vmprofiler-qt/src/qvirt_handlers.cpp

#include "qvirt_handlers.h"

qvirt_handlers_t::qvirt_handlers_t( qvminspector_t *vminspector ) : vminspector( vminspector ), ui( &vminspector->ui )
{
    connect( ui->virt_handlers_tree, &QTreeWidget::itemSelectionChanged, this, &qvirt_handlers_t::on_select );
}

void qvirt_handlers_t::update_transforms( vm::handler::handler_t &vm_handler )
{
    char buffer[ 256 ];
    ZydisFormatter formatter;
    ZydisFormatterInit( &formatter, ZYDIS_FORMATTER_STYLE_INTEL );

    ui->virt_handler_transforms_tree->clear();
    const auto &vm_handler_transforms = vm_handler.transforms;

    for ( auto [ transform_type, transform_instr ] : vm_handler_transforms )
    {
        if ( transform_type == vm::transform::type::generic0 && transform_instr.mnemonic == ZYDIS_MNEMONIC_INVALID )
            continue;

        auto new_transform_entry = new qtree_widget_item_t();

        switch ( transform_type )
        {
        case vm::transform::type::rolling_key:
        {
            new_transform_entry->setText( 0, "Key Transform" );
            break;
        }
        case vm::transform::type::generic0:
        case vm::transform::type::generic1:
        case vm::transform::type::generic2:
        case vm::transform::type::generic3:
        {
            new_transform_entry->setText( 0, "Generic" );
            break;
        }
        case vm::transform::type::update_key:
        {
            new_transform_entry->setText( 0, "Update Key" );
            break;
        }
        default:
            throw std::invalid_argument( "invalid transformation type..." );
        }

        ZydisFormatterFormatInstruction( &formatter, &transform_instr, buffer, sizeof( buffer ), NULL );

        new_transform_entry->setText( 1, buffer );
        ui->virt_handler_transforms_tree->addTopLevelItem( new_transform_entry );
    }
}

void qvirt_handlers_t::update_instrs( vm::handler::handler_t &vm_handler )
{
    char buffer[ 256 ];
    ZydisFormatter formatter;
    ZydisFormatterInit( &formatter, ZYDIS_FORMATTER_STYLE_INTEL );

    ui->virt_handler_instrs_tree->clear();
    const auto &vm_handler_instrs = vm_handler.instrs;

    // display vm handler instructions...
    for ( const auto &instr : vm_handler_instrs )
    {
        auto new_instr = new qtree_widget_item_t();
        new_instr->setText(
            0, qstring_t::number( ( instr.addr - vminspector->module_base ) + vminspector->image_base, 16 ) );

        ZydisFormatterFormatInstruction( &formatter, &instr.instr, buffer, sizeof( buffer ),
                                         ( instr.addr - vminspector->module_base ) + vminspector->image_base );

        new_instr->setText( 1, buffer );
        ui->virt_handler_instrs_tree->addTopLevelItem( new_instr );
    }
}

void qvirt_handlers_t::on_select()
{
    auto item = ui->virt_handlers_tree->selectedItems()[ 0 ];

    if ( !item )
        return;

    if ( !vminspector->vmctx )
        return;

    const auto handler_idx = item->data( 0, Qt::UserRole ).value< std::uint8_t >();
    update_instrs( vminspector->vmctx->vm_handlers[ handler_idx ] );
    update_transforms( vminspector->vmctx->vm_handlers[ handler_idx ] );
}