Skip to content

Commit

Permalink
Merge branch 'main' into main
Browse files Browse the repository at this point in the history
  • Loading branch information
brandonros authored Dec 26, 2024
2 parents bdb8874 + 2317fd1 commit c550d64
Show file tree
Hide file tree
Showing 3 changed files with 908 additions and 15 deletions.
16 changes: 4 additions & 12 deletions libmwemu/src/emu/pe64.rs
Original file line number Diff line number Diff line change
Expand Up @@ -523,7 +523,7 @@ impl PE64 {
"IAT binding started image_import_descriptor.len() = {} ...",
self.image_import_descriptor.len()
);
let mut flipflop = false;
let mut flipflop;

for i in 0..self.image_import_descriptor.len() {
let iim = &self.image_import_descriptor[i];
Expand All @@ -538,21 +538,17 @@ impl PE64 {
}

// Walking function names.
println!("walking function names");
let mut off_name =
PE32::vaddr_to_off(&self.sect_hdr, iim.original_first_thunk) as usize;

//log::info!("----> 0x{:x}", iim.first_thunk);
let mut off_addr = PE32::vaddr_to_off(&self.sect_hdr, iim.first_thunk) as usize;
//off_addr += 8;

println!("off_name: {}", off_name);
println!("off_addr: {}", off_addr);
flipflop = false;

loop {
if self.raw.len() <= off_name + 4 || self.raw.len() <= off_addr + 8 {
println!("breaking1");
break;
}

Expand All @@ -564,18 +560,15 @@ impl PE64 {
off_name += pe32::HintNameItem::size();
//off_addr += 8;
if flipflop {
flipflop = false;
break;
}
flipflop = true;
println!("continue2");
continue;
}
flipflop = false;
let func_name = PE32::read_string(&self.raw, off2 + 2);
let real_addr = emu::winapi64::kernel32::resolve_api_name(emu, &func_name);
if real_addr == 0 {
println!("breaking2");
break;
}

Expand All @@ -584,10 +577,9 @@ impl PE64 {
}*/

let fake_addr = read_u64_le!(self.raw, off_addr);
println!(
"writing real_addr: 0x{:x} {} 0x{:x} -> 0x{:x} ",
off_addr, func_name, fake_addr, real_addr
);

//println!("writing real_addr: 0x{:x} {} 0x{:x} -> 0x{:x} ", off_addr, func_name, fake_addr, real_addr);

write_u64_le!(self.raw, off_addr, real_addr);

off_name += pe32::HintNameItem::size();
Expand Down
14 changes: 11 additions & 3 deletions libmwemu/src/emu/winapi64/advapi32.rs
Original file line number Diff line number Diff line change
Expand Up @@ -101,7 +101,10 @@ fn RegQueryValueExA(emu: &mut emu::Emu) {
.read_qword(emu.regs.rsp + 8)
.expect("error reading api param");

let value = emu.maps.read_string(value_ptr);
let mut value = String::new();
if value_ptr > 0 {
value = emu.maps.read_string(value_ptr);
}

log::info!(
"{}** {} advapi32!RegQueryValueExA {} {}",
Expand All @@ -111,7 +114,12 @@ fn RegQueryValueExA(emu: &mut emu::Emu) {
emu.colors.nc
);

emu.maps.write_string(data_out, "some_random_reg_contents");
emu.maps.write_qword(datasz_out, 24);
if data_out > 0 {
emu.maps.write_string(data_out, "some_random_reg_contents");
}
if datasz_out > 0 {
emu.maps.write_qword(datasz_out, 24);
}
emu.regs.rax = constants::ERROR_SUCCESS;
}

Loading

0 comments on commit c550d64

Please sign in to comment.