #1
0
        void VirtualProtect(IProcessorEmulator emulator)
        {
            uint esp         = (uint)emulator.ReadRegister(Registers.esp);
            uint uAddress    = ReadLeUInt32(esp + 4u);
            uint dwSize      = ReadLeUInt32(esp + 8u);
            uint newProtect  = ReadLeUInt32(esp + 12u);
            uint pOldProtect = ReadLeUInt32(esp + 16u);

            Debug.Print("VirtualProtect({0:X8},{1:X8},{2:X8},{3:X8})", uAddress, dwSize, newProtect, pOldProtect);
            //$TODO: to make this work we have to keep a mapping (page -> permissions)
            // For now, return the protection of the segment.
            if (!this.map.TryFindSegment(Address.Ptr32(uAddress), out var seg))
            {
                var prot = MapProtectionToWin32(seg.Access);
                WriteLeUInt32(Address.Ptr32(pOldProtect), prot);
                emulator.WriteRegister(Registers.eax, 0u);
            }
            else
            {
                // RWX = 0x70
                WriteLeUInt32(Address.Ptr32(pOldProtect), 0x70);
                emulator.WriteRegister(Registers.eax, 1u);
            }
            emulator.WriteRegister(Registers.esp, esp + 20);
        }
Exemple #2
0
        void VirtualProtect(IProcessorEmulator emulator)
        {
            uint esp  = (uint)emulator.ReadRegister(Registers.esp);
            uint arg1 = ReadLeUInt32(esp + 4u);
            uint arg2 = ReadLeUInt32(esp + 8u);
            uint arg3 = ReadLeUInt32(esp + 12u);
            uint arg4 = ReadLeUInt32(esp + 16u);

            Debug.Print("VirtualProtect({0:X8},{1:X8},{2:X8},{3:X8})", arg1, arg2, arg3, arg4);

            emulator.WriteRegister(Registers.eax, 1u);
            emulator.WriteRegister(Registers.esp, esp + 20);
        }
Exemple #3
0
        void LoadLibraryA(IProcessorEmulator emulator)
        {
            // M[Esp] is return address.
            // M[Esp + 4] is pointer to DLL name.
            uint   esp         = (uint)emulator.ReadRegister(Registers.esp);
            uint   pstrLibName = ReadLeUInt32(esp + 4u);
            string szLibName   = ReadMbString(pstrLibName);
            Module module      = EnsureModule(szLibName);

            emulator.WriteRegister(Registers.eax, module.Handle);

            // Clean up the stack.
            emulator.WriteRegister(Registers.esp, esp + 8);
        }
Exemple #4
0
        void GetProcAddress(IProcessorEmulator emulator)
        {
            // M[esp] is return address
            // M[esp + 4] is hmodule
            // M[esp + 4] is pointer to function name
            uint esp        = (uint)emulator.ReadRegister(Registers.esp);
            uint hmodule    = ReadLeUInt32(esp + 4u);
            uint pstrFnName = ReadLeUInt32(esp + 8u);

            if ((pstrFnName & 0xFFFF0000) != 0)
            {
                string        importName = ReadMbString(pstrFnName);
                var           module     = modules.Values.First(m => m.Handle == hmodule);
                SimulatedProc fn         = EnsureProc(module, importName, NYI);
                emulator.WriteRegister(Registers.eax, fn.uFakedAddress);
                emulator.WriteRegister(Registers.esp, esp + 12);
            }
            else
            {
                //$TODO: import by ordinal.
                throw new NotImplementedException();
            }
        }
Exemple #5
0
 public rulong GetContextData(RegisterStorage register)
 {
     return(emu.ReadRegister(register));
 }
Exemple #6
0
        void VirtualProtect(IProcessorEmulator emulator)
        {
            uint esp = (uint)emulator.ReadRegister(Registers.esp);
            uint arg1 = img.ReadLeUInt32(esp + 4u -  img.BaseAddress.ToUInt32());
            uint arg2 = img.ReadLeUInt32(esp + 8u -  img.BaseAddress.ToUInt32());
            uint arg3 = img.ReadLeUInt32(esp + 12u - img.BaseAddress.ToUInt32());
            uint arg4 = img.ReadLeUInt32(esp + 16u - img.BaseAddress.ToUInt32());
            Debug.Print("VirtualProtect({0:X8},{1:X8},{2:X8},{3:X8})", arg1, arg2, arg3, arg4);

            emulator.WriteRegister(Registers.eax, 1u);
            emulator.WriteRegister(Registers.esp, esp + 20);
        }
Exemple #7
0
 void GetProcAddress(IProcessorEmulator emulator)
 {
     // M[esp] is return address
     // M[esp + 4] is hmodule
     // M[esp + 4] is pointer to function name
     uint esp = (uint)emulator.ReadRegister(Registers.esp);
     uint hmodule = img.ReadLeUInt32(esp + 4u - img.BaseAddress.ToUInt32());
     uint pstrFnName = img.ReadLeUInt32(esp + 8u - img.BaseAddress.ToUInt32());
     if ((pstrFnName & 0xFFFF0000) != 0)
     {
         string importName = ReadMbString(img, pstrFnName);
         var module = modules.Values.First(m => m.Handle == hmodule);
         SimulatedProc fn = EnsureProc(module, importName, NYI);
         emulator.WriteRegister(Registers.eax, fn.uFakedAddress);
         emulator.WriteRegister(Registers.esp, esp + 12);
     }
     else
     {
         //$TODO: import by ordinal.
         throw new NotImplementedException();
     }
 }
Exemple #8
0
        void LoadLibraryA(IProcessorEmulator emulator)
        {
            // M[Esp] is return address.
            // M[Esp + 4] is pointer to DLL name.
            uint esp = (uint)emulator.ReadRegister(Registers.esp);
            uint pstrLibName = img.ReadLeUInt32(esp + 4u - img.BaseAddress.ToUInt32());
            string szLibName = ReadMbString(img, pstrLibName);
            Module module = EnsureModule(szLibName);
            emulator.WriteRegister(Registers.eax, module.Handle);

            // Clean up the stack.
            emulator.WriteRegister(Registers.esp, esp + 8);
        }
Exemple #9
0
 public ulong GetRegisterValue(RegisterStorage reg)
 {
     return(emu.ReadRegister(reg));
 }