Skip to content

Commit

Permalink
Add console support
Browse files Browse the repository at this point in the history
  • Loading branch information
momo5502 committed Aug 31, 2024
1 parent d0e79f5 commit 477eef2
Show file tree
Hide file tree
Showing 3 changed files with 64 additions and 15 deletions.
8 changes: 7 additions & 1 deletion src/windows_emulator/main.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -282,7 +282,13 @@ namespace
context.process_params.access([&](RTL_USER_PROCESS_PARAMETERS& proc_params)
{
proc_params.Length = sizeof(proc_params);
proc_params.Flags = 0x6001 | 0x80000000;
proc_params.Flags = 0x6001 | 0x80000000; // Prevent CsrClientConnectToServer

proc_params.ConsoleHandle = reinterpret_cast<HANDLE>(CONSOLE_HANDLE);
proc_params.StandardOutput = reinterpret_cast<HANDLE>(STDOUT_HANDLE);
proc_params.StandardInput = reinterpret_cast<HANDLE>(STDIN_HANDLE);
proc_params.StandardError = proc_params.StandardOutput;

gs.make_unicode_string(proc_params.CurrentDirectory.DosPath, L"C:\\Users\\mauri\\Desktop");
gs.make_unicode_string(proc_params.ImagePathName, L"C:\\Users\\mauri\\Desktop\\ConsoleApplication6.exe");
gs.make_unicode_string(proc_params.CommandLine, L"C:\\Users\\mauri\\Desktop\\ConsoleApplication6.exe");
Expand Down
56 changes: 42 additions & 14 deletions src/windows_emulator/syscalls.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -10,16 +10,6 @@ struct syscall_context

namespace
{
constexpr uint64_t PSEUDO_BIT = 1ULL << 63ULL;
constexpr uint64_t EVENT_BIT = 1ULL << 62ULL;
constexpr uint64_t DIRECTORY_BIT = 1ULL << 61ULL;
constexpr uint64_t SYMLINK_BIT = 1ULL << 60ULL;
constexpr uint64_t FILE_BIT = 1ULL << 59ULL;

constexpr uint64_t KNOWN_DLLS_DIRECTORY = DIRECTORY_BIT | PSEUDO_BIT | 0x1337;
constexpr uint64_t KNOWN_DLLS_SYMLINK = SYMLINK_BIT | PSEUDO_BIT | 0x1337;
constexpr uint64_t SHARED_SECTION = FILE_BIT | PSEUDO_BIT | 0x1337;

uint64_t get_syscall_argument(x64_emulator& emu, const size_t index)
{
switch (index)
Expand Down Expand Up @@ -799,7 +789,8 @@ namespace
}

if (info_class == ProcessSchedulerSharedData
|| info_class == ProcessTlsInformation)
|| info_class == ProcessTlsInformation
|| info_class == ProcessConsoleHostProcess)
{
return STATUS_SUCCESS;
}
Expand Down Expand Up @@ -1002,27 +993,62 @@ namespace
throw std::runtime_error("Bad free type");
}

NTSTATUS handle_NtCreateSection(const syscall_context& /*c*/, const emulator_object<uint64_t> section_handle,
NTSTATUS handle_NtCreateSection(const syscall_context& c, const emulator_object<uint64_t> section_handle,
const ACCESS_MASK /*desired_access*/,
const emulator_object<OBJECT_ATTRIBUTES> /*object_attributes*/,
const emulator_object<LARGE_INTEGER> maximum_size,
const ULONG /*section_page_protection*/, const ULONG /*allocation_attributes*/,
const uint64_t /*file_handle*/)
{
section_handle.write(SHARED_SECTION);
puts("NtCreateSection not supported");
c.emu.stop();

section_handle.write(SHARED_SECTION);
/*
maximum_size.access([](LARGE_INTEGER& large_int)
{
large_int.QuadPart = page_align_up(large_int.QuadPart);
});
*/
return STATUS_SUCCESS;
}

NTSTATUS handle_NtConnectPort(const syscall_context& c)
{
puts("NtConnectPort not supported");
c.emu.stop();

return STATUS_SUCCESS;
}

NTSTATUS handle_NtConnectPort()
NTSTATUS handle_NtDeviceIoControlFile(const syscall_context& c)
{
puts("NtDeviceIoControlFile not supported");
return STATUS_SUCCESS;
}

NTSTATUS handle_NtCreateFile(const syscall_context& c, const emulator_object<uint64_t> file_handle,
ACCESS_MASK /*desired_access*/,
const emulator_object<OBJECT_ATTRIBUTES> object_attributes)
{
const auto attributes = object_attributes.read();
const auto filename = read_unicode_string(c.emu, attributes.ObjectName);

if (filename == L"\\Device\\ConDrv\\Server")
{
file_handle.write(CONSOLE_SERVER);
return STATUS_SUCCESS;
}

const auto root_handle = reinterpret_cast<uint64_t>(attributes.RootDirectory);
if ((root_handle & PSEUDO_BIT) && (filename == L"\\Reference" || filename == L"\\Connect"))
{
file_handle.write(root_handle);
return STATUS_SUCCESS;
}

throw std::runtime_error("Unsupported file");
}
}

syscall_dispatcher::syscall_dispatcher(const exported_symbols& ntdll_exports)
Expand Down Expand Up @@ -1070,6 +1096,8 @@ syscall_dispatcher::syscall_dispatcher(const exported_symbols& ntdll_exports)
add_handler(NtApphelpCacheControl);
add_handler(NtCreateSection);
add_handler(NtConnectPort);
add_handler(NtCreateFile);
add_handler(NtDeviceIoControlFile);

#undef add_handler
}
Expand Down
15 changes: 15 additions & 0 deletions src/windows_emulator/syscalls.hpp
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,21 @@
#include <x64_emulator.hpp>
#include "process_context.hpp"

constexpr uint64_t PSEUDO_BIT = 1ULL << 63ULL;
constexpr uint64_t EVENT_BIT = 1ULL << 62ULL;
constexpr uint64_t DIRECTORY_BIT = 1ULL << 61ULL;
constexpr uint64_t SYMLINK_BIT = 1ULL << 60ULL;
constexpr uint64_t FILE_BIT = 1ULL << 59ULL;

constexpr uint64_t KNOWN_DLLS_DIRECTORY = DIRECTORY_BIT | PSEUDO_BIT | 0x1337;
constexpr uint64_t KNOWN_DLLS_SYMLINK = SYMLINK_BIT | PSEUDO_BIT | 0x1337;
constexpr uint64_t SHARED_SECTION = FILE_BIT | PSEUDO_BIT | 0x1337;
constexpr uint64_t CONSOLE_SERVER = FILE_BIT | PSEUDO_BIT | 0x1338;

constexpr uint64_t CONSOLE_HANDLE = FILE_BIT | PSEUDO_BIT | 0x01;
constexpr uint64_t STDOUT_HANDLE = FILE_BIT | PSEUDO_BIT | 0x02;
constexpr uint64_t STDIN_HANDLE = FILE_BIT | PSEUDO_BIT | 0x03;

struct syscall_context;
using syscall_handler = void(*)(const syscall_context& c);

Expand Down

0 comments on commit 477eef2

Please sign in to comment.