diff --git a/src/windows_emulator/main.cpp b/src/windows_emulator/main.cpp index 349ebda..c8d1b80 100644 --- a/src/windows_emulator/main.cpp +++ b/src/windows_emulator/main.cpp @@ -282,7 +282,13 @@ namespace context.process_params.access([&](RTL_USER_PROCESS_PARAMETERS& proc_params) { proc_params.Length = sizeof(proc_params); - proc_params.Flags = 0x6001 | 0x80000000; + proc_params.Flags = 0x6001 | 0x80000000; // Prevent CsrClientConnectToServer + + proc_params.ConsoleHandle = reinterpret_cast(CONSOLE_HANDLE); + proc_params.StandardOutput = reinterpret_cast(STDOUT_HANDLE); + proc_params.StandardInput = reinterpret_cast(STDIN_HANDLE); + proc_params.StandardError = proc_params.StandardOutput; + gs.make_unicode_string(proc_params.CurrentDirectory.DosPath, L"C:\\Users\\mauri\\Desktop"); gs.make_unicode_string(proc_params.ImagePathName, L"C:\\Users\\mauri\\Desktop\\ConsoleApplication6.exe"); gs.make_unicode_string(proc_params.CommandLine, L"C:\\Users\\mauri\\Desktop\\ConsoleApplication6.exe"); diff --git a/src/windows_emulator/syscalls.cpp b/src/windows_emulator/syscalls.cpp index 8cc0a18..7954d12 100644 --- a/src/windows_emulator/syscalls.cpp +++ b/src/windows_emulator/syscalls.cpp @@ -10,16 +10,6 @@ struct syscall_context namespace { - constexpr uint64_t PSEUDO_BIT = 1ULL << 63ULL; - constexpr uint64_t EVENT_BIT = 1ULL << 62ULL; - constexpr uint64_t DIRECTORY_BIT = 1ULL << 61ULL; - constexpr uint64_t SYMLINK_BIT = 1ULL << 60ULL; - constexpr uint64_t FILE_BIT = 1ULL << 59ULL; - - constexpr uint64_t KNOWN_DLLS_DIRECTORY = DIRECTORY_BIT | PSEUDO_BIT | 0x1337; - constexpr uint64_t KNOWN_DLLS_SYMLINK = SYMLINK_BIT | PSEUDO_BIT | 0x1337; - constexpr uint64_t SHARED_SECTION = FILE_BIT | PSEUDO_BIT | 0x1337; - uint64_t get_syscall_argument(x64_emulator& emu, const size_t index) { switch (index) @@ -799,7 +789,8 @@ namespace } if (info_class == ProcessSchedulerSharedData - || info_class == ProcessTlsInformation) + || info_class == ProcessTlsInformation + || info_class == ProcessConsoleHostProcess) { return STATUS_SUCCESS; } @@ -1002,27 +993,62 @@ namespace throw std::runtime_error("Bad free type"); } - NTSTATUS handle_NtCreateSection(const syscall_context& /*c*/, const emulator_object section_handle, + NTSTATUS handle_NtCreateSection(const syscall_context& c, const emulator_object section_handle, const ACCESS_MASK /*desired_access*/, const emulator_object /*object_attributes*/, const emulator_object maximum_size, const ULONG /*section_page_protection*/, const ULONG /*allocation_attributes*/, const uint64_t /*file_handle*/) { - section_handle.write(SHARED_SECTION); + puts("NtCreateSection not supported"); + c.emu.stop(); + section_handle.write(SHARED_SECTION); + /* maximum_size.access([](LARGE_INTEGER& large_int) { large_int.QuadPart = page_align_up(large_int.QuadPart); }); + */ + return STATUS_SUCCESS; + } + + NTSTATUS handle_NtConnectPort(const syscall_context& c) + { + puts("NtConnectPort not supported"); + c.emu.stop(); return STATUS_SUCCESS; } - NTSTATUS handle_NtConnectPort() + NTSTATUS handle_NtDeviceIoControlFile(const syscall_context& c) { + puts("NtDeviceIoControlFile not supported"); return STATUS_SUCCESS; } + + NTSTATUS handle_NtCreateFile(const syscall_context& c, const emulator_object file_handle, + ACCESS_MASK /*desired_access*/, + const emulator_object object_attributes) + { + const auto attributes = object_attributes.read(); + const auto filename = read_unicode_string(c.emu, attributes.ObjectName); + + if (filename == L"\\Device\\ConDrv\\Server") + { + file_handle.write(CONSOLE_SERVER); + return STATUS_SUCCESS; + } + + const auto root_handle = reinterpret_cast(attributes.RootDirectory); + if ((root_handle & PSEUDO_BIT) && (filename == L"\\Reference" || filename == L"\\Connect")) + { + file_handle.write(root_handle); + return STATUS_SUCCESS; + } + + throw std::runtime_error("Unsupported file"); + } } syscall_dispatcher::syscall_dispatcher(const exported_symbols& ntdll_exports) @@ -1070,6 +1096,8 @@ syscall_dispatcher::syscall_dispatcher(const exported_symbols& ntdll_exports) add_handler(NtApphelpCacheControl); add_handler(NtCreateSection); add_handler(NtConnectPort); + add_handler(NtCreateFile); + add_handler(NtDeviceIoControlFile); #undef add_handler } diff --git a/src/windows_emulator/syscalls.hpp b/src/windows_emulator/syscalls.hpp index f2f8101..e66a2c0 100644 --- a/src/windows_emulator/syscalls.hpp +++ b/src/windows_emulator/syscalls.hpp @@ -3,6 +3,21 @@ #include #include "process_context.hpp" +constexpr uint64_t PSEUDO_BIT = 1ULL << 63ULL; +constexpr uint64_t EVENT_BIT = 1ULL << 62ULL; +constexpr uint64_t DIRECTORY_BIT = 1ULL << 61ULL; +constexpr uint64_t SYMLINK_BIT = 1ULL << 60ULL; +constexpr uint64_t FILE_BIT = 1ULL << 59ULL; + +constexpr uint64_t KNOWN_DLLS_DIRECTORY = DIRECTORY_BIT | PSEUDO_BIT | 0x1337; +constexpr uint64_t KNOWN_DLLS_SYMLINK = SYMLINK_BIT | PSEUDO_BIT | 0x1337; +constexpr uint64_t SHARED_SECTION = FILE_BIT | PSEUDO_BIT | 0x1337; +constexpr uint64_t CONSOLE_SERVER = FILE_BIT | PSEUDO_BIT | 0x1338; + +constexpr uint64_t CONSOLE_HANDLE = FILE_BIT | PSEUDO_BIT | 0x01; +constexpr uint64_t STDOUT_HANDLE = FILE_BIT | PSEUDO_BIT | 0x02; +constexpr uint64_t STDIN_HANDLE = FILE_BIT | PSEUDO_BIT | 0x03; + struct syscall_context; using syscall_handler = void(*)(const syscall_context& c);