Fix injector: drakvuf_set_vcpu_gprs forgot about RSI and RDI

[psrok1]

Hi!

This fix is addressing issues related with target process crash/hang caused by injector e.g. #925, #1758

I've spent hours on debugging injector crashes and I found a bit surprising bug: hijacked thread context is incorrectly restored because two registers were missing in drakvuf_set_vcpu_gprs function: RSI and RDI.

These registers are crucial because according to Microsoft x64 ABI convention, they're non-volatile registers that should be preserved by the callee. Of course the bug leads to the corruption of targeted process, usually followed by a crash.

I found the bug by debugging one of the common places where explorer.exe was spotted to crash after injection. In this case, injector traps on the return from ZwWaitForWorkViaWorkerFactory where hijacked thread wakes up. The clobbered RSI register is then used in various places as it points to some shared structure with PSRWLOCK pointer in rsi+0x48. Final result is usually an EXCEPTION_ACCESS_VIOLATION crash in RtlAcquireSRWLockExclusive.

Other register values are correctly restored excluding RSI and RDI:

RtlAcquireSRWLockExclusive argument evaluated from RSI:

The faulting instruction:

[drakvuf-jenkins]

Can one of the admins verify this patch?

[tklengyel]

@drakvuf-jenkins Test this please