You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
63 lines
1.6 KiB
63 lines
1.6 KiB
#pragma once
|
|
#include <unicorn/unicorn.h>
|
|
|
|
#include <atomic>
|
|
#include <nt/image.hpp>
|
|
#include <vmprofiler.hpp>
|
|
|
|
#define PAGE_4KB 0x1000
|
|
#define STACK_SIZE PAGE_4KB * 512
|
|
|
|
#define STACK_BASE 0xFFFF000000000000
|
|
#define IAT_VECTOR_TABLE 0xFFFFF00000000000
|
|
|
|
namespace vm {
|
|
inline bool g_force_emu = false;
|
|
|
|
class emu_t {
|
|
struct cpu_ctx_t {
|
|
std::uintptr_t rip;
|
|
uc_context* context;
|
|
std::uint8_t stack[STACK_SIZE];
|
|
};
|
|
|
|
struct code_block_data_t {
|
|
vm::instrs::code_block_t code_block;
|
|
std::shared_ptr<cpu_ctx_t> cpu_ctx;
|
|
std::shared_ptr<vm::ctx_t> g_vm_ctx;
|
|
};
|
|
|
|
public:
|
|
explicit emu_t(vm::ctx_t* vm_ctx);
|
|
~emu_t();
|
|
|
|
bool init();
|
|
bool get_trace(std::vector<vm::instrs::code_block_t>& code_blocks);
|
|
|
|
private:
|
|
std::uintptr_t img_base, img_size;
|
|
uc_hook code_exec_hook, invalid_mem_hook, int_hook;
|
|
|
|
uc_engine* uc_ctx;
|
|
vm::ctx_t* g_vm_ctx;
|
|
code_block_data_t* cc_block;
|
|
|
|
std::vector<std::uintptr_t> vip_begins;
|
|
std::vector<code_block_data_t> code_blocks;
|
|
std::map<std::uintptr_t, std::shared_ptr<vm::ctx_t> > vm_ctxs;
|
|
|
|
uc_err create_entry(vmp2::v2::entry_t* entry);
|
|
static void int_callback(uc_engine* uc, std::uint32_t intno, emu_t* obj);
|
|
static bool code_exec_callback(uc_engine* uc,
|
|
uint64_t address,
|
|
uint32_t size,
|
|
emu_t* obj);
|
|
|
|
static void invalid_mem(uc_engine* uc,
|
|
uc_mem_type type,
|
|
uint64_t address,
|
|
int size,
|
|
int64_t value,
|
|
emu_t* obj);
|
|
};
|
|
} // namespace vm
|