From ddee229fca8a859383d49443696656d3dc57d2ba Mon Sep 17 00:00:00 2001 From: momo5502 Date: Wed, 11 Sep 2024 13:22:52 +0200 Subject: [PATCH] More syscall features --- src/windows_emulator/process_context.hpp | 1 + src/windows_emulator/syscalls.cpp | 80 +++++++++++++++++++++++- 2 files changed, 80 insertions(+), 1 deletion(-) diff --git a/src/windows_emulator/process_context.hpp b/src/windows_emulator/process_context.hpp index b9b157f..5eef5d0 100644 --- a/src/windows_emulator/process_context.hpp +++ b/src/windows_emulator/process_context.hpp @@ -53,6 +53,7 @@ struct process_context handle_store events{}; handle_store files{}; handle_store semaphores{}; + std::map atoms{}; emulator_allocator gs_segment{}; bool verbose{false}; diff --git a/src/windows_emulator/syscalls.cpp b/src/windows_emulator/syscalls.cpp index 4114c3a..c71be3f 100644 --- a/src/windows_emulator/syscalls.cpp +++ b/src/windows_emulator/syscalls.cpp @@ -74,7 +74,8 @@ namespace return syscalls; } - uint64_t get_syscall_id(const std::vector& ntdll_syscalls, const std::vector& win32u_syscalls, const std::string_view name) + uint64_t get_syscall_id(const std::vector& ntdll_syscalls, + const std::vector& win32u_syscalls, const std::string_view name) { for (size_t i = 0; i < ntdll_syscalls.size(); ++i) { @@ -607,6 +608,30 @@ namespace return STATUS_SUCCESS; } + if (info_class == SystemProcessorInformation) + { + if (return_length) + { + return_length.write(sizeof(SYSTEM_PROCESSOR_INFORMATION)); + } + + if (system_information_length != sizeof(SYSTEM_PROCESSOR_INFORMATION)) + { + return STATUS_BUFFER_TOO_SMALL; + } + + const emulator_object info_obj{c.emu, system_information}; + + info_obj.access([&](SYSTEM_PROCESSOR_INFORMATION& info) + { + memset(&info, 0, sizeof(info)); + info.MaximumProcessors = 2; + info.ProcessorArchitecture = PROCESSOR_ARCHITECTURE_AMD64; + }); + + return STATUS_SUCCESS; + } + if (info_class == SystemNumaProcessorMap) { if (return_length) @@ -1261,6 +1286,58 @@ namespace return STATUS_SUCCESS; } + + NTSTATUS handle_NtAddAtomEx(const syscall_context& c, const uint64_t atom_name, const ULONG length, + const emulator_object atom, const ULONG /*flags*/) + { + std::wstring name{}; + name.resize(length / 2); + + c.emu.read_memory(atom_name, name.data(), length); + + uint16_t index = 0; + if (!c.proc.atoms.empty()) + { + auto i = c.proc.atoms.end(); + --i; + index = i->first + 1; + } + + std::optional last_entry{}; + for (auto& entry : c.proc.atoms) + { + if (entry.second == name) + { + if (atom) + { + atom.write(entry.first); + return STATUS_SUCCESS; + } + } + + if (entry.first > 0) + { + if (!last_entry) + { + index = 0; + } + else + { + const auto diff = entry.first - *last_entry; + if (diff > 1) + { + index = *last_entry + 1; + } + } + } + + last_entry = entry.first; + } + + c.proc.atoms[index] = std::move(name); + atom.write(index); + return STATUS_SUCCESS; + } } syscall_dispatcher::syscall_dispatcher(const exported_symbols& ntdll_exports, const exported_symbols& win32u_exports) @@ -1329,6 +1406,7 @@ syscall_dispatcher::syscall_dispatcher(const exported_symbols& ntdll_exports, co add_handler(NtReadVirtualMemory); add_handler(NtQueryInformationToken); add_handler(NtDxgkIsFeatureEnabled); + add_handler(NtAddAtomEx); #undef add_handler }