Mirror-bot/raven
1
1 Fork 0
mirror of https://github.com/mirkobrombin/raven.git synced 2026-10-30 21:35:06 +00:00
Code Issues Projects Releases Activity
Files
91e09443bbfb61f4841b0df293eefee788006ab3
raven/pkg/ntapi/handler.go
T

9046 lines
239 KiB
Go
Raw Blame History

//go:build guest_windows
package ntapi
import (
"encoding/binary"
"fmt"
"os"
"runtime"
"sort"
"strings"
"time"
"github.com/mirkobrombin/Raven/pkg/arch"
"github.com/mirkobrombin/Raven/pkg/mmu"
ravelog "github.com/mirkobrombin/Raven/pkg/log"
"golang.org/x/sys/unix"
)
// NTSTATUS codes.
const (
StatusSuccess uint32 = 0x00000000
StatusInformationLength uint32 = 0x00000004
StatusBufferOverflow uint32 = 0x80000005
StatusNoMoreEntries uint32 = 0x8000001A
StatusNoMoreFiles uint32 = 0x80000006
StatusObjectNameNotFound uint32 = 0xC0000034
StatusObjectNameInvalid uint32 = 0xC0000033
StatusObjectPathNotFound uint32 = 0xC000003A
StatusNotImplemented uint32 = 0xC0000002
StatusAccessViolation uint32 = 0xC0000005
StatusInvalidHandle uint32 = 0xC0000008
StatusInvalidParameter uint32 = 0xC000000D
StatusAccessDenied uint32 = 0xC0000022
StatusBufferTooSmall uint32 = 0xC0000023
StatusNoSuchFile uint32 = 0xC000000F
StatusNoMemory uint32 = 0xC0000017
StatusObjectTypeMismatch uint32 = 0xC0000024
StatusObjectNameCollision uint32 = 0xC0000035
StatusKeyNotFound uint32 = 0xC0000225
StatusNotFound uint32 = 0xC0000225
StatusPending uint32 = 0x00000103
StatusTimeout uint32 = 0x00000102
StatusWait0 uint32 = 0x00000000
StatusAbandoned uint32 = 0x00000080
StatusAlerted uint32 = 0x00000101
StatusProcessIsTerminating uint32 = 0xC000010A
StatusEndOfFile uint32 = 0xC0000011
StatusFileLockConflict uint32 = 0xC0000054
StatusLockNotGranted uint32 = 0xC0000055
StatusRangeNotLocked uint32 = 0xC000007E
StatusCancelled uint32 = 0xC0000120
)
// File access and creation flags.
const (
fileSupersede = 0x00000000
fileOpen = 0x00000001
fileCreate = 0x00000002
fileOpenIf = 0x00000003
fileOverwrite = 0x00000004
fileOverwriteIf = 0x00000005
fileDirectoryFile = 0x00000001
fileNonDirectoryFile = 0x00000040
fileSynchronousIoAlert = 0x00000010
fileSynchronousIoNonalert = 0x00000020
nativeFileFlagOverlapped = uint32(0x40000000)
nativeUseFilePointer = uint64(0xFFFFFFFFFFFFFFFE)
nativeWriteToEndOfFile = uint64(0xFFFFFFFFFFFFFFFF)
)
// FileInformationClass values.
const (
fileDirectoryInformation = 1
fileBasicInformation = 4
fileStandardInformation = 5
fileNameInformation = 9
filePositionInformation = 14
fileDispositionInformation = 13
fileBothDirectoryInformation = 3
fileEndOfFileInformation = 20
fileAllInformation = 18
)
// ======================== FILE I/O ========================
const (
dupCloseSource = 0x00000001
dupSameAccess = 0x00000002
memCommit = 0x00001000
memReserve = 0x00002000
memDecommit = 0x00004000
memRelease = 0x00008000
secCommit = 0x08000000
)
type ntDirEntry struct {
Name string
IsDir bool
Size int64
Atime time.Time
Mtime time.Time
Ctime time.Time
Nlink uint32
}
func writeGuestPtr(mem *mmu.MMU, addr, val uint64) {
if addr == 0 {
return
}
if mem.Mode32 {
mem.Write32(addr, uint32(val))
return
}
mem.Write64(addr, val)
}
func guestPtrSize(mem *mmu.MMU) uint64 {
if mem.Mode32 {
return 4
}
return 8
}
func validateGuestWrite(mem *mmu.MMU, addr, size uint64) bool {
return addr != 0 && mem.ValidateRange(addr, size, mmu.PermWrite) == nil
}
func signalHandleEvent(ctx *TrapContext, eventHandle Handle) {
if eventHandle == 0 {
return
}
if eh := ctx.Handles.GetEvent(eventHandle); eh != nil {
eh.Set()
}
}
func ntStatusFromErr(err error, notFound uint32) uint32 {
if err == nil {
return StatusSuccess
}
msg := strings.ToLower(err.Error())
switch {
case strings.Contains(msg, "not found"), strings.Contains(msg, "no such"):
return notFound
case strings.Contains(msg, "exist"), strings.Contains(msg, "collision"):
return StatusObjectNameCollision
case strings.Contains(msg, "directory"):
return StatusAccessDenied
default:
return StatusAccessDenied
}
}
func desiredAccessToOpenFlags(desiredAccess uint32) int {
const (
genericRead = 0x80000000
genericWrite = 0x40000000
fileReadData = 0x0001
fileWriteData = 0x0002
fileAppend = 0x0004
)
canRead := desiredAccess&genericRead != 0 || desiredAccess&fileReadData != 0
canWrite := desiredAccess&genericWrite != 0 || desiredAccess&(fileWriteData|fileAppend) != 0
switch {
case canRead && canWrite:
return os.O_RDWR
case canWrite:
return os.O_WRONLY
default:
return os.O_RDONLY
}
}
func getFileOffset(ctx *TrapContext, fh *FileHandle) uint64 {
if fh == nil {
return 0
}
off, err := ctx.FS.Lseek(fh.FD, 0, 1)
if err != nil || off < 0 {
return 0
}
return uint64(off)
}
func wildcardMatch(pattern, name string) bool {
pattern = strings.ToLower(pattern)
name = strings.ToLower(name)
var match func(pi, ni int) bool
match = func(pi, ni int) bool {
for pi < len(pattern) {
switch pattern[pi] {
case '*':
for pi+1 < len(pattern) && pattern[pi+1] == '*' {
pi++
}
if pi+1 == len(pattern) {
return true
}
for i := ni; i <= len(name); i++ {
if match(pi+1, i) {
return true
}
}
return false
case '?':
if ni >= len(name) {
return false
}
pi++
ni++
default:
if ni >= len(name) || pattern[pi] != name[ni] {
return false
}
pi++
ni++
}
}
return ni == len(name)
}
if pattern == "" {
return true
}
if pattern == "*.*" {
return true
}
return match(0, 0)
}
func listDirectoryEntries(ctx *TrapContext, fh *FileHandle) []ntDirEntry {
if fh == nil {
return nil
}
if dirNode := ctx.FS.Stat(fh.FD); dirNode != nil && dirNode.IsDir && len(dirNode.Children) > 0 {
names := make([]string, 0, len(dirNode.Children))
for name := range dirNode.Children {
names = append(names, name)
}
sort.Strings(names)
out := make([]ntDirEntry, 0, len(names))
for _, name := range names {
child := dirNode.Children[name]
out = append(out, ntDirEntry{
Name: child.Name,
IsDir: child.IsDir,
Size: child.Size,
Atime: child.Atime,
Mtime: child.Mtime,
Ctime: child.Ctime,
Nlink: child.Nlink,
})
}
return out
}
hostEntries, err := os.ReadDir(fh.Path)
if err != nil {
return nil
}
sort.Slice(hostEntries, func(i, j int) bool {
return strings.ToLower(hostEntries[i].Name()) < strings.ToLower(hostEntries[j].Name())
})
out := make([]ntDirEntry, 0, len(hostEntries))
for _, entry := range hostEntries {
info, ierr := entry.Info()
if ierr != nil {
continue
}
out = append(out, ntDirEntry{
Name: entry.Name(),
IsDir: entry.IsDir(),
Size: info.Size(),
Atime: info.ModTime(),
Mtime: info.ModTime(),
Ctime: info.ModTime(),
Nlink: 1,
})
}
return out
}
func closeHandleObject(
ctx *TrapContext,
handle Handle,
obj HandleObject,
objectRefs, ownerRefs int,
) {
switch v := obj.(type) {
case *FileHandle:
CancelNativeIOForHandle(ctx.Handles, handle)
if ownerRefs == 0 {
FileLocksFor(ctx.FS).ReleaseOwner(v.LockOwner())
}
if v.DeletePending && v.Path != "" && objectRefs == 0 {
_ = ctx.FS.Unlinkat(-1, v.Path, 0)
}
if objectRefs == 0 {
_ = ctx.FS.Close(v.FD)
}
case *SectionHandle:
if v.FileFD >= 0 && objectRefs == 0 {
_ = ctx.FS.Close(v.FileFD)
}
case *IoCompletionPortHandle:
if objectRefs == 0 {
v.Close()
}
}
_ = handle
}
func cloneHandleObject(ctx *TrapContext, obj HandleObject) (HandleObject, uint32) {
switch v := obj.(type) {
case *FileHandle:
newFD, err := ctx.FS.Dup(v.FD)
if err != nil {
return nil, StatusInvalidHandle
}
v.completionState()
cp := *v
cp.FD = newFD
return &cp, StatusSuccess
case *SectionHandle:
cp := *v
if v.FileFD >= 0 {
newFD, err := ctx.FS.Dup(v.FileFD)
if err != nil {
return nil, StatusInvalidHandle
}
cp.FileFD = newFD
}
if v.ViewSizes != nil {
cp.ViewSizes = make(map[uint64]uint64, len(v.ViewSizes))
for k, val := range v.ViewSizes {
cp.ViewSizes[k] = val
}
}
return &cp, StatusSuccess
default:
return obj, StatusSuccess
}
}
func handleNtCreateFile(ctx *TrapContext) uint32 {
// NtCreateFile(FileHandle*, DesiredAccess, ObjectAttributes*, IoStatusBlock*,
// AllocationSize*, FileAttributes, ShareAccess, CreateDisposition,
// CreateOptions, EaBuffer*, EaLength)
handlePtr := ctx.Arg(0)
desiredAccess := uint32(ctx.Arg(1))
objAttr := ctx.Arg(2)
ioStatus := ctx.Arg(3)
createDisp := uint32(ctx.Arg(7))
createOpts := uint32(ctx.Arg(8))
rootDir, _, attrs, err := ReadObjectAttributes(ctx, objAttr)
path, err := ResolveObjectPath(ctx, objAttr)
if err != nil || path == "" {
writeIOStatus(ctx.Mem, ioStatus, StatusObjectPathNotFound, 0)
return StatusObjectPathNotFound
}
if ctx.Trace {
fmt.Printf(" NtCreateFile: path=%q root=0x%x attrs=0x%x access=0x%x disp=%d opts=0x%x\n", path, rootDir, attrs, desiredAccess, createDisp, createOpts)
}
isDir := createOpts&fileDirectoryFile != 0
baseFlags := desiredAccessToOpenFlags(desiredAccess)
fileInfo := uint64(1)
_, statErr := ctx.FS.StatPath(-100, path)
exists := statErr == nil
if createDisp == fileCreate && exists {
writeIOStatus(ctx.Mem, ioStatus, StatusObjectNameCollision, 0)
return StatusObjectNameCollision
}
if createDisp == fileOpen && !exists {
writeIOStatus(ctx.Mem, ioStatus, StatusObjectNameNotFound, 0)
return StatusObjectNameNotFound
}
flags := baseFlags
switch createDisp {
case fileCreate, fileOpenIf:
flags |= os.O_CREATE
case fileOverwrite, fileOverwriteIf, fileSupersede:
flags |= os.O_CREATE | os.O_TRUNC
}
if desiredAccess&0x0004 != 0 {
flags |= os.O_APPEND
}
if isDir {
if createDisp == fileCreate || createDisp == fileOpenIf || createDisp == fileOverwriteIf || createDisp == fileSupersede {
ctx.FS.MkdirAll(path)
fileInfo = 2
}
} else {
switch createDisp {
case fileCreate:
fileInfo = 2
case fileOpenIf:
if !exists {
fileInfo = 2
}
case fileOverwrite, fileOverwriteIf:
fileInfo = 3
case fileSupersede:
fileInfo = 4
}
}
fd, openErr := ctx.FS.OpenAt(-100, path, flags, 0644)
if openErr != nil {
status := ntStatusFromErr(openErr, StatusObjectNameNotFound)
writeIOStatus(ctx.Mem, ioStatus, status, 0)
return status
}
isDirectory := isDir
if node := ctx.FS.Stat(fd); node != nil {
isDirectory = node.IsDir
}
var fileFlags uint32
if createOpts&(fileSynchronousIoAlert|fileSynchronousIoNonalert) == 0 {
fileFlags = 0x40000000 // FILE_FLAG_OVERLAPPED
}
fh := &FileHandle{
FD: fd,
Path: path,
Access: desiredAccess,
Flags: fileFlags,
IsDirectory: isDirectory,
}
h := ctx.Handles.Alloc(fh)
writeGuestPtr(ctx.Mem, handlePtr, uint64(h))
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, fileInfo)
return StatusSuccess
}
func handleNtOpenFile(ctx *TrapContext) uint32 {
// Same as NtCreateFile but with fewer params
return handleNtCreateFile(ctx)
}
func fileHandleCanReadNative(file *FileHandle) bool {
const (
genericRead = uint32(0x80000000)
genericAll = uint32(0x10000000)
fileRead = uint32(0x00000001)
)
return file != nil && file.Access&(genericRead|genericAll|fileRead) != 0
}
func fileHandleCanWriteNative(file *FileHandle) bool {
const (
genericWrite = uint32(0x40000000)
genericAll = uint32(0x10000000)
fileWrite = uint32(0x00000002)
fileAppend = uint32(0x00000004)
)
return file != nil &&
file.Access&(genericWrite|genericAll|fileWrite|fileAppend) != 0
}
func fileHandleAppendOnlyNative(file *FileHandle) bool {
const (
genericWrite = uint32(0x40000000)
genericAll = uint32(0x10000000)
fileWrite = uint32(0x00000002)
fileAppend = uint32(0x00000004)
)
if file == nil {
return false
}
canOverwrite := file.Access&(genericWrite|genericAll|fileWrite) != 0
return !canOverwrite && file.Access&fileAppend != 0
}
func nativeFileCurrentOffset(ctx *TrapContext, file *FileHandle) uint64 {
offset, err := ctx.FS.Lseek(file.FD, 0, 1)
if err != nil || offset < 0 {
return 0
}
return uint64(offset)
}
func nativeFileIORangeValid(offset, length uint64) bool {
const maxFileOffset = uint64(1<<63 - 1)
return offset <= maxFileOffset && length <= maxFileOffset-offset
}
func nativeFileWriteOffset(
ctx *TrapContext,
file *FileHandle,
requested uint64,
useCurrent bool,
) uint64 {
const (
genericWrite = uint32(0x40000000)
genericAll = uint32(0x10000000)
fileWrite = uint32(0x00000002)
fileAppend = uint32(0x00000004)
)
canOverwrite := file.Access&(genericWrite|genericAll|fileWrite) != 0
if !canOverwrite && file.Access&fileAppend != 0 {
if node := ctx.FS.Stat(file.FD); node != nil && node.Size > 0 {
return uint64(node.Size)
}
return 0
}
if useCurrent {
return nativeFileCurrentOffset(ctx, file)
}
return requested
}
func withNativeFileRead(
ctx *TrapContext,
file *FileHandle,
start, length uint64,
access func(),
) bool {
identity, ok := ctx.FS.FileIdentity(file.FD)
if !ok {
access()
return true
}
return FileLocksFor(ctx.FS).WithReadAccess(
identity,
file.LockOwner(),
start,
length,
access,
)
}
func withNativeFileWrite(
ctx *TrapContext,
file *FileHandle,
start, length uint64,
access func(),
) bool {
identity, ok := ctx.FS.FileIdentity(file.FD)
if !ok {
access()
return true
}
return FileLocksFor(ctx.FS).WithWriteAccess(
identity,
file.LockOwner(),
start,
length,
access,
)
}
func handleNtReadFile(ctx *TrapContext) uint32 {
// NtReadFile(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock*, Buffer, Length, ByteOffset*, Key*)
// ReactOS reference: ntoskrnl/io/iomgr/iofunc.c NtReadFile
fileHandle := Handle(ctx.Arg(0))
eventHandle := Handle(ctx.Arg(1))
apcRoutine := ctx.Arg(2)
apcContext := ctx.Arg(3)
ioStatus := ctx.Arg(4)
bufAddr := ctx.Arg(5)
length := ctx.Arg(6)
pByteOffset := ctx.Arg(7)
keyAddr := ctx.Arg(8)
const maxNativeIOBuffer = uint64(256 << 20)
if length > maxNativeIOBuffer {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidParameter, 0)
return StatusInvalidParameter
}
ioStatusSize := uint64(16)
if ctx.Mem.Mode32 {
ioStatusSize = 8
}
if !validateGuestWrite(ctx.Mem, ioStatus, ioStatusSize) {
return StatusAccessViolation
}
fh := ctx.Handles.GetFile(fileHandle)
if fh == nil {
if pipe := ctx.Handles.GetNamedPipe(fileHandle); pipe != nil {
if length != 0 &&
ctx.Mem.ValidateRange(bufAddr, length, mmu.PermWrite) != nil {
writeIOStatus(ctx.Mem, ioStatus, StatusAccessViolation, 0)
return StatusAccessViolation
}
data := make([]byte, length)
n := pipe.PipeRead(data)
status := uint32(StatusSuccess)
if n == 0 && length > 0 {
status = StatusEndOfFile
}
if n > 0 {
ctx.Mem.WriteBytes(bufAddr, data[:n])
}
writeIOStatus(ctx.Mem, ioStatus, status, uint64(n))
signalHandleEvent(ctx, eventHandle)
return status
}
}
if fh == nil {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidHandle, 0)
return StatusInvalidHandle
}
if !fileHandleCanReadNative(fh) {
writeIOStatus(ctx.Mem, ioStatus, StatusAccessDenied, 0)
return StatusAccessDenied
}
if length != 0 &&
ctx.Mem.ValidateRange(bufAddr, length, mmu.PermWrite) != nil {
writeIOStatus(ctx.Mem, ioStatus, StatusAccessViolation, 0)
return StatusAccessViolation
}
if pByteOffset != 0 &&
ctx.Mem.ValidateRange(pByteOffset, 8, mmu.PermRead) != nil {
writeIOStatus(ctx.Mem, ioStatus, StatusAccessViolation, 0)
return StatusAccessViolation
}
if keyAddr != 0 && ctx.Mem.ValidateRange(keyAddr, 4, mmu.PermRead) != nil {
writeIOStatus(ctx.Mem, ioStatus, StatusAccessViolation, 0)
return StatusAccessViolation
}
var event *EventHandle
if eventHandle != 0 {
event = ctx.Handles.GetEvent(eventHandle)
if event == nil {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidHandle, 0)
return StatusInvalidHandle
}
}
useCurrent := true
offset := uint64(0)
if pByteOffset != 0 {
offset, _ = ctx.Mem.Read64(pByteOffset)
useCurrent = offset == nativeUseFilePointer
}
isAsync := fh.Flags&nativeFileFlagOverlapped != 0
if useCurrent && isAsync {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidParameter, 0)
return StatusInvalidParameter
}
lockOffset := offset
if useCurrent {
lockOffset = nativeFileCurrentOffset(ctx, fh)
}
if !nativeFileIORangeValid(lockOffset, length) {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidParameter, 0)
return StatusInvalidParameter
}
perform := func() (uint32, uint64) {
buf := make([]byte, length)
var n int
var err error
if !withNativeFileRead(ctx, fh, lockOffset, length, func() {
if useCurrent {
n, err = ctx.FS.Read(fh.FD, buf)
} else {
n, err = ctx.FS.Pread(fh.FD, buf, int64(offset))
if !isAsync {
_, seekErr := ctx.FS.Lseek(
fh.FD,
int64(offset)+int64(n),
0,
)
if err == nil {
err = seekErr
}
}
}
}) {
return StatusFileLockConflict, 0
}
status := uint32(StatusSuccess)
if n == 0 && err != nil {
status = StatusEndOfFile
}
if n > 0 {
ctx.Mem.WriteBytes(bufAddr, buf[:n])
}
return status, uint64(n)
}
if isAsync {
operation := beginNativeIO(
ctx,
fileHandle,
fh,
ioStatus,
event,
apcRoutine,
apcContext,
)
go func() {
select {
case <-operation.cancel:
operation.complete(StatusCancelled, 0)
return
default:
}
status, information := perform()
select {
case <-operation.cancel:
operation.complete(StatusCancelled, 0)
default:
operation.complete(status, information)
}
}()
return StatusPending
}
status, information := perform()
completeNativeIOInline(
ctx,
fileHandle,
fh,
ioStatus,
event,
apcRoutine,
apcContext,
status,
information,
)
return status
}
func handleNtWriteFile(ctx *TrapContext) uint32 {
// NtWriteFile(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock*, Buffer, Length, ByteOffset*, Key*)
// ReactOS reference: ntoskrnl/io/iomgr/iofunc.c NtWriteFile
fileHandle := Handle(ctx.Arg(0))
eventHandle := Handle(ctx.Arg(1))
apcRoutine := ctx.Arg(2)
apcContext := ctx.Arg(3)
ioStatus := ctx.Arg(4)
bufAddr := ctx.Arg(5)
length := ctx.Arg(6)
pByteOffset := ctx.Arg(7)
keyAddr := ctx.Arg(8)
const maxNativeIOBuffer = uint64(256 << 20)
if length > maxNativeIOBuffer {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidParameter, 0)
return StatusInvalidParameter
}
ioStatusSize := uint64(16)
if ctx.Mem.Mode32 {
ioStatusSize = 8
}
if !validateGuestWrite(ctx.Mem, ioStatus, ioStatusSize) {
return StatusAccessViolation
}
// Handle standard output/error pseudo-handles
if uint64(fileHandle) == 0xFFFFFFF5 || uint64(fileHandle) == 0xFFFFFFF4 {
data, err := ctx.Mem.ReadBytes(bufAddr, int(length))
if err != nil {
return StatusInvalidParameter
}
fd := 1
if uint64(fileHandle) == 0xFFFFFFF4 {
fd = 2
}
ctx.FS.Write(fd, data)
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, length)
return StatusSuccess
}
fh := ctx.Handles.GetFile(fileHandle)
if fh == nil {
if pipe := ctx.Handles.GetNamedPipe(fileHandle); pipe != nil {
data, err := ctx.Mem.ReadBytes(bufAddr, int(length))
if err != nil {
return StatusInvalidParameter
}
if pByteOffset != 0 {
offset, _ := ctx.Mem.Read64(pByteOffset)
_ = offset
}
if !pipe.PipeWrite(data) {
return StatusAccessDenied
}
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, length)
signalHandleEvent(ctx, eventHandle)
return StatusSuccess
}
}
if fh == nil {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidHandle, 0)
return StatusInvalidHandle
}
if !fileHandleCanWriteNative(fh) {
writeIOStatus(ctx.Mem, ioStatus, StatusAccessDenied, 0)
return StatusAccessDenied
}
if length != 0 &&
ctx.Mem.ValidateRange(bufAddr, length, mmu.PermRead) != nil {
writeIOStatus(ctx.Mem, ioStatus, StatusAccessViolation, 0)
return StatusAccessViolation
}
if pByteOffset != 0 &&
ctx.Mem.ValidateRange(pByteOffset, 8, mmu.PermRead) != nil {
writeIOStatus(ctx.Mem, ioStatus, StatusAccessViolation, 0)
return StatusAccessViolation
}
if keyAddr != 0 && ctx.Mem.ValidateRange(keyAddr, 4, mmu.PermRead) != nil {
writeIOStatus(ctx.Mem, ioStatus, StatusAccessViolation, 0)
return StatusAccessViolation
}
var event *EventHandle
if eventHandle != 0 {
event = ctx.Handles.GetEvent(eventHandle)
if event == nil {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidHandle, 0)
return StatusInvalidHandle
}
}
data, err := ctx.Mem.ReadBytes(bufAddr, int(length))
if err != nil {
writeIOStatus(ctx.Mem, ioStatus, StatusAccessViolation, 0)
return StatusAccessViolation
}
useCurrent := true
offset := uint64(0)
writeToEnd := false
if pByteOffset != 0 {
offset, _ = ctx.Mem.Read64(pByteOffset)
useCurrent = offset == nativeUseFilePointer
writeToEnd = offset == nativeWriteToEndOfFile
}
isAsync := fh.Flags&nativeFileFlagOverlapped != 0
if useCurrent && isAsync && !fileHandleAppendOnlyNative(fh) {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidParameter, 0)
return StatusInvalidParameter
}
if writeToEnd {
offset = 0
if node := ctx.FS.Stat(fh.FD); node != nil && node.Size > 0 {
offset = uint64(node.Size)
}
useCurrent = false
}
lockOffset := nativeFileWriteOffset(ctx, fh, offset, useCurrent)
if !nativeFileIORangeValid(lockOffset, length) {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidParameter, 0)
return StatusInvalidParameter
}
perform := func() (uint32, uint64) {
var n int
var writeErr error
if !withNativeFileWrite(ctx, fh, lockOffset, length, func() {
if useCurrent {
n, writeErr = ctx.FS.Write(fh.FD, data)
} else {
n, writeErr = ctx.FS.Pwrite(fh.FD, data, int64(offset))
if !isAsync {
_, seekErr := ctx.FS.Lseek(
fh.FD,
int64(lockOffset)+int64(n),
0,
)
if writeErr == nil {
writeErr = seekErr
}
}
}
}) {
return StatusFileLockConflict, 0
}
if writeErr != nil {
return StatusAccessDenied, 0
}
return StatusSuccess, uint64(n)
}
if isAsync {
operation := beginNativeIO(
ctx,
fileHandle,
fh,
ioStatus,
event,
apcRoutine,
apcContext,
)
go func() {
select {
case <-operation.cancel:
operation.complete(StatusCancelled, 0)
return
default:
}
status, information := perform()
select {
case <-operation.cancel:
operation.complete(StatusCancelled, 0)
default:
operation.complete(status, information)
}
}()
return StatusPending
}
status, information := perform()
completeNativeIOInline(
ctx,
fileHandle,
fh,
ioStatus,
event,
apcRoutine,
apcContext,
status,
information,
)
return status
}
func handleNtClose(ctx *TrapContext) uint32 {
handle := Handle(ctx.Arg(0))
obj, objectRefs, ownerRefs, ok := ctx.Handles.Take(handle)
if !ok {
return StatusInvalidHandle
}
closeHandleObject(ctx, handle, obj, objectRefs, ownerRefs)
return StatusSuccess
}
func handleNtQueryInformationFile(ctx *TrapContext) uint32 {
fileHandle := Handle(ctx.Arg(0))
ioStatus := ctx.Arg(1)
buffer := ctx.Arg(2)
length := ctx.Arg(3)
infoClass := uint32(ctx.Arg(4))
fh := ctx.Handles.GetFile(fileHandle)
if fh == nil {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidHandle, 0)
return StatusInvalidHandle
}
node := ctx.FS.Stat(fh.FD)
if node == nil {
writeIOStatus(ctx.Mem, ioStatus, StatusNoSuchFile, 0)
return StatusNoSuchFile
}
attrs := uint32(0x80)
if node.IsDir {
attrs = 0x10
}
createFT := windowsFileTime(node.Ctime)
accessFT := windowsFileTime(node.Atime)
writeFT := windowsFileTime(node.Mtime)
changeFT := windowsFileTime(node.Ctime)
eof := uint64(node.Size)
alloc := (eof + mmu.PageSize - 1) & mmu.PageMask
if eof == 0 {
alloc = 0
}
winPath := `\??\` + VFSToNtPath(fh.Path)
nameBytes := encodeUTF16LE(winPath)
position := getFileOffset(ctx, fh)
switch infoClass {
case fileBasicInformation:
if length < 40 {
writeIOStatus(ctx.Mem, ioStatus, StatusBufferTooSmall, 0)
return StatusBufferTooSmall
}
ctx.Mem.Write64(buffer+0, createFT)
ctx.Mem.Write64(buffer+8, accessFT)
ctx.Mem.Write64(buffer+16, writeFT)
ctx.Mem.Write64(buffer+24, changeFT)
ctx.Mem.Write32(buffer+32, attrs)
ctx.Mem.Write32(buffer+36, 0)
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, 40)
return StatusSuccess
case fileStandardInformation:
if length < 24 {
writeIOStatus(ctx.Mem, ioStatus, StatusBufferTooSmall, 0)
return StatusBufferTooSmall
}
ctx.Mem.Write64(buffer+0, alloc)
ctx.Mem.Write64(buffer+8, eof)
ctx.Mem.Write32(buffer+16, node.Nlink)
ctx.Mem.Write8(buffer+20, boolToByte(fh.DeletePending))
ctx.Mem.Write8(buffer+21, boolToByte(node.IsDir))
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, 24)
return StatusSuccess
case fileNameInformation:
needed := uint64(4 + len(nameBytes))
if length < 4 {
writeIOStatus(ctx.Mem, ioStatus, StatusBufferTooSmall, 0)
return StatusBufferTooSmall
}
ctx.Mem.Write32(buffer+0, uint32(len(nameBytes)))
toCopy := minUint32(uint32(len(nameBytes)), uint32(length-4))
if toCopy > 0 {
ctx.Mem.WriteBytes(buffer+4, nameBytes[:toCopy])
}
if length < needed {
writeIOStatus(ctx.Mem, ioStatus, StatusBufferOverflow, length)
return StatusBufferOverflow
}
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, needed)
return StatusSuccess
case filePositionInformation:
if length < 8 {
writeIOStatus(ctx.Mem, ioStatus, StatusBufferTooSmall, 0)
return StatusBufferTooSmall
}
ctx.Mem.Write64(buffer, position)
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, 8)
return StatusSuccess
case fileEndOfFileInformation:
if length < 8 {
writeIOStatus(ctx.Mem, ioStatus, StatusBufferTooSmall, 0)
return StatusBufferTooSmall
}
ctx.Mem.Write64(buffer, eof)
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, 8)
return StatusSuccess
case fileAllInformation:
needed := uint64(96 + 4 + len(nameBytes))
if length < 96 {
writeIOStatus(ctx.Mem, ioStatus, StatusBufferTooSmall, 0)
return StatusBufferTooSmall
}
ctx.Mem.Write64(buffer+0, createFT)
ctx.Mem.Write64(buffer+8, accessFT)
ctx.Mem.Write64(buffer+16, writeFT)
ctx.Mem.Write64(buffer+24, changeFT)
ctx.Mem.Write32(buffer+32, attrs)
ctx.Mem.Write32(buffer+36, 0)
ctx.Mem.Write64(buffer+40, alloc)
ctx.Mem.Write64(buffer+48, eof)
ctx.Mem.Write32(buffer+56, node.Nlink)
ctx.Mem.Write8(buffer+60, boolToByte(fh.DeletePending))
ctx.Mem.Write8(buffer+61, boolToByte(node.IsDir))
ctx.Mem.Write32(buffer+76, fh.Access)
ctx.Mem.Write64(buffer+80, position)
ctx.Mem.Write32(buffer+88, 0)
ctx.Mem.Write32(buffer+92, 0)
ctx.Mem.Write32(buffer+96, uint32(len(nameBytes)))
avail := uint32(0)
if length > 100 {
avail = uint32(length - 100)
}
toCopy := minUint32(uint32(len(nameBytes)), avail)
if toCopy > 0 {
ctx.Mem.WriteBytes(buffer+100, nameBytes[:toCopy])
}
if length < needed {
writeIOStatus(ctx.Mem, ioStatus, StatusBufferOverflow, length)
return StatusBufferOverflow
}
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, needed)
return StatusSuccess
default:
writeIOStatus(ctx.Mem, ioStatus, StatusNotImplemented, 0)
return StatusNotImplemented
}
}
func handleNtSetInformationFile(ctx *TrapContext) uint32 {
fileHandle := Handle(ctx.Arg(0))
ioStatus := ctx.Arg(1)
buffer := ctx.Arg(2)
length := uint32(ctx.Arg(3))
class := uint32(ctx.Arg(4))
fh := ctx.Handles.GetFile(fileHandle)
if fh == nil {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidHandle, 0)
return StatusInvalidHandle
}
switch class {
case fileDispositionInformation:
deleteFile := false
if buffer != 0 {
flag, _ := ctx.Mem.Read8(buffer)
deleteFile = flag != 0
}
fh.DeletePending = deleteFile
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, 0)
return StatusSuccess
case filePositionInformation:
pos, _ := ctx.Mem.Read64(buffer)
if _, err := ctx.FS.Lseek(fh.FD, int64(pos), 0); err != nil {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidParameter, 0)
return StatusInvalidParameter
}
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, 0)
return StatusSuccess
case fileEndOfFileInformation, 19:
eof, _ := ctx.Mem.Read64(buffer)
if err := ctx.FS.Ftruncate(fh.FD, int64(eof)); err != nil {
status := ntStatusFromErr(err, StatusInvalidParameter)
writeIOStatus(ctx.Mem, ioStatus, status, 0)
return status
}
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, 0)
return StatusSuccess
case 10:
var replaceIfExists bool
var rootDir Handle
var nameLen uint32
var nameAddr uint64
if ctx.Mem.Mode32 {
flag, _ := ctx.Mem.Read8(buffer)
replaceIfExists = flag != 0
rootVal, _ := ctx.Mem.Read32(buffer + 4)
rootDir = Handle(rootVal)
nameLen, _ = ctx.Mem.Read32(buffer + 8)
nameAddr = buffer + 12
} else {
flag, _ := ctx.Mem.Read8(buffer)
replaceIfExists = flag != 0
rootVal, _ := ctx.Mem.Read64(buffer + 8)
rootDir = Handle(rootVal)
nameLen, _ = ctx.Mem.Read32(buffer + 16)
nameAddr = buffer + 20
}
if nameLen == 0 || length < nameLen {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidParameter, 0)
return StatusInvalidParameter
}
nameBytes, err := ctx.Mem.ReadBytes(nameAddr, int(nameLen))
if err != nil {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidParameter, 0)
return StatusInvalidParameter
}
newName := decodeUTF16LE(nameBytes)
newPath := NtPathToVFS(newName)
if !(strings.HasPrefix(newName, `\`) || (len(newName) >= 2 && newName[1] == ':')) {
basePath := fh.Path
if rootDir != 0 {
if base := ctx.Handles.GetFile(rootDir); base != nil {
basePath = base.Path
}
} else if slash := strings.LastIndex(basePath, "/"); slash >= 0 {
basePath = basePath[:slash]
if basePath == "" {
basePath = "/"
}
}
if !strings.HasPrefix(newPath, "/") {
newPath = "/" + newPath
}
if basePath == "/" {
newPath = basePath + strings.TrimPrefix(newPath, "/")
} else {
newPath = basePath + newPath
}
}
if replaceIfExists {
_ = ctx.FS.Unlinkat(-1, newPath, 0)
}
if err := ctx.FS.Renameat(-1, fh.Path, -1, newPath); err != nil {
status := ntStatusFromErr(err, StatusObjectNameNotFound)
writeIOStatus(ctx.Mem, ioStatus, status, 0)
return status
}
fh.Path = newPath
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, 0)
return StatusSuccess
default:
writeIOStatus(ctx.Mem, ioStatus, StatusNotImplemented, 0)
return StatusNotImplemented
}
}
func decodeUTF16(chars []uint16) []rune {
var out []rune
for i := 0; i < len(chars); i++ {
if chars[i] >= 0xD800 && chars[i] <= 0xDBFF && i+1 < len(chars) {
hi := rune(chars[i]) - 0xD800
lo := rune(chars[i+1]) - 0xDC00
out = append(out, 0x10000+hi<<10+lo)
i++
} else {
out = append(out, rune(chars[i]))
}
}
return out
}
func handleNtQueryDirectoryFile(ctx *TrapContext) uint32 {
fileHandle := Handle(ctx.Arg(0))
eventHandle := Handle(ctx.Arg(1))
ioStatus := ctx.Arg(4)
buffer := ctx.Arg(5)
length := ctx.Arg(6)
infoClass := uint32(ctx.Arg(7))
returnSingleEntry := ctx.Arg(8) != 0
fileNamePtr := ctx.Arg(9)
restartScan := ctx.Arg(10) != 0
fh := ctx.Handles.GetFile(fileHandle)
if fh == nil {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidHandle, 0)
return StatusInvalidHandle
}
if restartScan {
fh.DirIndex = 0
}
if fileNamePtr != 0 {
mask, err := ReadUnicodeString(ctx.Mem, fileNamePtr)
if err == nil {
fh.DirMask = mask
}
}
allEntries := listDirectoryEntries(ctx, fh)
if len(allEntries) == 0 {
writeIOStatus(ctx.Mem, ioStatus, StatusNoMoreFiles, 0)
return StatusNoMoreFiles
}
matches := make([]ntDirEntry, 0, len(allEntries))
for _, entry := range allEntries {
if fh.DirMask == "" || wildcardMatch(fh.DirMask, entry.Name) {
matches = append(matches, entry)
}
}
if fh.DirIndex >= len(matches) {
writeIOStatus(ctx.Mem, ioStatus, StatusNoMoreFiles, 0)
return StatusNoMoreFiles
}
offset := uint64(0)
prevOffset := uint64(0)
prevSize := uint64(0)
written := 0
for idx := fh.DirIndex; idx < len(matches); idx++ {
entry := matches[idx]
nameUTF16 := encodeUTF16LE(entry.Name)
baseSize := uint64(64)
nameOffset := uint64(64)
if infoClass == fileBothDirectoryInformation {
baseSize = 94
nameOffset = 94
} else if infoClass != fileDirectoryInformation {
writeIOStatus(ctx.Mem, ioStatus, StatusNotImplemented, 0)
return StatusNotImplemented
}
entrySize := (baseSize + uint64(len(nameUTF16)) + 7) &^ uint64(7)
if offset+entrySize > length {
break
}
addr := buffer + offset
if written > 0 {
ctx.Mem.Write32(buffer+prevOffset, uint32(prevSize))
}
createFT := windowsFileTime(entry.Ctime)
accessFT := windowsFileTime(entry.Atime)
writeFT := windowsFileTime(entry.Mtime)
changeFT := windowsFileTime(entry.Ctime)
attrs := uint32(0x80)
if entry.IsDir {
attrs = 0x10
}
ctx.Mem.Write32(addr+0, 0)
ctx.Mem.Write32(addr+4, uint32(idx))
ctx.Mem.Write64(addr+8, createFT)
ctx.Mem.Write64(addr+16, accessFT)
ctx.Mem.Write64(addr+24, writeFT)
ctx.Mem.Write64(addr+32, changeFT)
ctx.Mem.Write64(addr+40, uint64(entry.Size))
ctx.Mem.Write64(addr+48, uint64(entry.Size))
ctx.Mem.Write32(addr+56, attrs)
ctx.Mem.Write32(addr+60, uint32(len(nameUTF16)))
if infoClass == fileBothDirectoryInformation {
ctx.Mem.Write32(addr+64, 0)
ctx.Mem.Write8(addr+68, 0)
ctx.Mem.Write8(addr+69, 0)
}
ctx.Mem.WriteBytes(addr+nameOffset, nameUTF16)
prevOffset = offset
prevSize = entrySize
offset += entrySize
written++
fh.DirIndex = idx + 1
if returnSingleEntry {
break
}
}
if written == 0 {
writeIOStatus(ctx.Mem, ioStatus, StatusBufferTooSmall, 0)
return StatusBufferTooSmall
}
ctx.Mem.Write32(buffer+prevOffset, 0)
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, offset)
signalHandleEvent(ctx, eventHandle)
return StatusSuccess
}
func handleNtQueryVolumeInformationFile(ctx *TrapContext) uint32 {
_ = Handle(ctx.Arg(0)) // FileHandle
ioStatus := ctx.Arg(1)
buffer := ctx.Arg(2)
length := uint32(ctx.Arg(3))
class := uint32(ctx.Arg(4))
switch class {
case 1: // FileFsVolumeInformation
label := "Raven"
labelUTF16 := encodeUTF16LE(label)
needed := uint32(18 + len(labelUTF16))
if length < needed {
writeIOStatus(ctx.Mem, ioStatus, StatusBufferOverflow, 0)
return StatusBufferOverflow
}
if buffer != 0 {
ctx.Mem.Write64(buffer, 0) // VolumeCreationTime
ctx.Mem.Write32(buffer+8, 0x12345678) // VolumeSerialNumber
ctx.Mem.Write32(buffer+12, uint32(len(labelUTF16))) // VolumeLabelLength
ctx.Mem.Write8(buffer+16, 0) // SupportsObjects (BOOLEAN)
ctx.Mem.Write8(buffer+17, 0) // padding
ctx.Mem.WriteBytes(buffer+18, labelUTF16) // VolumeLabel
}
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, uint64(needed))
case 3: // FileFsSizeInformation
if length < 24 {
writeIOStatus(ctx.Mem, ioStatus, StatusBufferTooSmall, 0)
return StatusBufferTooSmall
}
if buffer != 0 {
ctx.Mem.Write64(buffer, 1000000) // TotalAllocationUnits
ctx.Mem.Write64(buffer+8, 500000) // AvailableAllocationUnits
ctx.Mem.Write32(buffer+16, 8) // SectorsPerAllocationUnit
ctx.Mem.Write32(buffer+20, 512) // BytesPerSector
}
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, 24)
case 4: // FileFsDeviceInformation
if length < 8 {
writeIOStatus(ctx.Mem, ioStatus, StatusBufferTooSmall, 0)
return StatusBufferTooSmall
}
if buffer != 0 {
ctx.Mem.Write32(buffer, 7) // DeviceType (FILE_DEVICE_DISK)
ctx.Mem.Write32(buffer+4, 0) // Characteristics
}
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, 8)
case 5: // FileFsAttributeInformation
fsName := "NTFS"
fsNameUTF16 := encodeUTF16LE(fsName)
needed := uint32(12 + len(fsNameUTF16))
if length < needed {
writeIOStatus(ctx.Mem, ioStatus, StatusBufferOverflow, 0)
return StatusBufferOverflow
}
if buffer != 0 {
ctx.Mem.Write32(buffer, 0x00000003) // FileSystemAttributes (CASE_PRESERVED|CASE_SENSITIVE)
ctx.Mem.Write32(buffer+4, 255) // MaximumComponentNameLength
ctx.Mem.Write32(buffer+8, uint32(len(fsNameUTF16))) // FileSystemNameLength
ctx.Mem.WriteBytes(buffer+12, fsNameUTF16) // FileSystemName
}
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, uint64(needed))
default:
return StatusNotImplemented
}
return StatusSuccess
}
func handleNtDeleteFile(ctx *TrapContext) uint32 {
// NtDeleteFile(POBJECT_ATTRIBUTES ObjectAttributes)
objAttr := ctx.Arg(0)
path, err := ResolveObjectPath(ctx, objAttr)
if err != nil || path == "" {
return StatusObjectPathNotFound
}
vfsPath := path
if strings.TrimSpace(vfsPath) == "" {
return StatusObjectPathNotFound
}
if err := ctx.FS.Unlinkat(-1, vfsPath, 0); err != nil {
msg := strings.ToLower(err.Error())
switch {
case strings.Contains(msg, "not found"), strings.Contains(msg, "no such"):
return StatusObjectNameNotFound
case strings.Contains(msg, "is a directory"), strings.Contains(msg, "not a directory"):
return StatusAccessDenied
case strings.Contains(msg, "directory not empty"):
return StatusAccessDenied
default:
return StatusAccessDenied
}
}
return StatusSuccess
}
func handleNtFlushBuffersFile(ctx *TrapContext) uint32 {
return StatusSuccess
}
func handleNtDeviceIoControlFile(ctx *TrapContext) uint32 {
fileHandle := Handle(ctx.Arg(0))
_ = ctx.Arg(1) // Event
_ = ctx.Arg(2) // ApcRoutine
_ = ctx.Arg(3) // ApcContext
ioStatus := ctx.Arg(4)
ioctlCode := uint32(ctx.Arg(5))
if ctx.Trace {
fmt.Printf(" NtDeviceIoControlFile: handle=0x%x ioctl=0x%08x\n", fileHandle, ioctlCode)
}
// Decode device type from IOCTL code
deviceType := (ioctlCode >> 16) & 0xFFFF
// Console device IOCTLs (FILE_DEVICE_CONSOLE = 0x50) - succeed silently
// even for invalid handles, as Wine uses these for debug output via condrv
if deviceType == 0x50 {
if ctx.Trace {
inputBuf := ctx.Arg(6)
inputLen := uint32(ctx.Arg(7)) // ULONG - 32-bit
if inputBuf != 0 && inputLen > 0 && inputLen < 4096 {
data, err := ctx.Mem.ReadBytes(inputBuf, int(inputLen))
if err == nil {
fmt.Printf(" [wine] %s", string(data))
}
}
}
if ioStatus != 0 {
ctx.Mem.Write32(ioStatus, StatusSuccess)
ctx.Mem.Write64(ioStatus+8, 0)
}
return StatusSuccess
}
// Reject truly invalid handles for non-console IOCTLs
if fileHandle == 0xFFFFFFFFFFFFFFFF || fileHandle == 0 {
if ioStatus != 0 {
ctx.Mem.Write32(ioStatus, StatusInvalidHandle)
ctx.Mem.Write64(ioStatus+8, 0)
}
return StatusInvalidHandle
}
// Console mode IOCTLs (legacy path)
const (
ctlCodeGetMode = 0x500000
ctlCodeSetMode = 0x500004
)
switch ioctlCode {
case ctlCodeGetMode:
outBuf := ctx.Arg(8)
if outBuf != 0 {
ctx.Mem.Write32(outBuf, 0x0007)
}
case ctlCodeSetMode:
// Accept silently
default:
writeIOStatus(ctx.Mem, ioStatus, 0xC0000010, 0) // STATUS_INVALID_DEVICE_REQUEST
return 0xC0000010
}
if ioStatus != 0 {
ctx.Mem.Write32(ioStatus, StatusSuccess)
ctx.Mem.Write64(ioStatus+8, 0)
}
return StatusSuccess
}
func handleNtCreateSection(ctx *TrapContext) uint32 {
handlePtr := ctx.Arg(0)
_ = ctx.Arg(1) // DesiredAccess
_ = ctx.Arg(2) // ObjectAttributes
maxSizePtr := ctx.Arg(3)
sectionProtect := uint32(ctx.Arg(4))
allocationAttrs := uint32(ctx.Arg(5))
fileHandle := Handle(ctx.Arg(6))
var maxSize uint64
if maxSizePtr != 0 {
maxSize, _ = ctx.Mem.Read64(maxSizePtr)
}
perms := NtMemProtectToMMU(sectionProtect)
if perms == 0 {
perms = mmu.PermRead | mmu.PermWrite
}
sec := &SectionHandle{
Perms: perms,
FileFD: -1,
ViewSizes: make(map[uint64]uint64),
}
if fh := ctx.Handles.GetFile(fileHandle); fh != nil {
if maxSize == 0 {
if node := ctx.FS.Stat(fh.FD); node != nil {
maxSize = uint64(node.Size)
}
}
if dupFD, err := ctx.FS.Dup(fh.FD); err == nil {
sec.FileFD = dupFD
}
sec.Path = fh.Path
}
if maxSize == 0 && allocationAttrs&secCommit != 0 {
maxSize = mmu.PageSize
}
if maxSize == 0 {
maxSize = mmu.PageSize
}
sec.Size = (maxSize + mmu.PageSize - 1) & mmu.PageMask
h := ctx.Handles.Alloc(sec)
writeGuestPtr(ctx.Mem, handlePtr, uint64(h))
return StatusSuccess
}
func handleNtMapViewOfSection(ctx *TrapContext) uint32 {
sectionHandle := Handle(ctx.Arg(0))
_ = ctx.Arg(1) // ProcessHandle
baseAddrPtr := ctx.Arg(2)
_ = ctx.Arg(3) // ZeroBits
_ = ctx.Arg(4) // CommitSize
sectionOffsetPtr := ctx.Arg(5)
viewSizePtr := ctx.Arg(6)
_ = ctx.Arg(7) // InheritDisposition
_ = ctx.Arg(8) // AllocationType
win32Protect := uint32(ctx.Arg(9))
sec := ctx.Handles.GetSection(sectionHandle)
if sec == nil {
return StatusInvalidHandle
}
baseAddr := uint64(0)
if baseAddrPtr != 0 {
baseAddr, _ = ctx.Mem.Read64(baseAddrPtr)
}
sectionOffset := uint64(0)
if sectionOffsetPtr != 0 {
sectionOffset, _ = ctx.Mem.Read64(sectionOffsetPtr)
}
size := sec.Size
if viewSizePtr != 0 {
if requested, _ := ctx.Mem.Read64(viewSizePtr); requested != 0 {
size = requested
}
}
if size == 0 {
size = mmu.PageSize
}
size = (size + mmu.PageSize - 1) & mmu.PageMask
perms := sec.Perms
if win32Protect != 0 {
perms = NtMemProtectToMMU(win32Protect)
}
addr := ctx.Mem.Mmap(baseAddr, size, perms)
if sec.FileFD >= 0 {
buf := make([]byte, size)
if n, err := ctx.FS.Pread(sec.FileFD, buf, int64(sectionOffset)); err == nil && n > 0 {
ctx.Mem.WriteBytes(addr, buf[:n])
}
}
sec.ViewSizes[addr] = size
if baseAddrPtr != 0 {
ctx.Mem.Write64(baseAddrPtr, addr)
}
if viewSizePtr != 0 {
ctx.Mem.Write64(viewSizePtr, size)
}
return StatusSuccess
}
func handleNtUnmapViewOfSection(ctx *TrapContext) uint32 {
_ = ctx.Arg(0) // ProcessHandle
baseAddr := ctx.Arg(1)
if baseAddr != 0 {
_, size, mapped, _ := ctx.Mem.QueryRegion(baseAddr)
if mapped && size > 0 {
ctx.Mem.Munmap(baseAddr, size)
}
}
return StatusSuccess
}
// ======================== REGISTRY ========================
func handleNtOpenKey(ctx *TrapContext) uint32 {
handlePtr := ctx.Arg(0)
_ = ctx.Arg(1) // desiredAccess
objAttr := ctx.Arg(2)
_, name, _, err := ReadObjectAttributes(ctx, objAttr)
if err != nil {
return StatusObjectNameInvalid
}
key := ctx.Reg.OpenKey(name)
if key == nil {
if ctx.Trace {
fmt.Printf(" NtOpenKey: NOT FOUND: %q\n", name)
}
return StatusKeyNotFound
}
h := ctx.Handles.Alloc(&RegistryKeyHandle{Key: key, Path: name})
ctx.Mem.Write64(handlePtr, uint64(h))
if ctx.Trace {
fmt.Printf(" NtOpenKey: opened %q → handle=0x%x\n", name, h)
}
return StatusSuccess
}
func handleNtOpenKeyEx(ctx *TrapContext) uint32 {
return handleNtOpenKey(ctx)
}
func handleNtCreateKey(ctx *TrapContext) uint32 {
handlePtr := ctx.Arg(0)
_ = ctx.Arg(1) // desiredAccess
objAttr := ctx.Arg(2)
_, name, _, err := ReadObjectAttributes(ctx, objAttr)
if err != nil {
return StatusObjectNameInvalid
}
key := ctx.Reg.CreateKey(name)
h := ctx.Handles.Alloc(&RegistryKeyHandle{Key: key, Path: name})
ctx.Mem.Write64(handlePtr, uint64(h))
return StatusSuccess
}
func handleNtQueryValueKey(ctx *TrapContext) uint32 {
keyHandle := Handle(ctx.Arg(0))
valueNameAddr := ctx.Arg(1) // PUNICODE_STRING
_ = ctx.Arg(2) // KeyValueInformationClass
buffer := ctx.Arg(3) // stack arg 0
rk := ctx.Handles.GetRegKey(keyHandle)
if rk == nil {
return StatusInvalidHandle
}
valueName, err := ReadUnicodeString(ctx.Mem, valueNameAddr)
if err != nil {
return StatusObjectNameInvalid
}
val, ok := rk.Key.Values[valueName]
if !ok {
// Case-insensitive search
for k, v := range rk.Key.Values {
if strings.EqualFold(k, valueName) {
val = v
ok = true
break
}
}
}
if !ok {
return StatusObjectNameNotFound
}
if buffer != 0 {
// KEY_VALUE_PARTIAL_INFORMATION: TitleIndex(4) + Type(4) + DataLength(4) + Data
ctx.Mem.Write32(buffer+0, 0) // TitleIndex
ctx.Mem.Write32(buffer+4, val.Type) // Type
ctx.Mem.Write32(buffer+8, uint32(len(val.Data))) // DataLength
ctx.Mem.WriteBytes(buffer+12, val.Data) // Data
}
return StatusSuccess
}
func handleNtSetValueKey(ctx *TrapContext) uint32 {
keyHandle := Handle(ctx.Arg(0))
valueNameAddr := ctx.Arg(1)
_ = ctx.Arg(2) // TitleIndex
valType := uint32(ctx.Arg(3))
dataAddr := ctx.Arg(4)
dataSize := uint32(ctx.Arg(5))
rk := ctx.Handles.GetRegKey(keyHandle)
if rk == nil {
return StatusInvalidHandle
}
valueName, err := ReadUnicodeString(ctx.Mem, valueNameAddr)
if err != nil {
return StatusObjectNameInvalid
}
// Stack args: DataPtr and DataSize
var data []byte
if dataAddr != 0 && dataSize > 0 {
if raw, err := ctx.Mem.ReadBytes(dataAddr, int(dataSize)); err == nil {
data = append([]byte(nil), raw...)
}
}
rk.Key.Values[valueName] = &RegistryValue{
Name: valueName,
Type: valType,
Data: data,
}
return StatusSuccess
}
func handleNtDeleteKey(ctx *TrapContext) uint32 {
return StatusSuccess
}
func handleNtDeleteValueKey(ctx *TrapContext) uint32 {
keyHandle := Handle(ctx.Arg(0))
valueNameAddr := ctx.Arg(1)
rk := ctx.Handles.GetRegKey(keyHandle)
if rk == nil {
return StatusInvalidHandle
}
valueName, err := ReadUnicodeString(ctx.Mem, valueNameAddr)
if err != nil {
return StatusObjectNameInvalid
}
delete(rk.Key.Values, valueName)
for k := range rk.Key.Values {
if strings.EqualFold(k, valueName) {
delete(rk.Key.Values, k)
break
}
}
return StatusSuccess
}
func handleNtEnumerateKey(ctx *TrapContext) uint32 {
keyHandle := Handle(ctx.Arg(0))
index := uint32(ctx.Arg(1))
_ = ctx.Arg(2) // KeyInformationClass
buffer := ctx.Arg(3)
rk := ctx.Handles.GetRegKey(keyHandle)
if rk == nil {
return StatusInvalidHandle
}
names := ctx.Reg.EnumerateKeys(rk.Key)
if int(index) >= len(names) {
return StatusNoMoreEntries
}
name := names[index]
child := rk.Key.Children[strings.ToUpper(name)]
if child != nil {
name = child.Name // use original case
}
// KEY_BASIC_INFORMATION
if buffer != 0 {
nameUTF16 := encodeUTF16LE(name)
ctx.Mem.Write64(buffer+0, 0) // LastWriteTime
ctx.Mem.Write32(buffer+8, 0) // TitleIndex
ctx.Mem.Write32(buffer+12, uint32(len(nameUTF16))) // NameLength
ctx.Mem.WriteBytes(buffer+16, nameUTF16) // Name
}
return StatusSuccess
}
func handleNtEnumerateValueKey(ctx *TrapContext) uint32 {
keyHandle := Handle(ctx.Arg(0))
index := uint32(ctx.Arg(1))
_ = ctx.Arg(2) // KeyValueInformationClass
buffer := ctx.Arg(3)
rk := ctx.Handles.GetRegKey(keyHandle)
if rk == nil {
return StatusInvalidHandle
}
names := ctx.Reg.EnumerateValues(rk.Key)
if int(index) >= len(names) {
return StatusNoMoreEntries
}
val := rk.Key.Values[names[index]]
if val == nil {
return StatusNoMoreEntries
}
// KEY_VALUE_BASIC_INFORMATION
if buffer != 0 {
nameUTF16 := encodeUTF16LE(val.Name)
ctx.Mem.Write32(buffer+0, 0) // TitleIndex
ctx.Mem.Write32(buffer+4, val.Type) // Type
ctx.Mem.Write32(buffer+8, uint32(len(nameUTF16))) // NameLength
ctx.Mem.WriteBytes(buffer+12, nameUTF16)
}
return StatusSuccess
}
func handleNtQueryKey(ctx *TrapContext) uint32 {
keyHandle := Handle(ctx.Arg(0))
infoClass := uint32(ctx.Arg(1))
buffer := ctx.Arg(2)
length := uint32(ctx.Arg(3))
retLen := ctx.Arg(4)
rk := ctx.Handles.GetRegKey(keyHandle)
if rk == nil {
return StatusInvalidHandle
}
keyName := rk.Path
if keyName == "" && rk.Key != nil {
keyName = rk.Key.Name
}
nameUTF16 := encodeUTF16LE(keyName)
switch infoClass {
case 0: // KeyBasicInformation
needed := uint32(16 + len(nameUTF16))
if retLen != 0 {
ctx.Mem.Write32(retLen, needed)
}
if length < needed {
return StatusBufferTooSmall
}
if buffer != 0 {
ctx.Mem.Write64(buffer+0, 0)
ctx.Mem.Write32(buffer+8, 0)
ctx.Mem.Write32(buffer+12, uint32(len(nameUTF16)))
ctx.Mem.WriteBytes(buffer+16, nameUTF16)
}
return StatusSuccess
case 1: // KeyNodeInformation
valueCount := uint32(len(rk.Key.Values))
subKeyCount := uint32(len(rk.Key.Children))
needed := uint32(28 + len(nameUTF16))
if retLen != 0 {
ctx.Mem.Write32(retLen, needed)
}
if length < needed {
return StatusBufferTooSmall
}
if buffer != 0 {
ctx.Mem.Write64(buffer+0, 0)
ctx.Mem.Write32(buffer+8, 0)
ctx.Mem.Write32(buffer+12, uint32(len(nameUTF16)))
ctx.Mem.Write32(buffer+16, subKeyCount)
ctx.Mem.Write32(buffer+20, valueCount)
ctx.Mem.Write32(buffer+24, 0)
ctx.Mem.WriteBytes(buffer+28, nameUTF16)
}
return StatusSuccess
default:
return StatusNotImplemented
}
}
// ======================== PROCESS / THREAD ========================
func handleNtQueryInformationProcess(ctx *TrapContext) uint32 {
// NtQueryInformationProcess(ProcessHandle, ProcessInformationClass, ProcessInformation, ProcessInformationLength, ReturnLength)
infoClass := uint32(ctx.Arg(1))
buffer := ctx.Arg(2)
bufLen := uint32(ctx.Arg(3))
retLen := ctx.Arg(4)
writeRetLen := func(n uint32) {
if retLen != 0 {
ctx.Mem.Write32(retLen, n)
}
}
switch infoClass {
case 0: // ProcessBasicInformation - PROCESS_BASIC_INFORMATION (48 bytes on x64)
const needed = 48
writeRetLen(needed)
if bufLen < needed {
return StatusBufferTooSmall
}
if buffer != 0 {
ctx.Mem.Write64(buffer+0, 0) // ExitStatus (NTSTATUS)
ctx.Mem.Write32(buffer+4, 0) // padding
ctx.Mem.Write64(buffer+8, ctx.State.PEBAddr) // PebBaseAddress
ctx.Mem.Write64(buffer+16, 0xF) // AffinityMask
ctx.Mem.Write32(buffer+24, 8) // BasePriority (NORMAL)
ctx.Mem.Write32(buffer+28, 0) // padding
ctx.Mem.Write64(buffer+32, 4) // UniqueProcessId
ctx.Mem.Write64(buffer+40, 0) // InheritedFromUniqueProcessId
}
case 1: // ProcessQuotaLimits - QUOTA_LIMITS (48 bytes)
const needed = 48
writeRetLen(needed)
if bufLen < needed {
return StatusBufferTooSmall
}
if buffer != 0 {
for i := uint64(0); i < needed; i++ {
ctx.Mem.Write8(buffer+i, 0)
}
ctx.Mem.Write64(buffer+0, 0x80000) // MinimumWorkingSetSize
ctx.Mem.Write64(buffer+8, 0x100000) // MaximumWorkingSetSize
ctx.Mem.Write64(buffer+16, ^uint64(0)) // PagedPoolLimit = unlimited
ctx.Mem.Write64(buffer+24, ^uint64(0)) // NonPagedPoolLimit
ctx.Mem.Write64(buffer+32, ^uint64(0)) // MinimumWorkingSetSize
ctx.Mem.Write64(buffer+40, ^uint64(0)) // PagefileLimit
}
case 2: // ProcessIoCounters - IO_COUNTERS (48 bytes)
const needed = 48
writeRetLen(needed)
if bufLen < needed {
return StatusBufferTooSmall
}
if buffer != 0 {
for i := uint64(0); i < needed; i++ {
ctx.Mem.Write8(buffer+i, 0)
}
}
case 3: // ProcessVmCounters - VM_COUNTERS_EX (80 bytes)
const needed = 80
writeRetLen(needed)
if bufLen < needed {
return StatusBufferTooSmall
}
if buffer != 0 {
for i := uint64(0); i < needed; i++ {
ctx.Mem.Write8(buffer+i, 0)
}
ctx.Mem.Write64(buffer+0, 0x10000) // PeakVirtualSize
ctx.Mem.Write64(buffer+8, 0x10000) // VirtualSize
ctx.Mem.Write64(buffer+24, 0x1000) // PeakWorkingSetSize
ctx.Mem.Write64(buffer+32, 0x1000) // WorkingSetSize
}
case 4: // ProcessTimes - KERNEL_USER_TIMES (32 bytes)
const needed = 32
writeRetLen(needed)
if bufLen < needed {
return StatusBufferTooSmall
}
if buffer != 0 {
now := uint64(time.Now().UnixNano()/100 + 116444736000000000) // FILETIME
ctx.Mem.Write64(buffer+0, now) // CreateTime
ctx.Mem.Write64(buffer+8, 0) // ExitTime
ctx.Mem.Write64(buffer+16, 0) // KernelTime (100ns units)
ctx.Mem.Write64(buffer+24, 0) // UserTime
}
case 5: // ProcessBasePriority
writeRetLen(4)
if buffer != 0 {
ctx.Mem.Write32(buffer, 8) // NORMAL_PRIORITY_CLASS
}
case 7: // ProcessDebugPort - NULL = no debugger
writeRetLen(8)
if buffer != 0 {
ctx.Mem.Write64(buffer, 0)
}
case 9: // ProcessWow64Information - NULL = 64-bit process
writeRetLen(8)
if buffer != 0 {
ctx.Mem.Write64(buffer, 0) // not WOW64
}
case 11: // ProcessHandleCount
writeRetLen(4)
if buffer != 0 {
ctx.Mem.Write32(buffer, uint32(ctx.Handles.Count()))
}
case 12: // ProcessAffinityMask
writeRetLen(8)
if buffer != 0 {
ctx.Mem.Write64(buffer, 0xF) // 4 CPUs
}
case 17: // ProcessSessionInformation - PROCESS_SESSION_INFORMATION (4 bytes)
writeRetLen(4)
if buffer != 0 {
ctx.Mem.Write32(buffer, 0) // Session 0
}
case 18: // ProcessWx86Information (return 0 = no x86 emulation)
writeRetLen(4)
if buffer != 0 {
ctx.Mem.Write32(buffer, 0)
}
case 20: // ProcessDeviceMap
writeRetLen(8)
if buffer != 0 {
ctx.Mem.Write64(buffer, 0)
}
case 22: // ProcessPriorityClass - PROCESS_PRIORITY_CLASS (2 bytes)
writeRetLen(2)
if buffer != 0 {
ctx.Mem.Write8(buffer+0, 0) // Foreground = false
ctx.Mem.Write8(buffer+1, 2) // PriorityClass = NORMAL
}
case 27: // ProcessImageFileName - UNICODE_STRING + data
imgName := ctx.State.ImagePath
if imgName == "" {
imgName = "program.exe"
}
imgPath := `\Device\HarddiskVolume1\` + imgName
utf16 := encodeUTF16LE(imgPath)
needed := uint32(16 + len(utf16) + 2)
writeRetLen(needed)
if bufLen < needed {
return StatusBufferTooSmall
}
if buffer != 0 {
ctx.Mem.Write16(buffer+0, uint16(len(utf16))) // Length
ctx.Mem.Write16(buffer+2, uint16(len(utf16)+2)) // MaximumLength
ctx.Mem.Write64(buffer+8, buffer+16) // Buffer pointer
ctx.Mem.WriteBytes(buffer+16, utf16)
ctx.Mem.Write16(buffer+16+uint64(len(utf16)), 0) // null terminator
}
case 29: // ProcessBreakOnTermination
writeRetLen(4)
if buffer != 0 {
ctx.Mem.Write32(buffer, 0) // not a critical process
}
case 30: // ProcessDebugObjectHandle - STATUS_PORT_NOT_SET when no debugger
writeRetLen(8)
if buffer != 0 {
ctx.Mem.Write64(buffer, 0)
}
return 0xC0000353 // STATUS_PORT_NOT_SET
case 31: // ProcessDebugFlags
writeRetLen(4)
if buffer != 0 {
ctx.Mem.Write32(buffer, 1) // PROCESS_NO_DEBUG_INHERIT
}
case 33: // ProcessDefaultHardErrorMode
writeRetLen(4)
if buffer != 0 {
ctx.Mem.Write32(buffer, 0)
}
case 34: // ProcessHandleTracing
return StatusNotImplemented
case 36: // ProcessImageFileName (Win32) - same as 27
imgName := ctx.State.ImagePath
if imgName == "" {
imgName = "program.exe"
}
imgPath := `\Device\HarddiskVolume1\` + imgName
utf16 := encodeUTF16LE(imgPath)
needed := uint32(16 + len(utf16) + 2)
writeRetLen(needed)
if bufLen < needed {
return StatusBufferTooSmall
}
if buffer != 0 {
ctx.Mem.Write16(buffer+0, uint16(len(utf16)))
ctx.Mem.Write16(buffer+2, uint16(len(utf16)+2))
ctx.Mem.Write64(buffer+8, buffer+16)
ctx.Mem.WriteBytes(buffer+16, utf16)
ctx.Mem.Write16(buffer+16+uint64(len(utf16)), 0)
}
case 40: // ProcessCookie - random cookie for stack canary
writeRetLen(4)
if buffer != 0 {
ctx.Mem.Write32(buffer, 0x12345678)
}
case 43: // ProcessImageInformation - SECTION_IMAGE_INFORMATION (48 bytes)
const needed = 48
writeRetLen(needed)
if bufLen < needed {
return StatusBufferTooSmall
}
if buffer != 0 {
imageBase, _ := ctx.Mem.Read64(ctx.State.PEBAddr + 0x10) // PEB.ImageBaseAddress
ctx.Mem.Write64(buffer+0, imageBase) // TransferAddress
ctx.Mem.Write32(buffer+8, 0) // ZeroBits
ctx.Mem.Write64(buffer+16, 0x100000) // MaximumStackSize
ctx.Mem.Write64(buffer+24, 0x1000) // CommittedStackSize
ctx.Mem.Write32(buffer+32, 0) // SubSystemType (native=0)
ctx.Mem.Write16(buffer+36, 6) // MinorSubsystemVersion
ctx.Mem.Write16(buffer+38, 1) // MajorSubsystemVersion
ctx.Mem.Write32(buffer+40, 0) // GpValue
ctx.Mem.Write16(buffer+44, 0x100) // ImageCharacteristics
ctx.Mem.Write16(buffer+46, 0x8664) // DllCharacteristics (AMD64)
}
case 60: // ProcessCommandLineInformation - UNICODE_STRING + command line
cmdLine := ""
if ctx.State != nil {
paramsAddr, _ := ctx.Mem.Read64(ctx.State.PEBAddr + PebProcessParameters)
if paramsAddr != 0 {
cmdLine = readGuestUnicodeString(ctx.Mem, paramsAddr+ProcessParamsCommandLine)
}
}
if cmdLine == "" && ctx.State != nil {
cmdLine = ctx.State.ImagePath
}
if cmdLine == "" {
cmdLine = "program.exe"
}
utf16 := encodeUTF16LE(cmdLine)
needed := uint32(16 + len(utf16) + 2)
writeRetLen(needed)
if bufLen < needed {
return StatusBufferTooSmall
}
if buffer != 0 {
ctx.Mem.Write16(buffer+0, uint16(len(utf16)))
ctx.Mem.Write16(buffer+2, uint16(len(utf16)+2))
ctx.Mem.Write64(buffer+8, buffer+16)
ctx.Mem.WriteBytes(buffer+16, utf16)
ctx.Mem.Write16(buffer+16+uint64(len(utf16)), 0)
}
case 61: // ProcessProtectionInformation
writeRetLen(4)
if buffer != 0 {
ctx.Mem.Write32(buffer, 0) // no protection level
}
case 64: // ProcessMitigationPolicy
writeRetLen(0)
case 77: // ProcessConsoleHostProcess
writeRetLen(8)
if buffer != 0 {
ctx.Mem.Write64(buffer, 0) // no console host process
}
default:
return StatusNotImplemented
}
return StatusSuccess
}
func handleNtQueryInformationThread(ctx *TrapContext) uint32 {
// NtQueryInformationThread(ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength, ReturnLength)
threadHandle := ctx.Handles.GetThread(Handle(ctx.Arg(0)))
infoClass := uint32(ctx.Arg(1))
buffer := ctx.Arg(2)
bufLen := uint32(ctx.Arg(3))
retLen := ctx.Arg(4)
writeRetLen := func(n uint32) {
if retLen != 0 {
ctx.Mem.Write32(retLen, n)
}
}
switch infoClass {
case 0: // ThreadBasicInformation - THREAD_BASIC_INFORMATION (48 bytes)
const needed = 48
writeRetLen(needed)
if bufLen < needed {
return StatusBufferTooSmall
}
tid := uint64(1)
priority := uint32(8)
if threadHandle != nil {
tid = uint64(threadHandle.TID)
priority = uint32(threadHandle.Priority)
} else if ctx.State != nil && ctx.State.ThreadId != 0 {
tid = uint64(ctx.State.ThreadId)
}
if buffer != 0 {
ctx.Mem.Write64(buffer+0, 0) // ExitStatus
if ctx.State != nil {
ctx.Mem.Write64(buffer+8, uint64(ctx.State.TEBAddr)) // TebBaseAddress
ctx.Mem.Write64(buffer+16, uint64(ctx.State.ProcessId))
}
ctx.Mem.Write64(buffer+24, tid) // ClientId.UniqueThread
ctx.Mem.Write64(buffer+32, 0xF) // AffinityMask
ctx.Mem.Write32(buffer+40, priority) // Priority
ctx.Mem.Write32(buffer+44, priority) // BasePriority
}
case 1: // ThreadTimes - KERNEL_USER_TIMES (32 bytes)
const needed = 32
writeRetLen(needed)
if bufLen < needed {
return StatusBufferTooSmall
}
if buffer != 0 {
now := uint64(time.Now().UnixNano()/100 + 116444736000000000)
ctx.Mem.Write64(buffer+0, now) // CreateTime
ctx.Mem.Write64(buffer+8, 0) // ExitTime
ctx.Mem.Write64(buffer+16, 0) // KernelTime
ctx.Mem.Write64(buffer+24, 0) // UserTime
}
case 2: // ThreadPriority
writeRetLen(4)
if buffer != 0 {
priority := uint32(8)
if threadHandle != nil {
priority = uint32(threadHandle.Priority)
}
ctx.Mem.Write32(buffer, priority)
}
case 3: // ThreadBasePriority
writeRetLen(4)
if buffer != 0 {
basePriority := uint32(8)
if threadHandle != nil {
basePriority = uint32(threadHandle.Priority)
}
ctx.Mem.Write32(buffer, basePriority)
}
case 4: // ThreadAffinityMask
writeRetLen(8)
if buffer != 0 {
ctx.Mem.Write64(buffer, 0xF)
}
case 9: // ThreadQuerySetWin32StartAddress
writeRetLen(8)
if buffer != 0 {
ctx.Mem.Write64(buffer, 0) // not tracked
}
case 14: // ThreadHideFromDebugger (query: returns BOOLEAN)
writeRetLen(1)
if buffer != 0 {
hidden := uint8(0)
if threadHandle != nil && threadHandle.HideFromDebugger {
hidden = 1
}
ctx.Mem.Write8(buffer, hidden)
}
case 16: // ThreadTebInformation
writeRetLen(8)
if buffer != 0 {
teb := uint64(0)
if ctx.State != nil {
teb = uint64(ctx.State.TEBAddr)
}
ctx.Mem.Write64(buffer, teb)
}
case 19: // ThreadIoPriority
writeRetLen(4)
if buffer != 0 {
ctx.Mem.Write32(buffer, 2) // NORMAL
}
case 27: // ThreadActualBasePriority
writeRetLen(4)
if buffer != 0 {
priority := uint32(8)
if threadHandle != nil {
priority = uint32(threadHandle.Priority)
}
ctx.Mem.Write32(buffer, priority)
}
case 17: // ThreadIsTerminated
writeRetLen(4)
if buffer != 0 {
ctx.Mem.Write32(buffer, 0) // running
}
case 34: // ThreadSuspendCount
writeRetLen(4)
if buffer != 0 {
ctx.Mem.Write32(buffer, 0)
}
default:
return StatusNotImplemented
}
return StatusSuccess
}
func handleNtQuerySystemInformation(ctx *TrapContext) uint32 {
infoClass := uint32(ctx.Arg(0))
buffer := ctx.Arg(1)
length := uint32(ctx.Arg(2))
retLen := ctx.Arg(3)
writeRetLen := func(n uint32) {
if retLen != 0 {
ctx.Mem.Write32(retLen, n)
}
}
switch infoClass {
case 0: // SystemBasicInformation
const needed = 56
writeRetLen(needed)
if buffer == 0 || length < needed {
return StatusBufferTooSmall
}
if buffer != 0 {
ctx.Mem.Write32(buffer+0, 0) // Reserved
ctx.Mem.Write32(buffer+4, 100) // TimerResolution
ctx.Mem.Write32(buffer+8, uint32(mmu.PageSize)) // PageSize
ctx.Mem.Write32(buffer+12, 262144) // NumberOfPhysicalPages
ctx.Mem.Write32(buffer+16, 256) // LowestPhysicalPageNumber
ctx.Mem.Write32(buffer+20, 262144) // HighestPhysicalPageNumber
ctx.Mem.Write32(buffer+24, uint32(mmu.PageSize)) // AllocationGranularity
ctx.Mem.Write64(buffer+28, 0x10000) // MinimumUserModeAddress
ctx.Mem.Write64(buffer+36, 0x7FFFFFFEFFFF) // MaximumUserModeAddress
ctx.Mem.Write64(buffer+44, 0xF) // ActiveProcessorsAffinityMask
ctx.Mem.Write8(buffer+52, uint8(runtime.NumCPU())) // NumberOfProcessors
}
case 1: // SystemProcessorInformation
if buffer != 0 {
ctx.Mem.Write16(buffer+0, 9) // ProcessorArchitecture = AMD64
ctx.Mem.Write16(buffer+2, 0) // ProcessorLevel
ctx.Mem.Write16(buffer+4, 0) // ProcessorRevision
}
case 2: // SystemPerformanceInformation (256 bytes SYSTEM_PERFORMANCE_INFORMATION)
if buffer != 0 {
total := uint64(1 * 1024 * 1024 * 1024) // 1GB total virtual
now := uint64(time.Now().UnixNano() / 100)
ctx.Mem.Write64(buffer+0, now) // IdleProcessTime
ctx.Mem.Write64(buffer+8, 0) // IoReadTransferCount
ctx.Mem.Write64(buffer+16, 0) // IoWriteTransferCount
ctx.Mem.Write64(buffer+24, 0) // IoOtherTransferCount
ctx.Mem.Write32(buffer+32, 0) // IoReadOperationCount
ctx.Mem.Write32(buffer+36, 0) // IoWriteOperationCount
ctx.Mem.Write32(buffer+40, 0) // IoOtherOperationCount
ctx.Mem.Write32(buffer+44, uint32(total/mmu.PageSize)) // AvailablePages
ctx.Mem.Write32(buffer+48, uint32(total/mmu.PageSize)) // CommittedPages
ctx.Mem.Write32(buffer+52, uint32(total*2/mmu.PageSize)) // CommitLimit
ctx.Mem.Write32(buffer+56, 0) // PeakCommitment
ctx.Mem.Write32(buffer+60, 1024*1024) // PageFaultCount
ctx.Mem.Write32(buffer+64, 0) // CopyOnWriteCount
ctx.Mem.Write32(buffer+68, 0) // TransitionCount
ctx.Mem.Write32(buffer+72, 0) // CacheTransitionCount
ctx.Mem.Write32(buffer+76, 0) // DemandZeroCount
ctx.Mem.Write32(buffer+80, 0) // PageReadCount
ctx.Mem.Write32(buffer+84, 0) // PageReadIoCount
ctx.Mem.Write32(buffer+88, 0) // CacheReadCount
ctx.Mem.Write32(buffer+92, 0) // CacheIoCount
ctx.Mem.Write32(buffer+96, 0) // DirtyPagesWriteCount
ctx.Mem.Write32(buffer+100, 0) // DirtyWriteIoCount
ctx.Mem.Write32(buffer+104, 0) // MappedPagesWriteCount
ctx.Mem.Write32(buffer+108, 0) // MappedWriteIoCount
ctx.Mem.Write32(buffer+112, uint32(total/mmu.PageSize)) // PagedPoolPages
ctx.Mem.Write32(buffer+116, 1024) // NonPagedPoolPages
ctx.Mem.Write32(buffer+120, 0) // PagedPoolAllocs
ctx.Mem.Write32(buffer+124, 0) // PagedPoolFrees
ctx.Mem.Write32(buffer+128, 0) // NonPagedPoolAllocs
ctx.Mem.Write32(buffer+132, 0) // NonPagedPoolFrees
ctx.Mem.Write32(buffer+136, 4096) // FreeSystemPtes
ctx.Mem.Write32(buffer+140, 1024) // ResidentSystemCodePage
ctx.Mem.Write32(buffer+144, 0) // TotalSystemDriverPages
ctx.Mem.Write32(buffer+148, 0) // TotalSystemCodePages
ctx.Mem.Write32(buffer+152, 0) // NonPagedPoolLookasideHits
ctx.Mem.Write32(buffer+156, 0) // PagedPoolLookasideHits
ctx.Mem.Write32(buffer+160, 0) // Spare3Count
ctx.Mem.Write32(buffer+164, 0) // ResidentSystemCachePage
ctx.Mem.Write32(buffer+168, 0) // ResidentPagedPoolPage
ctx.Mem.Write32(buffer+172, 0) // ResidentSystemDriverPage
ctx.Mem.Write32(buffer+176, 0) // CcFastReadNoWait
ctx.Mem.Write32(buffer+180, 0) // CcFastReadWait
ctx.Mem.Write32(buffer+184, 0) // CcFastReadResourceMiss
ctx.Mem.Write32(buffer+188, 0) // CcFastReadNotPossible
ctx.Mem.Write32(buffer+192, 0) // CcFastMdlReadNoWait
ctx.Mem.Write32(buffer+196, 0) // CcFastMdlReadWait
ctx.Mem.Write32(buffer+200, 0) // CcFastMdlReadResourceMiss
ctx.Mem.Write32(buffer+204, 0) // CcFastMdlReadNotPossible
ctx.Mem.Write32(buffer+208, 0) // CcMapDataNoWait
ctx.Mem.Write32(buffer+212, 0) // CcMapDataWait
ctx.Mem.Write32(buffer+216, 0) // CcMapDataNoWaitMiss
ctx.Mem.Write32(buffer+220, 0) // CcMapDataWaitMiss
ctx.Mem.Write32(buffer+224, 0) // CcPinMappedDataCount
ctx.Mem.Write32(buffer+228, 0) // CcPinReadNoWait
ctx.Mem.Write32(buffer+232, 0) // CcPinReadWait
ctx.Mem.Write32(buffer+236, 0) // CcPinReadNoWaitMiss
ctx.Mem.Write32(buffer+240, 0) // CcPinReadWaitMiss
ctx.Mem.Write32(buffer+244, 0) // CcCopyReadNoWait
ctx.Mem.Write32(buffer+248, 0) // CcCopyReadWait
ctx.Mem.Write32(buffer+252, 0) // CcCopyReadNoWaitMiss
}
case 3: // SystemTimeOfDayInformation (48 bytes)
const needed = 48
writeRetLen(needed)
if buffer == 0 || length < needed {
return StatusBufferTooSmall
}
if buffer != 0 {
now := uint64(time.Now().UnixNano()/100 + 116444736000000000)
ctx.Mem.Write64(buffer+0, 0)
ctx.Mem.Write64(buffer+8, now)
ctx.Mem.Write64(buffer+16, 0)
ctx.Mem.Write32(buffer+24, 0)
ctx.Mem.Write32(buffer+28, 0)
ctx.Mem.Write64(buffer+32, 0)
ctx.Mem.Write64(buffer+40, 0)
}
case 5: // SystemProcessInformation - minimal single-process entry
imageName := "Raven"
if ctx.State != nil && ctx.State.ImagePath != "" {
imageName = ctx.State.ImagePath
if slash := strings.LastIndexAny(imageName, `\/`); slash >= 0 {
imageName = imageName[slash+1:]
}
}
nameBytes := encodeUTF16LE(imageName)
needed := uint32(0x100 + len(nameBytes) + 2)
writeRetLen(needed)
if buffer == 0 || length < needed {
return StatusBufferTooSmall
}
ctx.Mem.Write32(buffer+0, 0)
ctx.Mem.Write32(buffer+4, 1)
ctx.Mem.Write64(buffer+8, 0)
ctx.Mem.Write32(buffer+16, 0)
ctx.Mem.Write32(buffer+20, 1)
ctx.Mem.Write64(buffer+24, 0)
ctx.Mem.Write64(buffer+32, 0)
ctx.Mem.Write64(buffer+40, 0)
ctx.Mem.Write64(buffer+48, 0)
ctx.Mem.Write16(buffer+56, uint16(len(nameBytes)))
ctx.Mem.Write16(buffer+58, uint16(len(nameBytes)+2))
ctx.Mem.Write32(buffer+60, 0)
ctx.Mem.Write64(buffer+64, buffer+0x100)
ctx.Mem.Write32(buffer+72, 8)
pid := uint64(4)
if ctx.State != nil && ctx.State.ProcessId != 0 {
pid = uint64(ctx.State.ProcessId)
}
ctx.Mem.Write64(buffer+80, pid)
ctx.Mem.Write64(buffer+88, 0)
ctx.Mem.Write32(buffer+96, uint32(ctx.Handles.Count()))
ctx.Mem.Write32(buffer+100, 0)
ctx.Mem.WriteBytes(buffer+0x100, nameBytes)
ctx.Mem.Write16(buffer+0x100+uint64(len(nameBytes)), 0)
case 7: // SystemProcessorSpeedInformation / SystemNumaProcessorMap
if buffer != 0 {
ctx.Mem.Write32(buffer, 0) // HighestNodeNumber = 0
ctx.Mem.Write32(buffer+4, 0)
}
case 16: // SystemHandleInformation
if buffer != 0 {
ctx.Mem.Write32(buffer, 0) // NumberOfHandles
ctx.Mem.Write32(buffer+4, 0) // Reserved
}
case 18: // SystemPagefileInformation
if buffer != 0 {
ctx.Mem.Write32(buffer, 0) // NextEntryOffset
ctx.Mem.Write32(buffer+4, 512*1024) // TotalSize (in pages)
ctx.Mem.Write32(buffer+8, 0) // TotalInUse
ctx.Mem.Write32(buffer+12, 0) // PeakUsage
// PageFileName is empty UNICODE_STRING at +16
}
case 21: // SystemFileCacheInformation
if buffer != 0 {
total := uint64(256 * 1024 * 1024) // 256MB cache
ctx.Mem.Write64(buffer, total/mmu.PageSize) // CurrentSize
ctx.Mem.Write64(buffer+8, total/mmu.PageSize) // PeakSize
ctx.Mem.Write32(buffer+16, 0) // PageFaultCount
ctx.Mem.Write64(buffer+24, total/mmu.PageSize) // MinimumWorkingSet
ctx.Mem.Write64(buffer+32, total/mmu.PageSize) // MaximumWorkingSet
ctx.Mem.Write64(buffer+40, total/mmu.PageSize) // CurrentSizeIncludingTransitionInPages
ctx.Mem.Write64(buffer+48, total/mmu.PageSize) // PeakSizeIncludingTransitionInPages
ctx.Mem.Write64(buffer+56, 0) // TransitionRePurposeCount
ctx.Mem.Write32(buffer+64, 0) // Flags
}
case 35: // SystemKernelDebuggerInformation
if buffer != 0 {
ctx.Mem.Write8(buffer, 0) // KernelDebuggerEnabled = FALSE
ctx.Mem.Write8(buffer+1, 1) // KernelDebuggerNotPresent = TRUE
}
case 37: // SystemRegistryQuotaInformation
if buffer != 0 {
ctx.Mem.Write32(buffer, 128*1024*1024) // RegistryQuotaAllowed (128MB)
ctx.Mem.Write32(buffer+4, 0) // RegistryQuotaUsed
ctx.Mem.Write64(buffer+8, 0) // PagedPoolSize
}
case 45: // SystemLookasideInformation
// success with empty data
case 8: // SystemProcessorPerformanceInformation (alias for case 2)
if buffer != 0 {
nCPU := runtime.NumCPU()
now := uint64(time.Now().UnixNano() / 100)
for i := 0; i < nCPU; i++ {
base := buffer + uint64(i)*48
ctx.Mem.Write64(base+0, 0)
ctx.Mem.Write64(base+8, now)
ctx.Mem.Write64(base+16, now)
ctx.Mem.Write64(base+24, 0)
ctx.Mem.Write64(base+32, 0)
ctx.Mem.Write32(base+40, 0)
}
}
case 11: // SystemModuleInformation (RTL_PROCESS_MODULES)
if buffer != 0 {
ctx.Mem.Write32(buffer, 0) // NumberOfModules = 0
}
case 23: // SystemInterruptInformation
// success with empty data
case 44: // SystemExtendedHandleInformation
if buffer != 0 {
ctx.Mem.Write64(buffer, 0) // NumberOfHandles
ctx.Mem.Write64(buffer+8, 0) // Reserved
}
case 64: // SystemCodeIntegrityInformation
if buffer != 0 {
ctx.Mem.Write32(buffer, 0)
}
case 173: // SystemCodeIntegrityUnlockModeInformation
// success with empty data
default:
// Many apps only check NTSTATUS, not the data - return success.
if ctx.Trace {
fmt.Printf(" NtQuerySystemInformation: unhandled class %d\n", infoClass)
}
}
return StatusSuccess
}
func handleNtTerminateProcess(ctx *TrapContext) uint32 {
exitCode := ctx.Arg(1)
if ctx.Trace {
fmt.Printf(" NtTerminateProcess: exitCode=%d\n", exitCode)
}
// Signal the CPU to stop
ctx.CPU.Stop()
return StatusSuccess
}
// ======================== VIRTUAL MEMORY ========================
func handleNtAllocateVirtualMemory(ctx *TrapContext) uint32 {
// ProcessHandle, BaseAddress*, ZeroBits, RegionSize*, AllocationType, Protect
basePtr := ctx.Arg(1)
sizePtr := ctx.Arg(3)
allocationType := uint32(ctx.Arg(4))
protect := uint32(ctx.Arg(5))
baseAddr, _ := ctx.Mem.Read64(basePtr)
size, _ := ctx.Mem.Read64(sizePtr)
if size == 0 {
return StatusInvalidParameter
}
if allocationType&(memCommit|memReserve) == 0 {
return StatusInvalidParameter
}
size = (size + mmu.PageSize - 1) & mmu.PageMask
perms := NtMemProtectToMMU(protect)
if perms == 0 {
perms = mmu.PermRead | mmu.PermWrite
}
addr := ctx.Mem.Mmap(baseAddr, size, perms)
if addr < 0x1000 {
ravelog.Logf("[WARN] NtAllocateVirtualMemory failed addr=0x%x size=0x%x baseAddr=0x%x\n", addr, size, baseAddr)
return StatusNoMemory
}
writeGuestPtr(ctx.Mem, basePtr, addr)
writeGuestPtr(ctx.Mem, sizePtr, size)
return StatusSuccess
}
func handleNtFreeVirtualMemory(ctx *TrapContext) uint32 {
basePtr := ctx.Arg(1)
sizePtr := ctx.Arg(2)
freeType := uint32(ctx.Arg(3))
baseAddr, _ := ctx.Mem.Read64(basePtr)
size, _ := ctx.Mem.Read64(sizePtr)
if baseAddr == 0 {
return StatusInvalidParameter
}
if freeType&memRelease != 0 {
_, regionSize, mapped, _ := ctx.Mem.QueryRegion(baseAddr)
if mapped && regionSize > 0 {
size = regionSize
}
} else if freeType&memDecommit != 0 {
if size == 0 {
_, regionSize, mapped, _ := ctx.Mem.QueryRegion(baseAddr)
if mapped && regionSize > 0 {
size = regionSize
}
}
} else {
return StatusInvalidParameter
}
if size == 0 {
return StatusInvalidParameter
}
ctx.Mem.Munmap(baseAddr, size)
writeGuestPtr(ctx.Mem, sizePtr, size)
return StatusSuccess
}
func handleNtProtectVirtualMemory(ctx *TrapContext) uint32 {
basePtr := ctx.Arg(1)
sizePtr := ctx.Arg(2)
newProtect := uint32(ctx.Arg(3))
oldProtectPtr := ctx.Arg(4)
baseAddr, _ := ctx.Mem.Read64(basePtr)
size, _ := ctx.Mem.Read64(sizePtr)
_, _, mapped, oldPerms := ctx.Mem.QueryRegion(baseAddr)
if !mapped {
return StatusInvalidParameter
}
perms := NtMemProtectToMMU(newProtect)
if perms == 0 && newProtect != 0x01 {
return StatusInvalidParameter
}
ctx.Mem.Mprotect(baseAddr, size, perms)
if oldProtectPtr != 0 {
ctx.Mem.Write32(oldProtectPtr, MMUPermsToNtProtect(oldPerms))
}
return StatusSuccess
}
func handleNtQueryVirtualMemory(ctx *TrapContext) uint32 {
addr := ctx.Arg(1)
infoClass := ctx.Arg(2)
buffer := ctx.Arg(3)
bufLen := ctx.Arg(4)
retLen := ctx.Arg(5)
if buffer == 0 {
return StatusSuccess
}
switch infoClass {
case 2: // MemorySectionName (UNICODE_STRING with image path for mapped files)
// Find the loaded module containing this address so apps can ask for the
// mapped file name of code/data pages.
imagePath := ""
if ctx.State != nil {
ldrAddr, _ := ctx.Mem.Read64(ctx.State.PEBAddr + PebLdr)
if ldrAddr != 0 {
listHead := ldrAddr + LdrInLoadOrderModuleList
flink, _ := ctx.Mem.Read64(listHead)
for flink != 0 && flink != listHead {
entry := flink
base, _ := ctx.Mem.Read64(entry + LdrEntryDllBase)
size, _ := ctx.Mem.Read32(entry + LdrEntrySizeOfImage)
if base != 0 && addr >= base && addr < base+uint64(size) {
imagePath = readGuestUnicodeString(ctx.Mem, entry+LdrEntryFullDllName)
break
}
flink, _ = ctx.Mem.Read64(flink)
}
}
if imagePath == "" {
pebBase, _ := ctx.Mem.Read64(ctx.State.PEBAddr + 0x10)
if pebBase != 0 && addr >= pebBase {
imagePath = ctx.State.ImagePath
}
}
}
if imagePath == "" {
imagePath = `\Device\HarddiskVolume1\Windows\System32\unknown.dll`
}
// Convert Win32 path to an NT device path when necessary.
if strings.HasPrefix(imagePath, `C:\`) {
imagePath = `\Device\HarddiskVolume1\` + imagePath[3:]
} else if strings.HasPrefix(imagePath, `/`) {
imagePath = `\Device\HarddiskVolume1` + imagePath
}
// Write UNICODE_STRING followed by the path data
// UNICODE_STRING: Length(2) + MaxLength(2) + pad(4) + Buffer(8) = 16 bytes
wsBytes := encodeUTF16LE(imagePath)
needed := uint64(16 + len(wsBytes) + 2)
if retLen != 0 {
writeGuestPtr(ctx.Mem, retLen, needed)
}
if bufLen < needed {
return StatusBufferTooSmall
}
strData := buffer + 16
ctx.Mem.Write16(buffer, uint16(len(wsBytes))) // Length
ctx.Mem.Write16(buffer+2, uint16(len(wsBytes)+2)) // MaxLength
ctx.Mem.Write32(buffer+4, 0) // padding
ctx.Mem.Write64(buffer+8, strData) // Buffer
ctx.Mem.WriteBytes(strData, wsBytes)
ctx.Mem.Write16(strData+uint64(len(wsBytes)), 0)
return StatusSuccess
}
base, size, mapped, perms := ctx.Mem.QueryRegion(addr)
// Convert MMU perms to Win32 PAGE_xxx constants.
var protect uint32
if !mapped {
protect = 0x01 // PAGE_NOACCESS
} else {
switch {
case perms&(mmu.PermRead|mmu.PermWrite|mmu.PermExecute) == mmu.PermRead|mmu.PermWrite|mmu.PermExecute:
protect = 0x40 // PAGE_EXECUTE_READWRITE
case perms&(mmu.PermRead|mmu.PermExecute) == mmu.PermRead|mmu.PermExecute:
protect = 0x20 // PAGE_EXECUTE_READ
case perms&(mmu.PermRead|mmu.PermWrite) == mmu.PermRead|mmu.PermWrite:
protect = 0x04 // PAGE_READWRITE
default:
protect = 0x02 // PAGE_READONLY
}
}
var state, typ uint32
if mapped {
state = 0x1000 // MEM_COMMIT
typ = 0x20000 // MEM_PRIVATE
} else {
state = 0x10000 // MEM_FREE
typ = 0
protect = 0x01 // PAGE_NOACCESS
}
if ctx.Mem.Mode32 {
if retLen != 0 {
ctx.Mem.Write32(retLen, 28)
}
if bufLen < 28 {
return StatusBufferTooSmall
}
ctx.Mem.Write32(buffer+0, uint32(base))
ctx.Mem.Write32(buffer+4, uint32(base))
ctx.Mem.Write32(buffer+8, protect)
ctx.Mem.Write32(buffer+12, uint32(size))
ctx.Mem.Write32(buffer+16, state)
ctx.Mem.Write32(buffer+20, protect)
ctx.Mem.Write32(buffer+24, typ)
return StatusSuccess
}
if retLen != 0 {
ctx.Mem.Write64(retLen, 48)
}
if bufLen < 48 {
return StatusBufferTooSmall
}
ctx.Mem.Write64(buffer+0, base)
ctx.Mem.Write64(buffer+8, base)
ctx.Mem.Write32(buffer+16, protect)
ctx.Mem.Write32(buffer+20, 0)
ctx.Mem.Write64(buffer+24, size)
ctx.Mem.Write32(buffer+32, state)
ctx.Mem.Write32(buffer+36, protect)
ctx.Mem.Write32(buffer+40, typ)
return StatusSuccess
}
// ======================== SYNCHRONIZATION ========================
func handleNtCreateEvent(ctx *TrapContext) uint32 {
handlePtr := ctx.Arg(0)
_ = ctx.Arg(1) // DesiredAccess
objAttr := ctx.Arg(2)
eventType := ctx.Arg(3)
autoReset := eventType == 1 // SynchronizationEvent
evt := NewEvent(!autoReset, false)
// Read name from OBJECT_ATTRIBUTES if present
var name string
if objAttr != 0 {
_, oaName, _, err := ReadObjectAttributes(ctx, objAttr)
if err == nil {
name = NormalizeObjectName(oaName)
}
}
var h Handle
if name != "" {
var isNew bool
h, isNew = ctx.Handles.AllocNamed(name, evt)
if !isNew {
// STATUS_OBJECT_NAME_COLLISION is not quite right for NT;
// the real kernel returns STATUS_OBJECT_NAME_EXISTS (0x40000000)
ctx.Mem.Write64(handlePtr, uint64(h))
return 0x40000000 // STATUS_OBJECT_NAME_EXISTS (success with info)
}
} else {
h = ctx.Handles.Alloc(evt)
}
ctx.Mem.Write64(handlePtr, uint64(h))
return StatusSuccess
}
func handleNtSetEvent(ctx *TrapContext) uint32 {
handle := Handle(ctx.Arg(0))
evt := ctx.Handles.GetEvent(handle)
if evt == nil {
return StatusInvalidHandle
}
evt.Set()
return StatusSuccess
}
func handleNtResetEvent(ctx *TrapContext) uint32 {
handle := Handle(ctx.Arg(0))
evt := ctx.Handles.GetEvent(handle)
if evt == nil {
return StatusInvalidHandle
}
evt.Reset()
return StatusSuccess
}
func handleNtClearEvent(ctx *TrapContext) uint32 {
return handleNtResetEvent(ctx)
}
func handleNtPulseEvent(ctx *TrapContext) uint32 {
// NtPulseEvent(EventHandle, PreviousState*) - signal then immediately reset
handle := Handle(ctx.Arg(0))
prevPtr := ctx.Arg(1)
evt := ctx.Handles.GetEvent(handle)
if evt == nil {
return StatusInvalidHandle
}
prev := evt.PeekSignaled()
if prevPtr != 0 {
if prev {
ctx.Mem.Write32(prevPtr, 1)
} else {
ctx.Mem.Write32(prevPtr, 0)
}
}
evt.Signal()
// Auto-reset: clear immediately after waking (best effort)
evt.Reset()
return StatusSuccess
}
func handleNtQueryEvent(ctx *TrapContext) uint32 {
// NtQueryEvent(EventHandle, EventInformationClass, EventInfo, Length, ReturnLength)
handle := Handle(ctx.Arg(0))
infoClass := ctx.Arg(1)
buffer := ctx.Arg(2)
bufLen := ctx.Arg(3)
retLen := ctx.Arg(4)
_ = infoClass // EventBasicInformation = 0
const needed = 8
if retLen != 0 {
ctx.Mem.Write32(retLen, needed)
}
if bufLen < needed {
return 0xC0000023
}
evt := ctx.Handles.GetEvent(handle)
signaled := false
eventType := uint32(0) // NotificationEvent
if evt != nil {
signaled = evt.PeekSignaled()
if evt.IsManualReset() {
eventType = 0 // NotificationEvent
} else {
eventType = 1 // SynchronizationEvent
}
}
if buffer != 0 {
ctx.Mem.Write32(buffer, eventType)
if signaled {
ctx.Mem.Write32(buffer+4, 1)
} else {
ctx.Mem.Write32(buffer+4, 0)
}
}
return StatusSuccess
}
func handleNtQueryMutant(ctx *TrapContext) uint32 {
// NtQueryMutant(MutantHandle, MutantInformationClass, MutantInfo, Length, ReturnLength)
buffer := ctx.Arg(2)
bufLen := ctx.Arg(3)
retLen := ctx.Arg(4)
const needed = 12
if retLen != 0 {
ctx.Mem.Write32(retLen, needed)
}
if bufLen < needed {
return 0xC0000023
}
if buffer != 0 {
ctx.Mem.Write32(buffer, 0) // CurrentCount
ctx.Mem.Write32(buffer+4, 0) // OwnedByCaller
ctx.Mem.Write32(buffer+8, 0) // AbandonedState
}
return StatusSuccess
}
func handleNtQuerySemaphore(ctx *TrapContext) uint32 {
// NtQuerySemaphore(SemHandle, SemInfoClass, SemInfo, Length, ReturnLength)
handle := Handle(ctx.Arg(0))
buffer := ctx.Arg(2)
bufLen := ctx.Arg(3)
retLen := ctx.Arg(4)
const needed = 8
if retLen != 0 {
ctx.Mem.Write32(retLen, needed)
}
if bufLen < needed {
return 0xC0000023
}
count, maxCount := int32(0), int32(1)
sem := ctx.Handles.GetSemaphore(handle)
if sem != nil {
count = sem.Count()
maxCount = sem.MaxCount()
}
if buffer != 0 {
ctx.Mem.Write32(buffer, uint32(count))
ctx.Mem.Write32(buffer+4, uint32(maxCount))
}
return StatusSuccess
}
func handleNtQueryTimerResolution(ctx *TrapContext) uint32 {
// NtQueryTimerResolution(MinimumResolution*, MaximumResolution*, ActualResolution*)
minPtr := ctx.Arg(0)
maxPtr := ctx.Arg(1)
curPtr := ctx.Arg(2)
if minPtr != 0 {
ctx.Mem.Write32(minPtr, 156250)
} // 15.625ms in 100ns units
if maxPtr != 0 {
ctx.Mem.Write32(maxPtr, 5000)
} // 0.5ms
if curPtr != 0 {
ctx.Mem.Write32(curPtr, 156250)
} // 15.625ms current
return StatusSuccess
}
// ──────────────────────────────────────────────────────────
// NtCreateKeyedEvent / NtOpenKeyedEvent / NtWaitForKeyedEvent / NtReleaseKeyedEvent
// Reference: reactos/ntoskrnl/ex/keyedevt.c
// Used by ntdll SRW locks, condition variables, critical section fallback
// ──────────────────────────────────────────────────────────
func handleNtCreateKeyedEvent(ctx *TrapContext) uint32 {
outHandle := ctx.Arg(0)
// arg1=DesiredAccess, arg2=ObjectAttributes, arg3=Flags - all ignored for now
name := ""
ke := NewKeyedEvent(name)
h := ctx.Handles.Alloc(ke)
if outHandle != 0 {
ctx.Mem.Write64(outHandle, uint64(h))
}
return StatusSuccess
}
func handleNtOpenKeyedEvent(ctx *TrapContext) uint32 {
outHandle := ctx.Arg(0)
// For now always return the global fallback event handle
h := ctx.Handles.Alloc(GlobalKeyedEvent)
if outHandle != 0 {
ctx.Mem.Write64(outHandle, uint64(h))
}
return StatusSuccess
}
func handleNtWaitForKeyedEvent(ctx *TrapContext) uint32 {
// NtWaitForKeyedEvent(Handle, Key, Alertable, Timeout*)
hVal := Handle(ctx.Arg(0))
key := ctx.Arg(1) // guest address used as key
timeoutP := ctx.Arg(3)
var ke *KeyedEventHandle
if hVal == 0 || hVal == Handle(0xFFFFFFFFFFFFFFFF) {
ke = GlobalKeyedEvent
} else {
ke = ctx.Handles.GetKeyedEvent(hVal)
if ke == nil {
ke = GlobalKeyedEvent
}
}
d := ntWaitDuration(ctx, timeoutP)
status := ke.Wait(key, d)
return status
}
func handleNtReleaseKeyedEvent(ctx *TrapContext) uint32 {
// NtReleaseKeyedEvent(Handle, Key, Alertable, Timeout*)
hVal := Handle(ctx.Arg(0))
key := ctx.Arg(1)
timeoutP := ctx.Arg(3)
var ke *KeyedEventHandle
if hVal == 0 || hVal == Handle(0xFFFFFFFFFFFFFFFF) {
ke = GlobalKeyedEvent
} else {
ke = ctx.Handles.GetKeyedEvent(hVal)
if ke == nil {
ke = GlobalKeyedEvent
}
}
d := ntWaitDuration(ctx, timeoutP)
status := ke.Release(key, d)
return status
}
// ──────────────────────────────────────────────────────────
// NtAllocateUuids - generates UUID components
// Reference: reactos/ntoskrnl/ex/uuid.c
// ──────────────────────────────────────────────────────────
func handleNtAllocateUuids(ctx *TrapContext) uint32 {
// NtAllocateUuids(Time*, Range*, Sequence*, Seed*)
timePtr := ctx.Arg(0)
rangePtr := ctx.Arg(1)
seqPtr := ctx.Arg(2)
seedPtr := ctx.Arg(3)
// Use current time as the time component
now := uint64(time.Now().UnixNano()/100 + 116444736000000000) // FILETIME
if timePtr != 0 {
ctx.Mem.Write64(timePtr, now)
}
if rangePtr != 0 {
ctx.Mem.Write32(rangePtr, 1)
}
var seq [2]byte
unix.Getrandom(seq[:], 0)
if seqPtr != 0 {
ctx.Mem.Write16(seqPtr, uint16(seq[0])|(uint16(seq[1])<<8))
}
var seed [8]byte
unix.Getrandom(seed[:], 0)
if seedPtr != 0 {
for i, b := range seed {
ctx.Mem.Write8(seedPtr+uint64(i), b)
}
}
return StatusSuccess
}
func handleNtWaitForSingleObject(ctx *TrapContext) uint32 {
handle := Handle(ctx.Arg(0))
_ = ctx.Arg(1) // Alertable
timeoutPtr := ctx.Arg(2)
timeout := ntWaitDuration(ctx, timeoutPtr)
return ntWaitOne(ctx, handle, timeout)
}
// ntWaitDuration converts an optional NT timeout pointer to a Go duration.
// Negative NT time = relative (100-ns units). Nil pointer = INFINITE.
func ntWaitDuration(ctx *TrapContext, ptr uint64) time.Duration {
if ptr == 0 {
return -1 // INFINITE
}
t, _ := ctx.Mem.Read64(ptr)
if t == 0 {
return 0 // poll
}
if int64(t) < 0 {
return time.Duration(-int64(t)) * 100 * time.Nanosecond
}
// Absolute FILETIME: compute delta from now
nowFT := uint64(time.Now().UnixNano()/100 + 116444736000000000)
if t <= nowFT {
return 0
}
return time.Duration(t-nowFT) * 100 * time.Nanosecond
}
// ntWaitOne waits on a single handle; returns NTSTATUS.
func ntWaitOne(ctx *TrapContext, h Handle, timeout time.Duration) uint32 {
obj := ctx.Handles.Get(h)
switch v := obj.(type) {
case *EventHandle:
if v.WaitTimeout(timeout) {
return StatusWait0
}
return StatusTimeout
case *MutantHandle:
res := v.WaitTimeout(1, timeout) // TID=1 (simplified)
if res == 0 {
return StatusWait0
}
if res == 0x80 {
return 0x00000080 // STATUS_ABANDONED_WAIT_0
}
return StatusTimeout
case *SemaphoreHandle:
res := v.WaitTimeout(timeout)
if res == 0 {
return StatusWait0
}
return StatusTimeout
case *WaitableTimerHandle:
res := v.WaitTimeout(timeout)
if res == 0 {
return StatusWait0
}
return StatusTimeout
case *ThreadHandle:
if v.Done == nil {
return StatusWait0
}
if timeout < 0 {
<-v.Done
return StatusWait0
}
select {
case <-v.Done:
return StatusWait0
case <-time.After(timeout):
return StatusTimeout
}
case nil:
return StatusInvalidHandle
case *GenericHandle:
switch strings.ToLower(v.Kind) {
case "process", "thread":
return StatusWait0
default:
return StatusWait0
}
default:
// Unknown handle type - treat as signaled
return StatusWait0
}
}
func handleNtWaitForMultipleObjects(ctx *TrapContext) uint32 {
// NtWaitForMultipleObjects(Count, Handles*, WaitType, Alertable, Timeout*)
count := uint32(ctx.Arg(0))
handlesPtr := ctx.Arg(1)
waitAll := ctx.Arg(2) == 0 // 0=WaitAll, 1=WaitAny
_ = ctx.Arg(3) // Alertable
timeoutPtr := ctx.Arg(4)
if count == 0 || handlesPtr == 0 {
return StatusWait0
}
if count > 64 {
count = 64
}
timeout := ntWaitDuration(ctx, timeoutPtr)
if !waitAll {
// WaitAny: try each handle, return first signaled
for i := uint32(0); i < count; i++ {
hVal, _ := ctx.Mem.Read64(handlesPtr + uint64(i)*8)
res := ntWaitOne(ctx, Handle(hVal), timeout)
if res == StatusWait0 || res == 0x80 {
return StatusWait0 + uint32(i)
}
}
return StatusTimeout
}
// WaitAll: wait for each in sequence
for i := uint32(0); i < count; i++ {
hVal, _ := ctx.Mem.Read64(handlesPtr + uint64(i)*8)
res := ntWaitOne(ctx, Handle(hVal), timeout)
if res == StatusTimeout {
return StatusTimeout
}
}
return StatusWait0
}
func handleNtCreateMutant(ctx *TrapContext) uint32 {
handlePtr := ctx.Arg(0)
_ = ctx.Arg(1) // DesiredAccess
objAttr := ctx.Arg(2)
initialOwner := ctx.Arg(3) != 0
m := NewMutant(0)
if initialOwner {
m.WaitTimeout(1, 0) // TID=1 as simplified owner
}
var name string
if objAttr != 0 {
_, oaName, _, err := ReadObjectAttributes(ctx, objAttr)
if err == nil {
name = NormalizeObjectName(oaName)
}
}
var h Handle
if name != "" {
var isNew bool
h, isNew = ctx.Handles.AllocNamed(name, m)
if !isNew {
ctx.Mem.Write64(handlePtr, uint64(h))
return 0x40000000 // STATUS_OBJECT_NAME_EXISTS
}
} else {
h = ctx.Handles.Alloc(m)
}
ctx.Mem.Write64(handlePtr, uint64(h))
return StatusSuccess
}
func handleNtReleaseMutant(ctx *TrapContext) uint32 {
h := Handle(ctx.Arg(0))
pPrevCount := ctx.Arg(1)
if mh := ctx.Handles.GetMutant(h); mh != nil {
prev := mh.Count()
mh.Release(1) // TID=1 simplified
if pPrevCount != 0 {
ctx.Mem.Write32(pPrevCount, uint32(prev))
}
}
return StatusSuccess
}
func handleNtDelayExecution(ctx *TrapContext) uint32 {
_ = ctx.Arg(0) // Alertable
intervalPtr := ctx.Arg(1)
if intervalPtr != 0 {
interval, _ := ctx.Mem.Read64(intervalPtr)
if int64(interval) < 0 {
dur := time.Duration(-int64(interval)) * 100
time.Sleep(dur)
}
}
return StatusSuccess
}
func handleNtYieldExecution(ctx *TrapContext) uint32 {
runtime.Gosched()
return 0x40000024 // STATUS_NO_YIELD_PERFORMED
}
func handleNtQueryPerformanceCounter(ctx *TrapContext) uint32 {
counterPtr := ctx.Arg(0)
freqPtr := ctx.Arg(1)
now := time.Now().UnixNano()
if counterPtr != 0 {
ctx.Mem.Write64(counterPtr, uint64(now/100)) // 100ns intervals
}
if freqPtr != 0 {
ctx.Mem.Write64(freqPtr, 10000000) // 10 MHz
}
return StatusSuccess
}
func handleNtQuerySystemTime(ctx *TrapContext) uint32 {
timePtr := ctx.Arg(0)
if timePtr != 0 {
// Windows FILETIME: 100ns intervals since Jan 1, 1601
// Epoch offset: 11644473600 seconds
now := time.Now()
ft := (now.Unix()+11644473600)*10000000 + int64(now.Nanosecond()/100)
ctx.Mem.Write64(timePtr, uint64(ft))
}
return StatusSuccess
}
// ======================== CRITICAL SECTIONS ========================
func handleRtlInitCritSec(ctx *TrapContext) uint32 {
csAddr := ctx.Arg(0)
if csAddr != 0 {
// Allocate RTL_CRITICAL_SECTION_DEBUG structure (48 bytes)
dbgInfo := ctx.Mem.Mmap(0, 48, mmu.PermRead|mmu.PermWrite)
// DebugInfo: Type=0, CreatorBackTraceIndex=0, CriticalSection pointer at +8
ctx.Mem.Write64(dbgInfo+8, csAddr) // CriticalSection pointer
// ProcessLocksList (+16): point to self (empty list)
ctx.Mem.Write64(dbgInfo+16, dbgInfo+16) // Flink = &self
ctx.Mem.Write64(dbgInfo+24, dbgInfo+16) // Blink = &self
// Initialize CRITICAL_SECTION
ctx.Mem.Write64(csAddr+0, dbgInfo) // DebugInfo pointer
ctx.Mem.Write32(csAddr+8, 0xFFFFFFFF) // LockCount = -1 (unlocked)
ctx.Mem.Write32(csAddr+12, 0) // RecursionCount
ctx.Mem.Write64(csAddr+16, 0) // OwningThread
ctx.Mem.Write64(csAddr+24, 0) // LockSemaphore
ctx.Mem.Write64(csAddr+32, 0) // SpinCount
}
return StatusSuccess
}
func handleRtlEnterCritSec(ctx *TrapContext) uint32 {
// Simplified: just set the lock count to 0 (locked)
csAddr := ctx.Arg(0)
if csAddr != 0 {
ctx.Mem.Write32(csAddr+8, 0) // LockCount = 0
ctx.Mem.Write32(csAddr+12, 1) // RecursionCount = 1
}
return StatusSuccess
}
func handleRtlLeaveCritSec(ctx *TrapContext) uint32 {
csAddr := ctx.Arg(0)
if csAddr != 0 {
ctx.Mem.Write32(csAddr+8, 0xFFFFFFFF) // LockCount = -1
ctx.Mem.Write32(csAddr+12, 0) // RecursionCount = 0
}
return StatusSuccess
}
func handleRtlDeleteCritSec(ctx *TrapContext) uint32 {
return StatusSuccess
}
func handleRtlTryEnterCritSec(ctx *TrapContext) uint32 {
// Always succeed
handleRtlEnterCritSec(ctx)
// Return TRUE (1) for success
ctx.CPU.SetSyscallReturn(1)
return 1 // TRUE
}
// ======================== SRW LOCKS ========================
func handleRtlInitSRWLock(ctx *TrapContext) uint32 {
addr := ctx.Arg(0)
if addr != 0 {
ctx.Mem.Write64(addr, 0)
}
return StatusSuccess
}
func handleRtlAcquireSRWExcl(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlReleaseSRWExcl(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlAcquireSRWShared(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlReleaseSRWShared(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlTryAcquireSRWExcl(ctx *TrapContext) uint32 {
ctx.CPU.SetSyscallReturn(1)
return 1
}
func handleRtlTryAcquireSRWShared(ctx *TrapContext) uint32 {
ctx.CPU.SetSyscallReturn(1)
return 1
}
// ======================== CONDITION VARIABLES ========================
func handleRtlInitCondVar(ctx *TrapContext) uint32 {
addr := ctx.Arg(0)
if addr != 0 {
ctx.Mem.Write64(addr, 0)
}
return StatusSuccess
}
func handleRtlWakeCondVar(ctx *TrapContext) uint32 {
GlobalCondVars.Get(ctx.Arg(0)).Signal()
return StatusSuccess
}
func handleRtlWakeAllCondVar(ctx *TrapContext) uint32 {
GlobalCondVars.Get(ctx.Arg(0)).Broadcast()
return StatusSuccess
}
// ======================== HEAP ========================
func handleRtlCreateHeap(ctx *TrapContext) uint32 {
heap := &HeapHandle{
Allocations: make(map[uint64]uint64),
}
h := ctx.Handles.Alloc(heap)
ctx.CPU.SetSyscallReturn(uint64(h))
ctx.ReturnOverridden = true
return 0
}
func handleRtlDestroyHeap(ctx *TrapContext) uint32 {
return StatusSuccess
}
func handleRtlAllocateHeap(ctx *TrapContext) uint32 {
_ = ctx.Arg(0) // HeapHandle
flags := ctx.Arg(1)
size := ctx.Arg(2)
if size == 0 {
size = 16
}
var addr uint64
if ctx.State != nil && ctx.State.HeapAlloc != nil {
zeroInit := flags&0x08 != 0 // HEAP_ZERO_MEMORY
addr = ctx.State.HeapAlloc(size, zeroInit)
} else {
addr = ctx.Mem.Mmap(0, size, mmu.PermRead|mmu.PermWrite)
}
ctx.CPU.SetSyscallReturn(addr)
ctx.ReturnOverridden = true
return 0
}
func handleRtlFreeHeap(ctx *TrapContext) uint32 {
_ = ctx.Arg(0) // HeapHandle
_ = ctx.Arg(1) // Flags
addr := ctx.Arg(2)
if addr != 0 {
if ctx.State != nil && ctx.State.HeapFree != nil {
ctx.State.HeapFree(addr)
} else {
ctx.Mem.Munmap(addr, mmu.PageSize)
}
}
ctx.CPU.SetSyscallReturn(1) // TRUE
ctx.ReturnOverridden = true
return 0
}
func handleRtlReAllocateHeap(ctx *TrapContext) uint32 {
_ = ctx.Arg(0) // HeapHandle
flags := ctx.Arg(1)
oldAddr := ctx.Arg(2)
newSize := ctx.Arg(3)
if newSize == 0 {
newSize = 16
}
var newAddr uint64
if ctx.State != nil && ctx.State.HeapAlloc != nil {
zeroInit := flags&0x08 != 0 // HEAP_ZERO_MEMORY
newAddr = ctx.State.HeapAlloc(newSize, zeroInit)
} else {
newAddr = ctx.Mem.Mmap(0, newSize, mmu.PermRead|mmu.PermWrite)
}
// Copy old data (best effort)
if oldAddr != 0 && newAddr != 0 {
copyLen := newSize
if ctx.State != nil && ctx.State.HeapSize != nil {
if old := ctx.State.HeapSize(oldAddr); old < copyLen {
copyLen = old
}
}
oldData, err := ctx.Mem.ReadBytes(oldAddr, int(copyLen))
if err == nil {
ctx.Mem.WriteBytes(newAddr, oldData)
}
if ctx.State != nil && ctx.State.HeapFree != nil {
ctx.State.HeapFree(oldAddr)
}
}
ctx.CPU.SetSyscallReturn(newAddr)
ctx.ReturnOverridden = true
return 0
}
func handleRtlSizeHeap(ctx *TrapContext) uint32 {
_ = ctx.Arg(0) // HeapHandle
_ = ctx.Arg(1) // Flags
ptr := ctx.Arg(2)
var sz uint64
if ctx.State != nil && ctx.State.HeapSize != nil && ptr != 0 {
sz = ctx.State.HeapSize(ptr)
} else {
sz = mmu.PageSize
}
ctx.CPU.SetSyscallReturn(sz)
ctx.ReturnOverridden = true
return 0
}
// ======================== STRING / UNICODE ========================
func handleRtlInitUnicodeString(ctx *TrapContext) uint32 {
destAddr := ctx.Arg(0) // PUNICODE_STRING
srcAddr := ctx.Arg(1) // PCWSTR
if destAddr == 0 {
return StatusSuccess
}
if srcAddr == 0 {
ctx.Mem.Write16(destAddr+0, 0) // Length
ctx.Mem.Write16(destAddr+2, 0) // MaximumLength
ctx.Mem.Write64(destAddr+8, 0) // Buffer
return StatusSuccess
}
// Find length of UTF-16 string
length := uint16(0)
for i := uint64(0); i < 65536; i += 2 {
ch, err := ctx.Mem.Read16(srcAddr + i)
if err != nil || ch == 0 {
break
}
length += 2
}
ctx.Mem.Write16(destAddr+0, length) // Length (bytes, not including null)
ctx.Mem.Write16(destAddr+2, length+2) // MaximumLength
ctx.Mem.Write64(destAddr+8, srcAddr) // Buffer
return StatusSuccess
}
// ======================== MISC ========================
func handleRtlGetVersion(ctx *TrapContext) uint32 {
buffer := ctx.Arg(0) // PRTL_OSVERSIONINFOW
if buffer != 0 {
// RTL_OSVERSIONINFOEXW layout (284 bytes):
// +0x00 DWORD dwOSVersionInfoSize
// +0x04 DWORD dwMajorVersion
// +0x08 DWORD dwMinorVersion
// +0x0C DWORD dwBuildNumber
// +0x10 DWORD dwPlatformId
// +0x14 WCHAR szCSDVersion[128] (256 bytes, offsets 20..275)
// +0x114 WORD wServicePackMajor (offset 276)
// +0x116 WORD wServicePackMinor
// +0x118 WORD wSuiteMask
// +0x11A BYTE wProductType
// +0x11B BYTE wReserved
structSize, _ := ctx.Mem.Read32(buffer)
ctx.Mem.Write32(buffer+4, 10) // dwMajorVersion
ctx.Mem.Write32(buffer+8, 0) // dwMinorVersion
ctx.Mem.Write32(buffer+12, 19041) // dwBuildNumber
ctx.Mem.Write32(buffer+16, 2) // dwPlatformId = VER_PLATFORM_WIN32_NT
// szCSDVersion[128]: empty string (null-terminate first WCHAR)
ctx.Mem.Write16(buffer+20, 0)
if structSize >= 284 { // RTL_OSVERSIONINFOEXW
ctx.Mem.Write16(buffer+276, 0) // wServicePackMajor
ctx.Mem.Write16(buffer+278, 0) // wServicePackMinor
ctx.Mem.Write16(buffer+280, 0x300) // wSuiteMask: VER_SUITE_SINGLEUSERTS|VER_SUITE_TERMINAL
ctx.Mem.Write8(buffer+282, 1) // wProductType = VER_NT_WORKSTATION
ctx.Mem.Write8(buffer+283, 0) // wReserved
}
}
return StatusSuccess
}
func handleRtlNtStatusToDosError(ctx *TrapContext) uint32 {
status := uint32(ctx.Arg(0))
var dosError uint32
switch status {
case StatusSuccess:
dosError = 0 // ERROR_SUCCESS
case StatusNoSuchFile, StatusObjectNameNotFound:
dosError = 2 // ERROR_FILE_NOT_FOUND
case StatusObjectPathNotFound:
dosError = 3 // ERROR_PATH_NOT_FOUND
case StatusAccessDenied:
dosError = 5 // ERROR_ACCESS_DENIED
case StatusInvalidHandle:
dosError = 6 // ERROR_INVALID_HANDLE
case StatusNoMemory:
dosError = 8 // ERROR_NOT_ENOUGH_MEMORY
case StatusInvalidParameter:
dosError = 87 // ERROR_INVALID_PARAMETER
case StatusFileLockConflict, StatusLockNotGranted:
dosError = 33 // ERROR_LOCK_VIOLATION
case StatusRangeNotLocked:
dosError = 158 // ERROR_NOT_LOCKED
case StatusPending:
dosError = 997 // ERROR_IO_PENDING
case StatusCancelled:
dosError = 995 // ERROR_OPERATION_ABORTED
default:
// SXS/activation-context errors → ERROR_SXS_KEY_NOT_FOUND (14007)
if status >= 0xC0150000 && status <= 0xC015FFFF {
dosError = 14007
} else {
dosError = 317 // ERROR_MR_MID_NOT_FOUND
}
}
ctx.CPU.SetSyscallReturn(uint64(dosError))
return dosError
}
func handleRtlSetLastWin32Error(ctx *TrapContext) uint32 {
errorCode := uint32(ctx.Arg(0))
if ctx.State != nil && ctx.State.TEBAddr != 0 {
off := uint64(TebLastErrorValue)
if ctx.State.Is32 {
off = Teb32LastErrorValue
}
ctx.Mem.Write32(ctx.State.TEBAddr+off, errorCode)
}
return StatusSuccess
}
func handleRtlGetLastWin32Error(ctx *TrapContext) uint32 {
if ctx.State != nil && ctx.State.TEBAddr != 0 {
off := uint64(TebLastErrorValue)
if ctx.State.Is32 {
off = Teb32LastErrorValue
}
val, err := ctx.Mem.Read32(ctx.State.TEBAddr + off)
if err == nil {
ctx.CPU.SetSyscallReturn(uint64(val))
return val
}
}
return 0
}
func handleNtDuplicateObject(ctx *TrapContext) uint32 {
_ = Handle(ctx.Arg(0)) // SourceProcessHandle
_ = Handle(ctx.Arg(1)) // TargetProcessHandle (not used for same-process)
srcHandle := Handle(ctx.Arg(2))
targetHandlePtr := ctx.Arg(3)
_ = ctx.Arg(4) // DesiredAccess
_ = ctx.Arg(5) // HandleAttributes
options := uint32(ctx.Arg(6))
if !validateGuestWrite(ctx.Mem, targetHandlePtr, guestPtrSize(ctx.Mem)) {
return StatusAccessViolation
}
status := StatusSuccess
closeSource := options&dupCloseSource != 0
newHandle, source, objectRefs, ownerRefs, ok := ctx.Handles.Clone(
srcHandle,
closeSource,
func(obj HandleObject) (HandleObject, bool) {
var cloned HandleObject
cloned, status = cloneHandleObject(ctx, obj)
return cloned, status == StatusSuccess
},
)
if !ok {
if status != StatusSuccess {
return status
}
return StatusInvalidHandle
}
writeGuestPtr(ctx.Mem, targetHandlePtr, uint64(newHandle))
if closeSource {
closeHandleObject(ctx, srcHandle, source, objectRefs, ownerRefs)
}
_ = options & dupSameAccess
return StatusSuccess
}
func handleNtQueryObject(ctx *TrapContext) uint32 {
h := Handle(ctx.Arg(0))
infoClass := ctx.Arg(1)
buffer := ctx.Arg(2)
bufLen := ctx.Arg(3)
retLen := ctx.Arg(4)
obj := ctx.Handles.Get(h)
typeName := "Unknown"
name := ""
if obj != nil {
switch strings.ToLower(obj.HandleType()) {
case "file":
typeName = "File"
if fh := ctx.Handles.GetFile(h); fh != nil {
name = `\\??\\` + VFSToNtPath(fh.Path)
}
case "event":
typeName = "Event"
case "mutant":
typeName = "Mutant"
case "semaphore":
typeName = "Semaphore"
case "thread":
typeName = "Thread"
case "process":
typeName = "Process"
case "section":
typeName = "Section"
default:
typeName = obj.HandleType()
}
if name == "" {
if n, ok := ctx.Handles.NameOf(h); ok && n != "" {
name = `\BaseNamedObjects\` + n
}
}
}
dataOff := uint64(16)
if ctx.Mem.Mode32 {
dataOff = 8
}
switch infoClass {
case 0: // ObjectBasicInformation (40 bytes)
if retLen != 0 {
ctx.Mem.Write32(retLen, 40)
}
if buffer == 0 || bufLen < 40 {
return 0xC0000023
}
ctx.Mem.Write32(buffer, 0) // Attributes
ctx.Mem.Write32(buffer+4, 0xF) // GrantedAccess
ctx.Mem.Write32(buffer+8, 1) // HandleCount
ctx.Mem.Write32(buffer+12, 1) // PointerCount
ctx.Mem.Write32(buffer+16, 0) // PagedPoolCharge
ctx.Mem.Write32(buffer+20, 0) // NonPagedPoolCharge
ctx.Mem.Write32(buffer+24, 0) // Reserved[0]
ctx.Mem.Write32(buffer+28, 0) // Reserved[1]
ctx.Mem.Write32(buffer+32, 0) // Reserved[2]
ctx.Mem.Write64(buffer+36, 0) // NameInformationLength + TypeInformationLength
return StatusSuccess
case 1: // ObjectNameInformation (UNICODE_STRING + name)
wsBytes := encodeUTF16LE(name)
needed := uint64(dataOff + uint64(len(wsBytes)) + 2)
if retLen != 0 {
ctx.Mem.Write32(retLen, uint32(needed))
}
if buffer == 0 {
return StatusSuccess
}
if bufLen < needed {
return StatusBufferTooSmall
}
strData := buffer + dataOff
ctx.Mem.Write16(buffer, uint16(len(wsBytes)))
ctx.Mem.Write16(buffer+2, uint16(len(wsBytes)+2))
if ctx.Mem.Mode32 {
ctx.Mem.Write32(buffer+4, uint32(strData))
} else {
ctx.Mem.Write32(buffer+4, 0)
ctx.Mem.Write64(buffer+8, strData)
}
ctx.Mem.WriteBytes(strData, wsBytes)
ctx.Mem.Write16(strData+uint64(len(wsBytes)), 0)
return StatusSuccess
case 2: // ObjectTypeInformation
wsBytes := encodeUTF16LE(typeName)
needed := uint64(72 + len(wsBytes) + 2)
if retLen != 0 {
ctx.Mem.Write32(retLen, uint32(needed))
}
if buffer == 0 {
return StatusSuccess
}
if bufLen < needed {
return StatusBufferTooSmall
}
strData := buffer + dataOff
ctx.Mem.Write16(buffer, uint16(len(wsBytes)))
ctx.Mem.Write16(buffer+2, uint16(len(wsBytes)+2))
if ctx.Mem.Mode32 {
ctx.Mem.Write32(buffer+4, uint32(strData))
} else {
ctx.Mem.Write32(buffer+4, 0)
ctx.Mem.Write64(buffer+8, strData)
}
ctx.Mem.WriteBytes(strData, wsBytes)
ctx.Mem.Write16(strData+uint64(len(wsBytes)), 0)
return StatusSuccess
case 3: // ObjectTypesInformation
// Return a tiny but non-empty type count to satisfy callers that check >0.
needed := uint32(4)
if retLen != 0 {
ctx.Mem.Write32(retLen, needed)
}
if buffer == 0 {
return StatusSuccess
}
if bufLen < uint64(needed) {
return StatusBufferTooSmall
}
ctx.Mem.Write32(buffer, 1)
return StatusSuccess
case 4: // ObjectHandleFlagInformation
if retLen != 0 {
ctx.Mem.Write32(retLen, 2)
}
if buffer == 0 || bufLen < 2 {
return StatusBufferTooSmall
}
flags := objectHandleFlags[h]
if flags&1 != 0 {
ctx.Mem.Write8(buffer+0, 1) // Inherit
} else {
ctx.Mem.Write8(buffer+0, 0)
}
if flags&2 != 0 {
ctx.Mem.Write8(buffer+1, 1) // ProtectFromClose
} else {
ctx.Mem.Write8(buffer+1, 0)
}
return StatusSuccess
}
return StatusNotImplemented
}
// ======================== LDR (DLL LOADING) ========================
func handleLdrGetDllHandle(ctx *TrapContext) uint32 {
// LdrGetDllHandle(PathToFile, Unused, ModuleName*, ModuleHandle*)
// ModuleName is UNICODE_STRING*, ModuleHandle is HMODULE*
moduleNamePtr := ctx.Arg(2) // UNICODE_STRING*
handlePtr := ctx.Arg(3) // HMODULE*
if moduleNamePtr == 0 || handlePtr == 0 {
return StatusNotImplemented
}
nameStr := readGuestUnicodeString(ctx.Mem, moduleNamePtr)
nameStr = strings.ToLower(nameStr)
// Strip path, keep only filename
if idx := strings.LastIndexAny(nameStr, "\\/"); idx >= 0 {
nameStr = nameStr[idx+1:]
}
if !strings.HasSuffix(nameStr, ".dll") {
nameStr += ".dll"
}
base := findModuleByName(ctx, nameStr)
if base == 0 {
writeGuestPointer(ctx.Mem, handlePtr, 0)
return 0xC0000135 // STATUS_DLL_NOT_FOUND
}
writeGuestPointer(ctx.Mem, handlePtr, base)
return StatusSuccess
}
func handleLdrGetProcedureAddress(ctx *TrapContext) uint32 {
// LdrGetProcedureAddress(ModuleHandle, FunctionName*, Ordinal, FunctionAddress*)
moduleHandle := ctx.Arg(0) // HMODULE (base address)
funcNamePtr := ctx.Arg(1) // ANSI_STRING*
ordinal := uint16(ctx.Arg(2))
funcAddrPtr := ctx.Arg(3) // PVOID*
if funcAddrPtr != 0 {
writeGuestPointer(ctx.Mem, funcAddrPtr, 0)
}
if moduleHandle == 0 {
return StatusNotImplemented
}
var funcName string
if funcNamePtr != 0 {
funcName = readGuestAnsiString(ctx.Mem, funcNamePtr)
}
// Look up in the Dispatcher's synthetic export table
addr := ctx.Disp.LookupExportByModule(moduleHandle, funcName, ordinal)
if ctx.Trace {
fmt.Printf(" LdrGetProcedureAddress: module=0x%x name=%q ordinal=%d → addr=0x%x\n",
moduleHandle, funcName, ordinal, addr)
}
if addr != 0 && funcAddrPtr != 0 {
writeGuestPointer(ctx.Mem, funcAddrPtr, addr)
return StatusSuccess
}
return 0xC0000139 // STATUS_ENTRYPOINT_NOT_FOUND
}
// ======================== Helpers ========================
// writeIOStatus writes an IO_STATUS_BLOCK.
func writeIOStatus(mem *mmu.MMU, addr uint64, status uint32, info uint64) {
if addr == 0 {
return
}
mem.Write32(addr, status)
if mem.Mode32 {
mem.Write32(addr+4, uint32(info))
return
}
mem.Write64(addr+8, info)
}
// windowsFileTime converts a time.Time to Windows FILETIME (100ns since 1601-01-01).
func windowsFileTime(t time.Time) uint64 {
const epochDiff = 11644473600
return uint64((t.Unix()+epochDiff)*10000000 + int64(t.Nanosecond()/100))
}
// readGuestStringUTF16 reads a null-terminated UTF-16LE string from guest memory.
func readGuestStringUTF16(mem *mmu.MMU, addr uint64, maxBytes int) string {
if addr == 0 {
return ""
}
data, err := mem.ReadBytes(addr, maxBytes)
if err != nil {
return ""
}
return decodeUTF16LE(data)
}
func readGuestAnsiString(mem *mmu.MMU, addr uint64) string {
if mem == nil || addr == 0 {
return ""
}
length, _ := mem.Read16(addr)
var buffer uint64
if mem.Mode32 {
ptr, _ := mem.Read32(addr + 4)
buffer = uint64(ptr)
} else {
buffer, _ = mem.Read64(addr + 8)
}
if buffer == 0 || length == 0 {
return ""
}
data, err := mem.ReadBytes(buffer, int(length))
if err != nil {
return ""
}
return string(data)
}
func writeGuestPointer(mem *mmu.MMU, addr, value uint64) {
if mem == nil || addr == 0 {
return
}
if mem.Mode32 {
_ = mem.Write32(addr, uint32(value))
return
}
_ = mem.Write64(addr, value)
}
// readGuestUnicodeString reads a UNICODE_STRING structure from guest memory.
func readGuestUnicodeString(mem *mmu.MMU, addr uint64) string {
if addr == 0 {
return ""
}
length, _ := mem.Read16(addr + UnicodeStringLength)
var bufPtr uint64
if mem.Mode32 {
ptr32, _ := mem.Read32(addr + UnicodeString32Buffer)
bufPtr = uint64(ptr32)
} else {
bufPtr, _ = mem.Read64(addr + UnicodeStringBuffer)
}
if bufPtr == 0 || length == 0 {
return ""
}
return readGuestStringUTF16(mem, bufPtr, int(length))
}
// findModuleByName searches PEB_LDR_DATA InLoadOrderModuleList for a DLL by name.
func findModuleByName(ctx *TrapContext, name string) uint64 {
if ctx == nil || ctx.Mem == nil || ctx.State == nil {
return 0
}
pebAddr := ctx.State.PEBAddr
is32 := ctx.Mem.Mode32 || ctx.State.Is32
var ldrAddr uint64
if is32 {
value, _ := ctx.Mem.Read32(pebAddr + Peb32Ldr)
ldrAddr = uint64(value)
} else {
ldrAddr, _ = ctx.Mem.Read64(pebAddr + PebLdr)
}
if ldrAddr == 0 {
return 0
}
listOffset := uint64(LdrInLoadOrderModuleList)
baseOffset := uint64(LdrEntryDllBase)
nameOffset := uint64(LdrEntryBaseDllName)
if is32 {
listOffset = Ldr32InLoadOrderModuleList
baseOffset = Ldr32EntryDllBase
nameOffset = Ldr32EntryBaseDllName
}
listHead := ldrAddr + listOffset
readPointer := func(addr uint64) uint64 {
if is32 {
value, _ := ctx.Mem.Read32(addr)
return uint64(value)
}
value, _ := ctx.Mem.Read64(addr)
return value
}
flink := readPointer(listHead)
for flink != 0 && flink != listHead {
entry := flink
baseName := readGuestUnicodeString(ctx.Mem, entry+nameOffset)
if strings.EqualFold(baseName, name) {
return readPointer(entry + baseOffset)
}
flink = readPointer(flink)
}
return 0
}
// writeGuestUTF16 writes a string as UTF-16LE with null terminator to guest memory.
func writeGuestUTF16(mem *mmu.MMU, addr uint64, s string) int {
utf16 := encodeUTF16LE(s)
data := append(utf16, 0, 0)
mem.WriteBytes(addr, data)
return len(data)
}
// encode32LE encodes a uint32 as little-endian bytes.
func encode32LE(val uint32) []byte {
b := make([]byte, 4)
binary.LittleEndian.PutUint32(b, val)
return b
}
// ======================== Additional handlers for Wine DLL init ========================
func handleRtlGetCurrentPeb(ctx *TrapContext) uint32 {
ctx.SetReturn(ctx.State.PEBAddr)
return StatusSuccess
}
func handleRtlAcquirePebLock(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlReleasePebLock(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlInitAnsiString(ctx *TrapContext) uint32 {
// RtlInitAnsiString(PANSI_STRING dest, PCSZ source)
dest := ctx.Arg(0)
src := ctx.Arg(1)
if dest == 0 {
return StatusSuccess
}
if src == 0 {
ctx.Mem.Write16(dest+0, 0) // Length
ctx.Mem.Write16(dest+2, 0) // MaximumLength
ctx.Mem.Write64(dest+8, 0) // Buffer
return StatusSuccess
}
// Measure string length
length := uint16(0)
for {
b, err := ctx.Mem.Read8(src + uint64(length))
if err != nil || b == 0 {
break
}
length++
}
ctx.Mem.Write16(dest+0, length)
ctx.Mem.Write16(dest+2, length+1)
ctx.Mem.Write64(dest+8, src)
return StatusSuccess
}
func handleRtlInitUnicodeStringEx(ctx *TrapContext) uint32 {
// Same as RtlInitUnicodeString but returns NTSTATUS
handleRtlInitUnicodeString(ctx)
return StatusSuccess
}
func handleRtlMultiByteToUnicodeN(ctx *TrapContext) uint32 {
// RtlMultiByteToUnicodeN(wchar* dst, ULONG dstMax, ULONG* resultLen, char* src, ULONG srcLen)
dst := ctx.Arg(0)
dstMax := uint32(ctx.Arg(1))
resultLenPtr := ctx.Arg(2)
src := ctx.Arg(3)
srcLen := uint32(ctx.Arg(4))
written := uint32(0)
for i := uint32(0); i < srcLen && written+2 <= dstMax; i++ {
b, err := ctx.Mem.Read8(src + uint64(i))
if err != nil {
break
}
ctx.Mem.Write16(dst+uint64(written), uint16(b))
written += 2
}
if resultLenPtr != 0 {
ctx.Mem.Write32(resultLenPtr, written)
}
return StatusSuccess
}
func handleRtlMultiByteToUnicodeSize(ctx *TrapContext) uint32 {
// RtlMultiByteToUnicodeSize(ULONG* resultSize, char* src, ULONG srcLen)
resultPtr := ctx.Arg(0)
srcLen := uint32(ctx.Arg(2))
if resultPtr != 0 {
ctx.Mem.Write32(resultPtr, srcLen*2)
}
return StatusSuccess
}
func handleRtlUnicodeToMultiByteN(ctx *TrapContext) uint32 {
// RtlUnicodeToMultiByteN(char* dst, ULONG dstMax, ULONG* resultLen, wchar* src, ULONG srcLen)
dst := ctx.Arg(0)
dstMax := uint32(ctx.Arg(1))
resultLenPtr := ctx.Arg(2)
src := ctx.Arg(3)
srcLen := uint32(ctx.Arg(4))
written := uint32(0)
for i := uint32(0); i+2 <= srcLen && written < dstMax; i += 2 {
ch, err := ctx.Mem.Read16(src + uint64(i))
if err != nil {
break
}
if ch > 127 {
ch = '?'
}
ctx.Mem.Write8(dst+uint64(written), uint8(ch))
written++
}
if resultLenPtr != 0 {
ctx.Mem.Write32(resultLenPtr, written)
}
return StatusSuccess
}
func handleRtlUnicodeToMultiByteSize(ctx *TrapContext) uint32 {
resultPtr := ctx.Arg(0)
srcLen := uint32(ctx.Arg(2))
if resultPtr != 0 {
ctx.Mem.Write32(resultPtr, srcLen/2)
}
return StatusSuccess
}
func handleRtlAnsiStringToUnicodeString(ctx *TrapContext) uint32 {
// RtlAnsiStringToUnicodeString(PUNICODE_STRING dest, PANSI_STRING src, BOOLEAN alloc)
dest := ctx.Arg(0)
src := ctx.Arg(1)
allocate := ctx.Arg(2) != 0
if dest == 0 || src == 0 {
return StatusInvalidParameter
}
srcLen, _ := ctx.Mem.Read16(src + 0)
srcBuf, _ := ctx.Mem.Read64(src + 8)
uniLen := uint16(srcLen) * 2
uniMaxLen := uniLen + 2
var uniBuf uint64
if allocate {
uniBuf = ctx.Mem.Mmap(0, uint64(uniMaxLen), mmu.PermRead|mmu.PermWrite)
} else {
uniBuf, _ = ctx.Mem.Read64(dest + 8)
}
for i := uint16(0); i < srcLen; i++ {
b, _ := ctx.Mem.Read8(srcBuf + uint64(i))
ctx.Mem.Write16(uniBuf+uint64(i)*2, uint16(b))
}
ctx.Mem.Write16(uniBuf+uint64(srcLen)*2, 0) // null terminator
ctx.Mem.Write16(dest+0, uniLen)
ctx.Mem.Write16(dest+2, uniMaxLen)
ctx.Mem.Write64(dest+8, uniBuf)
return StatusSuccess
}
func handleRtlUnicodeStringToAnsiString(ctx *TrapContext) uint32 {
dest := ctx.Arg(0)
src := ctx.Arg(1)
allocate := ctx.Arg(2) != 0
if dest == 0 || src == 0 {
return StatusInvalidParameter
}
srcLen, _ := ctx.Mem.Read16(src + 0)
srcBuf, _ := ctx.Mem.Read64(src + 8)
ansiLen := srcLen / 2
ansiMaxLen := ansiLen + 1
var ansiBuf uint64
if allocate {
ansiBuf = ctx.Mem.Mmap(0, uint64(ansiMaxLen), mmu.PermRead|mmu.PermWrite)
} else {
ansiBuf, _ = ctx.Mem.Read64(dest + 8)
}
for i := uint16(0); i < ansiLen; i++ {
ch, _ := ctx.Mem.Read16(srcBuf + uint64(i)*2)
if ch > 127 {
ch = '?'
}
ctx.Mem.Write8(ansiBuf+uint64(i), uint8(ch))
}
ctx.Mem.Write8(ansiBuf+uint64(ansiLen), 0)
ctx.Mem.Write16(dest+0, ansiLen)
ctx.Mem.Write16(dest+2, ansiMaxLen)
ctx.Mem.Write64(dest+8, ansiBuf)
return StatusSuccess
}
func handleRtlFreeAnsiString(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlCreateUnicodeString(ctx *TrapContext) uint32 {
// RtlCreateUnicodeString(PUNICODE_STRING dest, PCWSTR src)
dest := ctx.Arg(0)
src := ctx.Arg(1)
if dest == 0 || src == 0 {
ctx.SetReturn(0) // FALSE
return StatusSuccess
}
// Measure wide string
length := uint64(0)
for {
ch, err := ctx.Mem.Read16(src + length*2)
if err != nil || ch == 0 {
break
}
length++
}
byteLen := uint16(length * 2)
bufSize := uint64(byteLen + 2)
buf := ctx.Mem.Mmap(0, bufSize, mmu.PermRead|mmu.PermWrite)
// Copy
for i := uint64(0); i < length; i++ {
ch, _ := ctx.Mem.Read16(src + i*2)
ctx.Mem.Write16(buf+i*2, ch)
}
ctx.Mem.Write16(buf+length*2, 0) // null terminator
ctx.Mem.Write16(dest+0, byteLen)
ctx.Mem.Write16(dest+2, byteLen+2)
ctx.Mem.Write64(dest+8, buf)
ctx.SetReturn(1) // TRUE
return StatusSuccess
}
func handleRtlCompareUnicodeStrings(ctx *TrapContext) uint32 {
s1 := ctx.Arg(0)
l1 := uint32(ctx.Arg(1))
s2 := ctx.Arg(2)
l2 := uint32(ctx.Arg(3))
caseInsensitive := ctx.Arg(4) != 0
minLen := l1
if l2 < minLen {
minLen = l2
}
for i := uint32(0); i < minLen; i++ {
c1, _ := ctx.Mem.Read16(s1 + uint64(i)*2)
c2, _ := ctx.Mem.Read16(s2 + uint64(i)*2)
if caseInsensitive {
if c1 >= 'A' && c1 <= 'Z' {
c1 += 32
}
if c2 >= 'A' && c2 <= 'Z' {
c2 += 32
}
}
if c1 != c2 {
if c1 < c2 {
ctx.SetReturn(^uint64(0)) // -1
} else {
ctx.SetReturn(1)
}
return StatusSuccess
}
}
if l1 == l2 {
ctx.SetReturn(0)
} else if l1 < l2 {
ctx.SetReturn(^uint64(0))
} else {
ctx.SetReturn(1)
}
return StatusSuccess
}
func handleRtlImageNtHeader(ctx *TrapContext) uint32 {
base := ctx.Arg(0)
if base == 0 {
ctx.SetReturn(0)
return StatusSuccess
}
// Read e_lfanew
lfanew, err := ctx.Mem.Read32(base + 0x3C)
if err != nil {
ctx.SetReturn(0)
return StatusSuccess
}
ntHeader := base + uint64(lfanew)
sig, err := ctx.Mem.Read32(ntHeader)
if err != nil || sig != 0x00004550 {
ctx.SetReturn(0)
return StatusSuccess
}
ctx.SetReturn(ntHeader)
return StatusSuccess
}
func handleRtlImageDirectoryEntryToData(ctx *TrapContext) uint32 {
base := ctx.Arg(0)
_ = ctx.Arg(1) // MappedAsImage
dirIdx := ctx.Arg(2)
sizePtr := ctx.Arg(3)
if base == 0 {
ctx.SetReturn(0)
return StatusSuccess
}
lfanew, err := ctx.Mem.Read32(base + 0x3C)
if err != nil {
ctx.SetReturn(0)
return StatusSuccess
}
optHdr := base + uint64(lfanew) + 4 + 20
magic, _ := ctx.Mem.Read16(optHdr)
var dataDirOff uint64
if magic == 0x20B { // PE32+
dataDirOff = optHdr + 112
} else {
dataDirOff = optHdr + 96
}
entryOff := dataDirOff + dirIdx*8
rva, _ := ctx.Mem.Read32(entryOff)
size, _ := ctx.Mem.Read32(entryOff + 4)
if rva == 0 || size == 0 {
ctx.SetReturn(0)
return StatusSuccess
}
if sizePtr != 0 {
ctx.Mem.Write32(sizePtr, size)
}
ctx.SetReturn(base + uint64(rva))
return StatusSuccess
}
func handleRtlGetNativeSystemInformation(ctx *TrapContext) uint32 {
return handleNtQuerySystemInformation(ctx)
}
func handleNtGetTickCount(ctx *TrapContext) uint32 {
ctx.SetReturn(uint64(time.Now().UnixMilli()) & 0xFFFFFFFF)
return StatusSuccess
}
func handleNtFlushInstructionCache(ctx *TrapContext) uint32 {
return StatusSuccess
}
func handleNtGetContextThread(ctx *TrapContext) uint32 {
return StatusSuccess
}
func handleNtSetContextThread(ctx *TrapContext) uint32 {
return StatusSuccess
}
func handleNtResumeThread(ctx *TrapContext) uint32 {
prevCount := ctx.Arg(1)
if prevCount != 0 {
ctx.Mem.Write32(prevCount, 1)
}
return StatusSuccess
}
func handleNtSuspendThread(ctx *TrapContext) uint32 {
prevCount := ctx.Arg(1)
if prevCount != 0 {
ctx.Mem.Write32(prevCount, 0)
}
return StatusSuccess
}
func handleNtOpenProcessToken(ctx *TrapContext) uint32 {
tokenHandle := ctx.Arg(2)
if tokenHandle != 0 {
h := ctx.Handles.Alloc(NewDefaultTokenHandle())
ctx.Mem.Write64(tokenHandle, uint64(h))
}
return StatusSuccess
}
func handleNtOpenThreadToken(ctx *TrapContext) uint32 {
tokenHandle := ctx.Arg(2)
if tokenHandle != 0 {
h := ctx.Handles.Alloc(NewDefaultTokenHandle())
ctx.Mem.Write64(tokenHandle, uint64(h))
}
return StatusSuccess
}
func handleNtQueryInformationToken(ctx *TrapContext) uint32 {
token := ctx.Handles.GetToken(Handle(ctx.Arg(0)))
if token == nil {
token = NewDefaultTokenHandle()
}
infoClass := uint32(ctx.Arg(1))
outBuf := ctx.Arg(2)
outLen := uint32(ctx.Arg(3))
retLen := ctx.Arg(4)
switch infoClass {
case 1: // TokenUser - write a minimal SID
sid := token.UserSID
if len(sid) == 0 {
sid = NewDefaultTokenHandle().UserSID
}
needed := uint32(16 + len(sid))
if retLen != 0 {
ctx.Mem.Write32(retLen, needed)
}
if outLen < needed {
return 0xC0000023 // STATUS_BUFFER_TOO_SMALL
}
if outBuf != 0 {
// TOKEN_USER: SID_AND_ATTRIBUTES (pointer + attributes)
sidAddr := outBuf + 16
ctx.Mem.Write64(outBuf, sidAddr) // SID pointer
ctx.Mem.Write32(outBuf+8, 0) // Attributes
ctx.Mem.WriteBytes(sidAddr, sid)
}
return StatusSuccess
case 25: // TokenElevation
if retLen != 0 {
ctx.Mem.Write32(retLen, 4)
}
if outLen >= 4 && outBuf != 0 {
if token.Elevated {
ctx.Mem.Write32(outBuf, 1)
} else {
ctx.Mem.Write32(outBuf, 0)
}
}
return StatusSuccess
default:
if retLen != 0 {
ctx.Mem.Write32(retLen, 0)
}
return StatusNotImplemented
}
}
func handleNtAllocateLocallyUniqueId(ctx *TrapContext) uint32 {
luid := ctx.Arg(0)
if luid != 0 {
id := uint64(time.Now().UnixNano() & 0xFFFFFFFF)
ctx.Mem.Write32(luid, uint32(id)) // LowPart
ctx.Mem.Write32(luid+4, 0) // HighPart
}
return StatusSuccess
}
func handleNtQueryDefaultLocale(ctx *TrapContext) uint32 {
localePtr := ctx.Arg(1)
if localePtr != 0 {
ctx.Mem.Write32(localePtr, 0x0409) // en-US
}
return StatusSuccess
}
func handleNtQueryDefaultUILanguage(ctx *TrapContext) uint32 {
langPtr := ctx.Arg(0)
if langPtr != 0 {
ctx.Mem.Write16(langPtr, 0x0409) // en-US
}
return StatusSuccess
}
func handleNtQueryInstallUILanguage(ctx *TrapContext) uint32 {
langPtr := ctx.Arg(0)
if langPtr != 0 {
ctx.Mem.Write16(langPtr, 0x0409)
}
return StatusSuccess
}
func handleRtlGetProcessHeaps(ctx *TrapContext) uint32 {
// RtlGetProcessHeaps(ULONG count, PVOID* heaps)
count := uint32(ctx.Arg(0))
heaps := ctx.Arg(1)
// Read process heap from PEB
processHeap, _ := ctx.Mem.Read64(ctx.State.PEBAddr + PebProcessHeap)
if count > 0 && heaps != 0 && processHeap != 0 {
ctx.Mem.Write64(heaps, processHeap)
}
ctx.SetReturn(1) // 1 heap
return StatusSuccess
}
func handleRtlLockHeap(ctx *TrapContext) uint32 {
ctx.SetReturn(1) // TRUE
return StatusSuccess
}
func handleRtlUnlockHeap(ctx *TrapContext) uint32 {
ctx.SetReturn(1) // TRUE
return StatusSuccess
}
func handleRtlValidateHeap(ctx *TrapContext) uint32 {
ctx.SetReturn(1) // TRUE
return StatusSuccess
}
func handleRtlSetHeapInformation(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlQueryHeapInformation(ctx *TrapContext) uint32 {
retLen := ctx.Arg(4)
if retLen != 0 {
ctx.Mem.Write32(retLen, 0)
}
return StatusSuccess
}
func handleRtlGetUserInfoHeap(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlSetUserValueHeap(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlCompactHeap(ctx *TrapContext) uint32 {
ctx.SetReturn(0)
return StatusSuccess
}
func handleRtlWalkHeap(ctx *TrapContext) uint32 {
return 0xC0000225 // STATUS_NO_MORE_ENTRIES
}
func handleRtlInitCodePageTable(ctx *TrapContext) uint32 {
nlsPtr := ctx.Arg(0) // USHORT* - pointer to raw NLS data
infoPtr := ctx.Arg(1) // CPTABLEINFO* - output struct
if nlsPtr == 0 || infoPtr == 0 {
return StatusSuccess
}
initCodePageTableAt(ctx, nlsPtr, infoPtr)
return StatusSuccess
}
// handleRtlInitNlsTables initializes NLSTABLEINFO from raw NLS data pointers.
// VOID RtlInitNlsTables(PUSHORT AnsiNlsBase, PUSHORT OemNlsBase, PUSHORT CaseTableNlsBase, PNLSTABLEINFO TableInfo)
func handleRtlInitNlsTables(ctx *TrapContext) uint32 {
ansiPtr := ctx.Arg(0)
oemPtr := ctx.Arg(1)
casePtr := ctx.Arg(2)
infoPtr := ctx.Arg(3)
if infoPtr == 0 {
return StatusSuccess
}
// NLSTABLEINFO layout (x64):
// +0x00 CPTABLEINFO OemTableInfo (0x40 bytes)
// +0x40 CPTABLEINFO AnsiTableInfo (0x40 bytes)
// +0x80 PUSHORT UpperCaseTable
// +0x88 PUSHORT LowerCaseTable
if ansiPtr != 0 {
initCodePageTableAt(ctx, ansiPtr, infoPtr+0x40)
}
if oemPtr != 0 {
initCodePageTableAt(ctx, oemPtr, infoPtr)
}
if casePtr != 0 {
ctx.Mem.Write64(infoPtr+0x80, casePtr)
ctx.Mem.Write64(infoPtr+0x88, casePtr) // LowerCaseTable same as Upper for now
}
return StatusSuccess
}
// initCodePageTableAt is the core logic of RtlInitCodePageTable.
func initCodePageTableAt(ctx *TrapContext, nlsPtr, infoPtr uint64) {
read16 := func(off uint64) uint16 {
v, _ := ctx.Mem.Read16(nlsPtr + off*2)
return v
}
cp := read16(1)
ctx.Mem.Write16(infoPtr+0x00, cp)
ctx.Mem.Write16(infoPtr+0x02, read16(2))
ctx.Mem.Write16(infoPtr+0x04, read16(3))
ctx.Mem.Write16(infoPtr+0x06, read16(4))
ctx.Mem.Write16(infoPtr+0x08, read16(5))
ctx.Mem.Write16(infoPtr+0x0A, read16(6))
ctx.Mem.Write16(infoPtr+0x0C, 0)
for i := uint64(0); i < 12; i++ {
b, _ := ctx.Mem.Read8(nlsPtr + 7*2 + i)
ctx.Mem.Write8(infoPtr+0x0E+i, b)
}
headerSize := read16(0)
mbTableAddr := nlsPtr + uint64(headerSize+1)*2
ctx.Mem.Write64(infoPtr+0x20, mbTableAddr)
glyphSizeAddr := mbTableAddr + 256*2
glyphSize, _ := ctx.Mem.Read16(glyphSizeAddr)
glyphEndAddr := glyphSizeAddr + uint64(glyphSize+1)*2
ctx.Mem.Write64(infoPtr+0x30, glyphEndAddr)
dbcsMarker, _ := ctx.Mem.Read16(glyphEndAddr)
if dbcsMarker != 0 {
ctx.Mem.Write16(infoPtr+0x0C, cp)
}
wcTableAddr := glyphEndAddr + 2
ctx.Mem.Write64(infoPtr+0x28, wcTableAddr)
ctx.Mem.Write64(infoPtr+0x38, 0)
}
// handleRtlResetRtlTranslations sets PEB NLS fields from NLSTABLEINFO.
// VOID RtlResetRtlTranslations(PNLSTABLEINFO TableInfo)
func handleRtlResetRtlTranslations(ctx *TrapContext) uint32 {
infoPtr := ctx.Arg(0)
if infoPtr == 0 || ctx.State == nil {
return StatusSuccess
}
peb := ctx.State.PEBAddr
// AnsiTableInfo.MultiByteTable is at infoPtr+0x40+0x20
// PEB.AnsiCodePageData = MultiByteTable - 1 (pointer to USHORT before table)
ansiMBTable, _ := ctx.Mem.Read64(infoPtr + 0x40 + 0x20)
if ansiMBTable > 2 {
ctx.Mem.Write64(peb+PebAnsiCodePageData, ansiMBTable-2)
}
// OemTableInfo.MultiByteTable is at infoPtr+0x00+0x20
oemMBTable, _ := ctx.Mem.Read64(infoPtr + 0x20)
if oemMBTable > 2 {
ctx.Mem.Write64(peb+PebOemCodePageData, oemMBTable-2)
}
// UpperCaseTable is at infoPtr+0x80
ucTable, _ := ctx.Mem.Read64(infoPtr + 0x80)
if ucTable != 0 {
ctx.Mem.Write64(peb+PebUnicodeCaseTableData, ucTable)
}
return StatusSuccess
}
func handleRtlFlsAlloc(ctx *TrapContext) uint32 {
// RtlFlsAlloc(callback, *index_out)
// RCX = callback (ignored), RDX = pointer to output index
indexPtr := ctx.Arg(1)
// Use PEB FlsBitmap to allocate an index
pebAddr := ctx.State.PEBAddr
flsBitmapPtr, _ := ctx.Mem.Read64(pebAddr + PebFlsBitmap)
if flsBitmapPtr == 0 {
if indexPtr != 0 {
ctx.Mem.Write32(indexPtr, 0xFFFFFFFF)
}
return 0xC0000017 // STATUS_NO_MEMORY
}
// RtlFindClearBitsAndSet on the FLS bitmap
sizeOfBitMap, _ := ctx.Mem.Read32(flsBitmapPtr)
bufferAddr, _ := ctx.Mem.Read64(flsBitmapPtr + 8)
idx := uint32(0xFFFFFFFF)
for i := uint32(0); i < sizeOfBitMap; i++ {
wordIdx := i / 32
bitIdx := i % 32
word, _ := ctx.Mem.Read32(bufferAddr + uint64(wordIdx)*4)
if word&(1<<bitIdx) == 0 {
word |= 1 << bitIdx
ctx.Mem.Write32(bufferAddr+uint64(wordIdx)*4, word)
idx = i
break
}
}
if idx == 0xFFFFFFFF {
if indexPtr != 0 {
ctx.Mem.Write32(indexPtr, 0xFFFFFFFF)
}
return 0xC0000017 // STATUS_NO_MEMORY
}
ensureFlsData(ctx)
if indexPtr != 0 {
ctx.Mem.Write32(indexPtr, idx)
}
if ctx.Trace {
fmt.Fprintf(os.Stderr, " RtlFlsAlloc → index=%d\n", idx)
}
return StatusSuccess
}
func handleRtlFlsFree(ctx *TrapContext) uint32 {
idx := uint32(ctx.Arg(0))
flsDataPtr, _ := ctx.Mem.Read64(ctx.State.TEBAddr + TebFlsData)
if flsDataPtr != 0 && idx < 256 {
ctx.Mem.Write64(flsDataPtr+8+uint64(idx)*8, 0)
}
// Clear bit in PEB FlsBitmap
pebAddr := ctx.State.PEBAddr
flsBitmapPtr, _ := ctx.Mem.Read64(pebAddr + PebFlsBitmap)
if flsBitmapPtr != 0 {
bufferAddr, _ := ctx.Mem.Read64(flsBitmapPtr + 8)
if bufferAddr != 0 {
wordIdx := idx / 32
bitIdx := idx % 32
word, _ := ctx.Mem.Read32(bufferAddr + uint64(wordIdx)*4)
word &^= 1 << bitIdx
ctx.Mem.Write32(bufferAddr+uint64(wordIdx)*4, word)
}
}
return StatusSuccess
}
func handleRtlFlsGetValue(ctx *TrapContext) uint32 {
// RtlFlsGetValue(index, *value_out)
// RCX = index, RDX = pointer to output value
idx := uint32(ctx.Arg(0))
outPtr := ctx.Arg(1)
flsDataPtr, _ := ctx.Mem.Read64(ctx.State.TEBAddr + TebFlsData)
var val uint64
if flsDataPtr != 0 && idx < 256 {
val, _ = ctx.Mem.Read64(flsDataPtr + 8 + uint64(idx)*8)
}
if outPtr != 0 {
ctx.Mem.Write64(outPtr, val)
}
return StatusSuccess
}
func handleRtlFlsSetValue(ctx *TrapContext) uint32 {
// RtlFlsSetValue(index, value)
// RCX = index, RDX = value
idx := uint32(ctx.Arg(0))
val := ctx.Arg(1)
ensureFlsData(ctx)
flsDataPtr, _ := ctx.Mem.Read64(ctx.State.TEBAddr + TebFlsData)
if flsDataPtr != 0 && idx < 256 {
ctx.Mem.Write64(flsDataPtr+8+uint64(idx)*8, val)
}
return StatusSuccess
}
// ensureFlsData allocates the FLS data array in guest memory if not yet created.
func ensureFlsData(ctx *TrapContext) {
flsDataPtr, _ := ctx.Mem.Read64(ctx.State.TEBAddr + TebFlsData)
if flsDataPtr != 0 {
return
}
// Allocate 256 slots + 8 bytes header = 2056 bytes
const flsArraySize = 8 + 256*8
addr := ctx.Mem.Mmap(0, flsArraySize, 0x3) // RW
if addr == 0 {
return
}
// Clear to zero
for i := uint64(0); i < flsArraySize; i += 8 {
ctx.Mem.Write64(addr+i, 0)
}
// Store in TEB
ctx.Mem.Write64(ctx.State.TEBAddr+TebFlsData, addr)
}
func handleRtlProcessFlsData(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlExitUserProcess(ctx *TrapContext) uint32 {
code := uint32(ctx.Arg(0))
os.Exit(int(code))
return StatusSuccess
}
func handleRtlExitUserThread(ctx *TrapContext) uint32 {
ctx.CPU.Stop()
return StatusSuccess
}
func handleRtlNormalizeProcessParams(ctx *TrapContext) uint32 {
params := ctx.Arg(0)
ctx.SetReturn(params)
return StatusSuccess
}
func handleRtlIsProcessorFeaturePresent(ctx *TrapContext) uint32 {
feature := uint32(ctx.Arg(0))
switch feature {
case 10: // PF_COMPARE_EXCHANGE_DOUBLE
ctx.SetReturn(1)
case 23: // PF_FASTFAIL_AVAILABLE
ctx.SetReturn(1)
default:
ctx.SetReturn(0)
}
return StatusSuccess
}
func handleRtlCaptureContext(ctx *TrapContext) uint32 {
pCtx := ctx.Arg(0)
if pCtx == 0 {
return StatusSuccess
}
_ = saveCPUContextToGuest(ctx.CPU, ctx.Mem, pCtx)
return StatusSuccess
}
func restoreContextFromGuest(ctx *TrapContext, pCtx uint64) bool {
if pCtx == 0 {
return false
}
return restoreCPUContextFromGuest(ctx.CPU, ctx.Mem, pCtx) == nil
}
func handleRtlUnwind(ctx *TrapContext) uint32 {
pCtx := ctx.Arg(1)
restoreContextFromGuest(ctx, pCtx)
return StatusSuccess
}
func handleRtlUnwindEx(ctx *TrapContext) uint32 {
pCtx := ctx.Arg(1)
restoreContextFromGuest(ctx, pCtx)
return StatusSuccess
}
func handleRtlLookupFunctionEntry(ctx *TrapContext) uint32 {
trampoline := AllocTrampoline(ctx.Mem)
guestCall := func(addr uint64, args []uint64) (uint64, error) {
return CallGuestFunction(ctx.CPU, ctx.Mem, trampoline, addr, args, ctx.Trace)
}
_, imageBase, entryAddr := LookupFunctionEntry(ctx.Mem, ctx.Arg(0), guestCall)
imageBasePtr := ctx.Arg(1)
if imageBasePtr != 0 {
ctx.Mem.Write64(imageBasePtr, imageBase)
}
ctx.SetReturn(entryAddr)
return StatusSuccess
}
func handleRtlRestoreContext(ctx *TrapContext) uint32 {
restoreContextFromGuest(ctx, ctx.Arg(0))
return StatusSuccess
}
func handleRtlRaiseException(ctx *TrapContext) uint32 {
// Best-effort dispatch to registered VEH handlers.
// Full EXCEPTION_POINTERS marshalling is not implemented yet.
if handlers := GlobalVEH.GetAll(); len(handlers) > 0 {
if rw, ok := ctx.CPU.(RegisterWriter); ok {
rw.WriteReg(regRCX, ctx.Arg(0)) // PEXCEPTION_RECORD
}
for _, h := range handlers {
if h == nil || h.Addr == 0 {
continue
}
rsp := ctx.CPU.GetSP()
if rsp >= 8 {
rsp -= 8
ctx.Mem.Write64(rsp, ctx.CPU.GetPC())
ctx.CPU.SetSP(rsp)
ctx.CPU.SetPC(h.Addr)
return StatusSuccess
}
}
}
return StatusSuccess
}
func handleRtlRaiseStatus(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlAddVectoredExceptionHandler(ctx *TrapContext) uint32 {
first := ctx.Arg(0) != 0
handler := ctx.Arg(1)
h := GlobalVEH.Add(handler, first)
ctx.SetReturn(h)
return StatusSuccess
}
func handleRtlRemoveVectoredExceptionHandler(ctx *TrapContext) uint32 {
GlobalVEH.Remove(ctx.Arg(0))
ctx.SetReturn(1)
return StatusSuccess
}
func handleRtlPcToFileHeader(ctx *TrapContext) uint32 {
ctx.SetReturn(0)
return StatusSuccess
}
func handleRtlGetEnabledExtendedFeatures(ctx *TrapContext) uint32 {
ctx.SetReturn(0) // no extended features
return StatusSuccess
}
func handleRtlSetUnhandledExceptionFilter(ctx *TrapContext) uint32 {
if ctx.State != nil {
prev := ctx.State.UnhandledExceptionFilter
ctx.State.UnhandledExceptionFilter = ctx.Arg(0)
ctx.SetReturn(prev)
}
return StatusSuccess
}
func handleNtCreateSemaphore(ctx *TrapContext) uint32 {
handlePtr := ctx.Arg(0)
_ = ctx.Arg(1) // DesiredAccess
objAttr := ctx.Arg(2)
initialCount := int32(ctx.Arg(3))
maxCount := int32(ctx.Arg(4))
if maxCount <= 0 {
maxCount = 0x7fffffff
}
sem := NewSemaphore(initialCount, maxCount)
var name string
if objAttr != 0 {
_, oaName, _, err := ReadObjectAttributes(ctx, objAttr)
if err == nil {
name = NormalizeObjectName(oaName)
}
}
var h Handle
if name != "" {
var isNew bool
h, isNew = ctx.Handles.AllocNamed(name, sem)
if !isNew {
if handlePtr != 0 {
ctx.Mem.Write64(handlePtr, uint64(h))
}
return 0x40000000 // STATUS_OBJECT_NAME_EXISTS
}
} else {
h = ctx.Handles.Alloc(sem)
}
if handlePtr != 0 {
ctx.Mem.Write64(handlePtr, uint64(h))
}
return StatusSuccess
}
func handleNtReleaseSemaphore(ctx *TrapContext) uint32 {
// NtReleaseSemaphore(SemaphoreHandle, ReleaseCount, PreviousCount*)
h := Handle(ctx.Arg(0))
releaseCount := int32(ctx.Arg(1))
pPrevCount := ctx.Arg(2)
if releaseCount <= 0 {
releaseCount = 1
}
if sh := ctx.Handles.GetSemaphore(h); sh != nil {
prev, _ := sh.Release(releaseCount)
if pPrevCount != 0 {
ctx.Mem.Write32(pPrevCount, uint32(prev))
}
}
return StatusSuccess
}
func handleNtOpenEvent(ctx *TrapContext) uint32 {
handlePtr := ctx.Arg(0)
_ = ctx.Arg(1) // DesiredAccess
objAttr := ctx.Arg(2)
var name string
if objAttr != 0 {
_, oaName, _, err := ReadObjectAttributes(ctx, objAttr)
if err == nil {
name = NormalizeObjectName(oaName)
}
}
h := ctx.Handles.GetNamed(name)
if h == 0 {
return StatusObjectNameNotFound
}
if handlePtr != 0 {
ctx.Mem.Write64(handlePtr, uint64(h))
}
return StatusSuccess
}
func handleNtOpenMutant(ctx *TrapContext) uint32 {
handlePtr := ctx.Arg(0)
_ = ctx.Arg(1) // DesiredAccess
objAttr := ctx.Arg(2)
var name string
if objAttr != 0 {
_, oaName, _, err := ReadObjectAttributes(ctx, objAttr)
if err == nil {
name = NormalizeObjectName(oaName)
}
}
h := ctx.Handles.GetNamed(name)
if h == 0 {
return StatusObjectNameNotFound
}
if handlePtr != 0 {
ctx.Mem.Write64(handlePtr, uint64(h))
}
return StatusSuccess
}
func handleNtOpenSemaphore(ctx *TrapContext) uint32 {
handlePtr := ctx.Arg(0)
_ = ctx.Arg(1) // DesiredAccess
objAttr := ctx.Arg(2)
var name string
if objAttr != 0 {
_, oaName, _, err := ReadObjectAttributes(ctx, objAttr)
if err == nil {
name = NormalizeObjectName(oaName)
}
}
h := ctx.Handles.GetNamed(name)
if h == 0 {
return StatusObjectNameNotFound
}
if handlePtr != 0 {
ctx.Mem.Write64(handlePtr, uint64(h))
}
return StatusSuccess
}
func handleNtOpenSection(ctx *TrapContext) uint32 {
return 0xC0000034
}
func handleNtQueryAttributesFile(ctx *TrapContext) uint32 {
return 0xC0000034 // not found
}
func handleNtOpenProcess(ctx *TrapContext) uint32 {
handlePtr := ctx.Arg(0)
if handlePtr != 0 {
h := ctx.Handles.Alloc(&GenericHandle{Kind: "Process"})
ctx.Mem.Write64(handlePtr, uint64(h))
}
return StatusSuccess
}
func handleNtSetInformationProcess(ctx *TrapContext) uint32 { return StatusSuccess }
func handleNtSetInformationThread(ctx *TrapContext) uint32 {
threadHandle := ctx.Handles.GetThread(Handle(ctx.Arg(0)))
infoClass := uint32(ctx.Arg(1))
switch infoClass {
case 2, 3:
if threadHandle != nil {
threadHandle.Priority = int32(ctx.Arg(2))
}
return StatusSuccess
case 0x11:
if threadHandle != nil {
threadHandle.HideFromDebugger = true
}
return StatusSuccess
case 0, 1:
return StatusSuccess
default:
return StatusInvalidParameter
}
}
func handleNtOpenThread(ctx *TrapContext) uint32 {
handlePtr := ctx.Arg(0)
if handlePtr != 0 {
h := ctx.Handles.Alloc(&GenericHandle{Kind: "Thread"})
ctx.Mem.Write64(handlePtr, uint64(h))
}
return StatusSuccess
}
func handleNtAlertThread(ctx *TrapContext) uint32 { return StatusSuccess }
func handleNtAlertResumeThread(ctx *TrapContext) uint32 { return StatusSuccess }
func handleNtTestAlert(ctx *TrapContext) uint32 { return StatusSuccess }
func handleNtCreateTimer(ctx *TrapContext) uint32 {
// NtCreateTimer(TimerHandle*, DesiredAccess, ObjectAttributes*, TimerType)
handlePtr := ctx.Arg(0)
objAttr := ctx.Arg(2)
timerType := ctx.Arg(3) // 0=NotificationTimer(manual), 1=SynchronizationTimer(auto)
manualReset := timerType == 0
timer := NewWaitableTimer(manualReset)
var name string
if objAttr != 0 {
_, oaName, _, err := ReadObjectAttributes(ctx, objAttr)
if err == nil {
name = NormalizeObjectName(oaName)
}
}
var h Handle
if name != "" {
var isNew bool
h, isNew = ctx.Handles.AllocNamed(name, timer)
if !isNew {
if handlePtr != 0 {
ctx.Mem.Write64(handlePtr, uint64(h))
}
return 0x40000000
}
} else {
h = ctx.Handles.Alloc(timer)
}
if handlePtr != 0 {
ctx.Mem.Write64(handlePtr, uint64(h))
}
return StatusSuccess
}
func handleNtSetTimer(ctx *TrapContext) uint32 {
// NtSetTimer(TimerHandle, DueTime*, ApcRoutine, ApcContext, Resume, Period, PreviousState*)
h := Handle(ctx.Arg(0))
dueTimePtr := ctx.Arg(1)
period := int32(ctx.Arg(5)) // ms
prevStatePtr := ctx.Arg(6)
wt, ok := ctx.Handles.Get(h).(*WaitableTimerHandle)
if !ok {
return StatusInvalidHandle
}
if prevStatePtr != 0 {
ctx.Mem.Write8(prevStatePtr, boolToByte(wt.IsSignaled()))
}
var dueNs int64
if dueTimePtr != 0 {
dueRaw, _ := ctx.Mem.Read64(dueTimePtr)
dueInt := int64(dueRaw)
if dueInt < 0 {
// Relative time: negative 100-ns intervals
dueNs = (-dueInt) * 100
} else if dueInt > 0 {
// Absolute FILETIME: convert to duration from now
nowFT := uint64(time.Now().UnixNano()/100 + 116444736000000000)
if uint64(dueInt) > nowFT {
dueNs = int64(uint64(dueInt)-nowFT) * 100
} else {
dueNs = 0
}
}
}
due := time.Duration(dueNs)
if due < 0 {
due = 0
}
var periodDur time.Duration
if period > 0 {
periodDur = time.Duration(period) * time.Millisecond
}
wt.Set(due, periodDur)
return StatusSuccess
}
func handleNtCancelTimer(ctx *TrapContext) uint32 {
h := Handle(ctx.Arg(0))
prevStatePtr := ctx.Arg(1)
wt, ok := ctx.Handles.Get(h).(*WaitableTimerHandle)
if !ok {
return StatusInvalidHandle
}
if prevStatePtr != 0 {
ctx.Mem.Write8(prevStatePtr, boolToByte(wt.IsSignaled()))
}
wt.Cancel()
return StatusSuccess
}
func handleNtQueryTimer(ctx *TrapContext) uint32 {
// NtQueryTimer(TimerHandle, TimerInformationClass, TimerInformation*, Length, ReturnLength*)
h := Handle(ctx.Arg(0))
buffer := ctx.Arg(2)
retLen := ctx.Arg(4)
wt, ok := ctx.Handles.Get(h).(*WaitableTimerHandle)
const needed = 16 // TIMER_BASIC_INFORMATION: RemainingTime(8) + TimerState(4) + pad(4)
if retLen != 0 {
ctx.Mem.Write32(retLen, needed)
}
if buffer != 0 {
ctx.Mem.Write64(buffer+0, 0) // RemainingTime (unknown without real tracking)
if ok && wt.IsSignaled() {
ctx.Mem.Write32(buffer+8, 1)
} else {
ctx.Mem.Write32(buffer+8, 0)
}
}
return StatusSuccess
}
func boolToByte(b bool) uint8 {
if b {
return 1
}
return 0
}
var rtlCurrentDirectory = `C:\`
var rtlProcessEnv = map[string]string{
"SYSTEMROOT": `C:\Windows`,
"WINDIR": `C:\Windows`,
"TEMP": `C:\Windows\Temp`,
"TMP": `C:\Windows\Temp`,
"COMSPEC": `C:\Windows\System32\cmd.exe`,
}
var rtlEnvBlocks = map[uint64]map[string]string{}
func normalizeDosPath(path string) string {
p := strings.TrimSpace(path)
if p == "" {
return rtlCurrentDirectory
}
p = strings.ReplaceAll(p, "/", `\`)
if strings.HasPrefix(p, `\??\`) {
return p
}
if strings.HasPrefix(p, `\\?\`) {
return `\??\` + strings.TrimPrefix(p, `\\?\`)
}
if strings.HasPrefix(p, `\\`) {
return `\??\UNC\` + strings.TrimPrefix(p, `\\`)
}
if strings.HasPrefix(p, `\`) {
drive := "C:"
if len(rtlCurrentDirectory) >= 2 && rtlCurrentDirectory[1] == ':' {
drive = rtlCurrentDirectory[:2]
}
p = drive + p
} else if !(len(p) >= 2 && p[1] == ':') {
base := rtlCurrentDirectory
if base == "" {
base = `C:\`
}
if !strings.HasSuffix(base, `\`) {
base += `\`
}
p = base + p
}
return p
}
func dosPathToNtPath(path string) string {
p := normalizeDosPath(path)
if strings.HasPrefix(p, `\??\`) || strings.HasPrefix(p, `\Device\`) {
return p
}
return `\??\` + p
}
func normalizeEnvKey(name string) string {
return strings.ToUpper(strings.TrimSpace(name))
}
func cloneEnv(src map[string]string) map[string]string {
dst := make(map[string]string, len(src))
for k, v := range src {
dst[k] = v
}
return dst
}
func lookupEnvMap(envBlock uint64) map[string]string {
if envBlock != 0 {
if m, ok := rtlEnvBlocks[envBlock]; ok {
return m
}
}
return rtlProcessEnv
}
func lookupEnvValue(envBlock uint64, name string) (string, bool) {
key := normalizeEnvKey(name)
if key == "" {
return "", false
}
if v, ok := lookupEnvMap(envBlock)[key]; ok {
return v, true
}
if v, ok := rtlProcessEnv[key]; ok {
return v, true
}
if v := os.Getenv(key); v != "" {
return v, true
}
return "", false
}
func expandEnvVars(envBlock uint64, src string) string {
var b strings.Builder
for i := 0; i < len(src); {
if src[i] != '%' {
b.WriteByte(src[i])
i++
continue
}
j := strings.IndexByte(src[i+1:], '%')
if j < 0 {
b.WriteByte(src[i])
i++
continue
}
j = i + 1 + j
name := src[i+1 : j]
if val, ok := lookupEnvValue(envBlock, name); ok {
b.WriteString(val)
} else {
b.WriteString(src[i : j+1])
}
i = j + 1
}
return b.String()
}
func handleLdrLoadDll(ctx *TrapContext) uint32 {
// LdrLoadDll(path, flags, moduleName*, handle*)
handlePtr := ctx.Arg(3)
if handlePtr != 0 {
writeGuestPointer(ctx.Mem, handlePtr, 0)
}
return StatusNotImplemented
}
func handleLdrGetDllHandleEx(ctx *TrapContext) uint32 {
// LdrGetDllHandleEx(flags, path, unused, moduleName*, handle*)
_ = ctx.Arg(0) // flags
moduleNamePtr := ctx.Arg(3) // UNICODE_STRING*
handlePtr := ctx.Arg(4)
if handlePtr != 0 {
writeGuestPointer(ctx.Mem, handlePtr, 0)
}
if moduleNamePtr == 0 {
return 0xC0000135 // STATUS_DLL_NOT_FOUND
}
nameStr := readGuestUnicodeString(ctx.Mem, moduleNamePtr)
nameStr = strings.ToLower(nameStr)
if idx := strings.LastIndexAny(nameStr, "\\/"); idx >= 0 {
nameStr = nameStr[idx+1:]
}
if !strings.HasSuffix(nameStr, ".dll") {
nameStr += ".dll"
}
base := findModuleByName(ctx, nameStr)
if base == 0 {
return 0xC0000135 // STATUS_DLL_NOT_FOUND
}
if handlePtr != 0 {
writeGuestPointer(ctx.Mem, handlePtr, base)
}
return StatusSuccess
}
func handleLdrAddRefDll(ctx *TrapContext) uint32 { return StatusSuccess }
func handleLdrGetDllPath(ctx *TrapContext) uint32 {
dllPathPtr := ctx.Arg(2)
searchPathsPtr := ctx.Arg(3)
if dllPathPtr != 0 {
writeGuestPointer(ctx.Mem, dllPathPtr, 0)
}
if searchPathsPtr != 0 {
writeGuestPointer(ctx.Mem, searchPathsPtr, 0)
}
return StatusSuccess
}
func handleLdrGetDllFullName(ctx *TrapContext) uint32 {
return StatusNotImplemented
}
func handleRtlDosPathNameToNtPathName_U(ctx *TrapContext) uint32 {
dosName := readGuestStringUTF16(ctx.Mem, ctx.Arg(0), 4096)
ntNameUS := ctx.Arg(1)
filePartPtr := ctx.Arg(2)
if ntNameUS == 0 || dosName == "" {
ctx.SetReturn(0)
return StatusSuccess
}
ntPath := dosPathToNtPath(dosName)
ntBytes := encodeUTF16LE(ntPath)
buf := ctx.Mem.Mmap(0, uint64(len(ntBytes)+2), mmu.PermRead|mmu.PermWrite)
ctx.Mem.WriteBytes(buf, ntBytes)
ctx.Mem.Write16(buf+uint64(len(ntBytes)), 0)
ctx.Mem.Write16(ntNameUS+UnicodeStringLength, uint16(len(ntBytes)))
ctx.Mem.Write16(ntNameUS+UnicodeStringMaxLength, uint16(len(ntBytes)+2))
ctx.Mem.Write64(ntNameUS+UnicodeStringBuffer, buf)
if filePartPtr != 0 {
lastSlash := strings.LastIndex(ntPath, `\`)
if lastSlash >= 0 && lastSlash+1 < len(ntPath) {
offsetBytes := uint64(len(encodeUTF16LE(ntPath[:lastSlash+1])))
ctx.Mem.Write64(filePartPtr, buf+offsetBytes)
} else {
ctx.Mem.Write64(filePartPtr, 0)
}
}
ctx.SetReturn(1)
return StatusSuccess
}
func handleRtlDosPathNameToNtPathName_U_WithStatus(ctx *TrapContext) uint32 {
_ = handleRtlDosPathNameToNtPathName_U(ctx)
return StatusSuccess
}
func handleRtlGetCurrentDirectory_U(ctx *TrapContext) uint32 {
bufLen := uint32(ctx.Arg(0))
buf := ctx.Arg(1)
cwd := rtlCurrentDirectory
if cwd == "" {
cwd = `C:\`
}
if buf != 0 && bufLen >= uint32(len(cwd)*2+2) {
for i, ch := range []rune(cwd) {
ctx.Mem.Write16(buf+uint64(i)*2, uint16(ch))
}
ctx.Mem.Write16(buf+uint64(len(cwd))*2, 0)
}
ctx.SetReturn(uint64(len(cwd) * 2))
return StatusSuccess
}
func handleRtlSetCurrentDirectory_U(ctx *TrapContext) uint32 {
pathUS := ctx.Arg(0)
path := readGuestUnicodeString(ctx.Mem, pathUS)
if path == "" {
return StatusInvalidParameter
}
rtlCurrentDirectory = normalizeDosPath(path)
if strings.HasPrefix(rtlCurrentDirectory, `\??\`) {
rtlCurrentDirectory = strings.TrimPrefix(rtlCurrentDirectory, `\??\`)
}
return StatusSuccess
}
func handleRtlGetFullPathName_U(ctx *TrapContext) uint32 {
fileName := readGuestStringUTF16(ctx.Mem, ctx.Arg(0), 4096)
bufLen := uint32(ctx.Arg(1))
buf := ctx.Arg(2)
filePartPtr := ctx.Arg(3)
if fileName == "" {
ctx.SetReturn(0)
return StatusSuccess
}
fullPath := normalizeDosPath(fileName)
if strings.HasPrefix(fullPath, `\??\`) {
fullPath = strings.TrimPrefix(fullPath, `\??\`)
}
utf16Bytes := encodeUTF16LE(fullPath)
required := uint32(len(utf16Bytes)) // bytes without null
if buf == 0 || bufLen < required+2 {
ctx.SetReturn(uint64(required + 2))
if filePartPtr != 0 {
ctx.Mem.Write64(filePartPtr, 0)
}
return StatusSuccess
}
ctx.Mem.WriteBytes(buf, utf16Bytes)
ctx.Mem.Write16(buf+uint64(required), 0)
if filePartPtr != 0 {
lastSlash := strings.LastIndex(fullPath, `\`)
if lastSlash >= 0 && lastSlash+1 < len(fullPath) {
offset := uint64(len(encodeUTF16LE(fullPath[:lastSlash+1])))
ctx.Mem.Write64(filePartPtr, buf+offset)
} else {
ctx.Mem.Write64(filePartPtr, 0)
}
}
ctx.SetReturn(uint64(required))
return StatusSuccess
}
func handleRtlDetermineDosPathNameType_U(ctx *TrapContext) uint32 {
path := readGuestStringUTF16(ctx.Mem, ctx.Arg(0), 1024)
switch {
case strings.HasPrefix(path, `\??\`) || strings.HasPrefix(path, `\\?\`):
ctx.SetReturn(5) // RtlPathTypeRootLocalDevice
case strings.HasPrefix(path, `\\`):
ctx.SetReturn(1) // RtlPathTypeUncAbsolute
case len(path) >= 3 && path[1] == ':' && (path[2] == '\\' || path[2] == '/'):
ctx.SetReturn(3) // RtlPathTypeDriveAbsolute
case len(path) >= 2 && path[1] == ':':
ctx.SetReturn(4) // RtlPathTypeDriveRelative
case strings.HasPrefix(path, `\`):
ctx.SetReturn(2) // RtlPathTypeRooted
default:
ctx.SetReturn(6) // RtlPathTypeRelative
}
return StatusSuccess
}
func handleRtlGetNtGlobalFlags(ctx *TrapContext) uint32 {
// Return retail-like defaults: no debug heap/pageheap flags enabled.
ctx.SetReturn(0)
return StatusSuccess
}
func handleRtlGetNtProductType(ctx *TrapContext) uint32 {
// BOOLEAN RtlGetNtProductType(NT_PRODUCT_TYPE* ProductType)
out := ctx.Arg(0)
if out == 0 {
ctx.SetReturn(0)
return StatusSuccess
}
ctx.Mem.Write32(out, 1) // NtProductWinNt
ctx.SetReturn(1)
return StatusSuccess
}
func handleRtlInitializeBitMap(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlSetBits(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlClearBits(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlAreBitsSet(ctx *TrapContext) uint32 {
ctx.SetReturn(1)
return StatusSuccess
}
func handleRtlAreBitsClear(ctx *TrapContext) uint32 {
ctx.SetReturn(1)
return StatusSuccess
}
func handleRtlGetThreadErrorMode(ctx *TrapContext) uint32 {
ctx.SetReturn(0)
return StatusSuccess
}
func handleRtlSetThreadErrorMode(ctx *TrapContext) uint32 {
oldMode := ctx.Arg(1)
if oldMode != 0 {
ctx.Mem.Write32(oldMode, 0)
}
return StatusSuccess
}
func handleRtlWow64GetProcessMachines(ctx *TrapContext) uint32 {
_ = ctx.Arg(0) // ProcessHandle
processMachinePtr := ctx.Arg(1)
nativeMachinePtr := ctx.Arg(2)
const imageFileMachineAMD64 = 0x8664
if processMachinePtr != 0 {
ctx.Mem.Write16(processMachinePtr, imageFileMachineAMD64)
}
if nativeMachinePtr != 0 {
ctx.Mem.Write16(nativeMachinePtr, imageFileMachineAMD64)
}
return StatusSuccess
}
// Wine-specific stubs
func handleWineGetVersion(ctx *TrapContext) uint32 {
// wine_get_version() returns pointer to version string
ver := "9.0"
buf := ctx.Mem.Mmap(0, 16, mmu.PermRead|mmu.PermWrite)
for i, b := range []byte(ver) {
ctx.Mem.Write8(buf+uint64(i), b)
}
ctx.Mem.Write8(buf+uint64(len(ver)), 0)
ctx.SetReturn(buf)
return StatusSuccess
}
func handleWineServerCall(ctx *TrapContext) uint32 {
// wine_server_call(req) - return STATUS_NOT_IMPLEMENTED
ctx.SetReturn(0xC0000002)
return StatusSuccess
}
func handleWineDbgGetChannelFlags(ctx *TrapContext) uint32 {
ctx.SetReturn(0) // no debug channels
return StatusSuccess
}
func handleWineDbgHeader(ctx *TrapContext) uint32 {
// Return pointer to an empty string (the NUL at PEB+0x100 which is always 0)
ctx.SetReturn(ctx.State.PEBAddr + 0x100)
return StatusSuccess
}
func handleWineDbgOutput(ctx *TrapContext) uint32 {
ctx.SetReturn(0) // 0 chars written
return StatusSuccess
}
func handleWineDbgStrdup(ctx *TrapContext) uint32 {
ctx.SetReturn(ctx.Arg(0)) // return same pointer
return StatusSuccess
}
func handleRtlOpenCurrentUser(ctx *TrapContext) uint32 {
// RtlOpenCurrentUser(ACCESS_MASK access, PHANDLE result)
// Opens \\Registry\\User\\.Default
_ = ctx.Arg(0) // access
handlePtr := ctx.Arg(1)
key := ctx.Reg.OpenKey("\\Registry\\User\\.Default")
if key == nil {
// Create a stub key so callers get something valid
ctx.Reg.CreateKey("\\Registry\\User\\.Default")
key = ctx.Reg.OpenKey("\\Registry\\User\\.Default")
}
if key != nil {
h := ctx.Handles.Alloc(&RegistryKeyHandle{Key: key})
if handlePtr != 0 {
ctx.Mem.Write64(handlePtr, uint64(h))
}
return StatusSuccess
}
return StatusObjectNameNotFound
}
func handleRtlQueryDynamicTimeZoneInformation(ctx *TrapContext) uint32 {
// RTL_DYNAMIC_TIME_ZONE_INFORMATION is 0x80 (128) bytes
infoPtr := ctx.Arg(0)
if infoPtr != 0 {
// Zero out the structure (UTC timezone)
for i := uint64(0); i < 128; i++ {
ctx.Mem.Write8(infoPtr+i, 0)
}
}
return StatusSuccess
}
func handleWineNtToUnixFileName(ctx *TrapContext) uint32 {
return StatusNotImplemented
}
func handleWineUnixToNtFileName(ctx *TrapContext) uint32 {
return StatusNotImplemented
}
func handleRtlCreateEnvironment(ctx *TrapContext) uint32 {
cloneCurrent := ctx.Arg(0) != 0
envPtr := ctx.Arg(1)
if envPtr != 0 {
// Keep a guest pointer for API compatibility and track logical values in Go.
envBuf := ctx.Mem.Mmap(0, 4, mmu.PermRead|mmu.PermWrite)
ctx.Mem.Write16(envBuf, 0)
if cloneCurrent {
rtlEnvBlocks[envBuf] = cloneEnv(rtlProcessEnv)
} else {
rtlEnvBlocks[envBuf] = map[string]string{
"SYSTEMROOT": rtlProcessEnv["SYSTEMROOT"],
"WINDIR": rtlProcessEnv["WINDIR"],
"TEMP": rtlProcessEnv["TEMP"],
"TMP": rtlProcessEnv["TMP"],
"COMSPEC": rtlProcessEnv["COMSPEC"],
}
}
ctx.Mem.Write64(envPtr, envBuf)
}
return StatusSuccess
}
func handleRtlDestroyEnvironment(ctx *TrapContext) uint32 {
envBlock := ctx.Arg(0)
if envBlock != 0 {
delete(rtlEnvBlocks, envBlock)
}
return StatusSuccess
}
func handleRtlQueryEnvironmentVariable_U(ctx *TrapContext) uint32 {
// RtlQueryEnvironmentVariable_U(Environment, Name, Value)
envBlock := ctx.Arg(0)
nameUS := ctx.Arg(1)
valueUS := ctx.Arg(2)
if nameUS == 0 || valueUS == 0 {
return StatusInvalidParameter
}
name := readGuestUnicodeString(ctx.Mem, nameUS)
val, ok := lookupEnvValue(envBlock, name)
if !ok {
return 0xC0000100 // STATUS_VARIABLE_NOT_FOUND
}
dstMax, _ := ctx.Mem.Read16(valueUS + UnicodeStringMaxLength)
dstBuf, _ := ctx.Mem.Read64(valueUS + UnicodeStringBuffer)
utf16Val := encodeUTF16LE(val)
required := uint16(len(utf16Val))
if dstBuf == 0 {
return StatusInvalidParameter
}
if uint32(dstMax) < uint32(required)+2 {
ctx.Mem.Write16(valueUS+UnicodeStringLength, required)
return StatusBufferTooSmall
}
ctx.Mem.WriteBytes(dstBuf, utf16Val)
ctx.Mem.Write16(dstBuf+uint64(required), 0)
ctx.Mem.Write16(valueUS+UnicodeStringLength, required)
return StatusSuccess
}
func handleRtlSetEnvironmentVariable(ctx *TrapContext) uint32 {
// RtlSetEnvironmentVariable(PWSTR* Environment, Name, Value)
envPtrPtr := ctx.Arg(0)
nameUS := ctx.Arg(1)
valueUS := ctx.Arg(2)
if nameUS == 0 {
return StatusInvalidParameter
}
name := normalizeEnvKey(readGuestUnicodeString(ctx.Mem, nameUS))
if name == "" {
return StatusInvalidParameter
}
var envBlock uint64
var target map[string]string
if envPtrPtr != 0 {
envBlock, _ = ctx.Mem.Read64(envPtrPtr)
if envBlock == 0 {
envBlock = ctx.Mem.Mmap(0, 4, mmu.PermRead|mmu.PermWrite)
ctx.Mem.Write16(envBlock, 0)
ctx.Mem.Write64(envPtrPtr, envBlock)
rtlEnvBlocks[envBlock] = cloneEnv(rtlProcessEnv)
}
target = lookupEnvMap(envBlock)
} else {
target = rtlProcessEnv
}
if valueUS == 0 {
delete(target, name)
return StatusSuccess
}
val := readGuestUnicodeString(ctx.Mem, valueUS)
target[name] = val
return StatusSuccess
}
func handleRtlExpandEnvironmentStrings_U(ctx *TrapContext) uint32 {
// RtlExpandEnvironmentStrings_U(Environment, Source, Destination, ReturnedLength)
envBlock := ctx.Arg(0) // optional environment block pointer
srcUS := ctx.Arg(1)
dstUS := ctx.Arg(2)
returnLenPtr := ctx.Arg(3)
if srcUS == 0 || dstUS == 0 {
return StatusInvalidParameter
}
src := readGuestUnicodeString(ctx.Mem, srcUS)
if src == "" {
if returnLenPtr != 0 {
ctx.Mem.Write32(returnLenPtr, 0)
}
ctx.Mem.Write16(dstUS+UnicodeStringLength, 0)
return StatusSuccess
}
expanded := expandEnvVars(envBlock, src)
dstMax, _ := ctx.Mem.Read16(dstUS + UnicodeStringMaxLength)
dstBuf, _ := ctx.Mem.Read64(dstUS + UnicodeStringBuffer)
outUTF16 := encodeUTF16LE(expanded)
required := uint32(len(outUTF16))
if returnLenPtr != 0 {
ctx.Mem.Write32(returnLenPtr, required)
}
if dstBuf == 0 {
return StatusInvalidParameter
}
if uint32(dstMax) < required+2 {
ctx.Mem.Write16(dstUS+UnicodeStringLength, uint16(minUint32(required, uint32(dstMax))))
return StatusBufferTooSmall
}
ctx.Mem.WriteBytes(dstBuf, outUTF16)
ctx.Mem.Write16(dstBuf+uint64(len(outUTF16)), 0)
ctx.Mem.Write16(dstUS+UnicodeStringLength, uint16(len(outUTF16)))
return StatusSuccess
}
func handleRtlCreateProcessParametersEx(ctx *TrapContext) uint32 {
paramsPtr := ctx.Arg(0)
if paramsPtr != 0 {
params := ctx.Mem.Mmap(0, 1024, mmu.PermRead|mmu.PermWrite)
ctx.Mem.Write32(params, 1024) // MaximumLength
ctx.Mem.Write32(params+4, 512) // Length
ctx.Mem.Write64(paramsPtr, params)
}
return StatusSuccess
}
func handleRtlDestroyProcessParameters(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlRunOnceBeginInitialize(ctx *TrapContext) uint32 {
return StatusSuccess // proceed with initialization
}
func handleRtlRunOnceComplete(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlRunOnceExecuteOnce(ctx *TrapContext) uint32 { return StatusSuccess }
func handleNtCreateIoCompletion(ctx *TrapContext) uint32 {
handlePtr := ctx.Arg(0)
if !validateGuestWrite(ctx.Mem, handlePtr, guestPtrSize(ctx.Mem)) {
return StatusAccessViolation
}
h := ctx.Handles.Alloc(&IoCompletionPortHandle{})
writeGuestPtr(ctx.Mem, handlePtr, uint64(h))
return StatusSuccess
}
func handleNtSetIoCompletion(ctx *TrapContext) uint32 {
// NtSetIoCompletion(IoCompletionHandle, CompletionKey, CompletionContext, Status, Information)
h := Handle(ctx.Arg(0))
key := ctx.Arg(1)
overlapped := ctx.Arg(2)
status := uint32(ctx.Arg(3))
info := uint32(ctx.Arg(4))
iocp := ctx.Handles.GetIoCompletion(h)
if iocp == nil {
return StatusInvalidHandle
}
iocp.Post(key, overlapped, info, status)
return StatusSuccess
}
func handleNtRemoveIoCompletion(ctx *TrapContext) uint32 {
// NtRemoveIoCompletion(IoCompletionHandle, KeyContext, ApcContext, IoStatusBlock, Timeout)
h := Handle(ctx.Arg(0))
keyPtr := ctx.Arg(1)
apcPtr := ctx.Arg(2)
ioStatus := ctx.Arg(3)
timeoutPtr := ctx.Arg(4)
iocp := ctx.Handles.GetIoCompletion(h)
if iocp == nil {
return StatusInvalidHandle
}
ptrSize := guestPtrSize(ctx.Mem)
if !validateGuestWrite(ctx.Mem, keyPtr, ptrSize) ||
!validateGuestWrite(ctx.Mem, apcPtr, ptrSize) ||
!validateGuestWrite(ctx.Mem, ioStatus, ptrSize*2) {
return StatusAccessViolation
}
timeout := time.Duration(-1)
if timeoutPtr != 0 {
t, _ := ctx.Mem.Read64(timeoutPtr)
tv := int64(t)
if tv == 0 {
timeout = 0
} else if tv < 0 {
timeout = time.Duration(-tv) * 100 * time.Nanosecond
} else {
now := time.Now()
const epochDiff = 11644473600
ftNow := (now.Unix()+epochDiff)*10000000 + int64(now.Nanosecond()/100)
rel := tv - ftNow
if rel <= 0 {
timeout = 0
} else {
timeout = time.Duration(rel) * 100 * time.Nanosecond
}
}
}
pkt, removeResult := iocp.RemoveEx(timeout)
if removeResult != IoCompletionRemoved {
status := StatusTimeout
if removeResult == IoCompletionClosed {
status = StatusAbandoned
}
if ioStatus != 0 {
writeIOStatus(ctx.Mem, ioStatus, status, 0)
}
return status
}
if keyPtr != 0 {
writeGuestPtr(ctx.Mem, keyPtr, pkt.CompletionKey)
}
if apcPtr != 0 {
writeGuestPtr(ctx.Mem, apcPtr, pkt.Overlapped)
}
if ioStatus != 0 {
writeIOStatus(ctx.Mem, ioStatus, pkt.Status, uint64(pkt.BytesTransferred))
}
return StatusSuccess
}
func handleNtRemoveIoCompletionEx(ctx *TrapContext) uint32 {
// NtRemoveIoCompletionEx(IoCompletionHandle, Entries, Count, NumRemoved, Timeout, Alertable)
h := Handle(ctx.Arg(0))
entries := ctx.Arg(1)
count := uint32(ctx.Arg(2))
removedPtr := ctx.Arg(3)
timeoutPtr := ctx.Arg(4)
_ = ctx.Arg(5) // Alertable
iocp := ctx.Handles.GetIoCompletion(h)
if iocp == nil {
return StatusInvalidHandle
}
if count == 0 {
return StatusInvalidParameter
}
ptrSize := guestPtrSize(ctx.Mem)
entrySize := ptrSize * 4
if !validateGuestWrite(ctx.Mem, entries, uint64(count)*entrySize) ||
!validateGuestWrite(ctx.Mem, removedPtr, 4) {
return StatusAccessViolation
}
timeout := time.Duration(-1)
if timeoutPtr != 0 {
t, _ := ctx.Mem.Read64(timeoutPtr)
tv := int64(t)
if tv == 0 {
timeout = 0
} else if tv < 0 {
timeout = time.Duration(-tv) * 100 * time.Nanosecond
} else {
now := time.Now()
const epochDiff = 11644473600
ftNow := (now.Unix()+epochDiff)*10000000 + int64(now.Nanosecond()/100)
rel := tv - ftNow
if rel <= 0 {
timeout = 0
} else {
timeout = time.Duration(rel) * 100 * time.Nanosecond
}
}
}
removed := uint32(0)
for removed < count {
wait := time.Duration(0)
if removed == 0 {
wait = timeout
}
pkt, removeResult := iocp.RemoveEx(wait)
if removeResult != IoCompletionRemoved {
if removeResult == IoCompletionClosed && removed == 0 {
if removedPtr != 0 {
ctx.Mem.Write32(removedPtr, 0)
}
return StatusAbandoned
}
break
}
// FILE_IO_COMPLETION_INFORMATION {KeyContext, ApcContext, IoStatusBlock}
base := entries + uint64(removed)*entrySize
writeGuestPtr(ctx.Mem, base, pkt.CompletionKey)
writeGuestPtr(ctx.Mem, base+ptrSize, pkt.Overlapped)
writeGuestPtr(ctx.Mem, base+ptrSize*2, uint64(pkt.Status))
writeGuestPtr(ctx.Mem, base+ptrSize*3, uint64(pkt.BytesTransferred))
removed++
}
if removedPtr != 0 {
ctx.Mem.Write32(removedPtr, removed)
}
if removed == 0 {
return StatusTimeout
}
return StatusSuccess
}
func handleNtCancelIoFile(ctx *TrapContext) uint32 {
fileHandle := Handle(ctx.Arg(0))
ioStatus := ctx.Arg(1)
if ctx.Handles.GetFile(fileHandle) == nil {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidHandle, 0)
return StatusInvalidHandle
}
ioStatusSize := uint64(16)
if ctx.Mem.Mode32 {
ioStatusSize = 8
}
if !validateGuestWrite(ctx.Mem, ioStatus, ioStatusSize) {
return StatusAccessViolation
}
nativeIOFor(ctx.Handles).cancelMatching(
fileHandle,
nativeCurrentThreadID(ctx),
true,
0,
)
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, 0)
return StatusSuccess
}
func handleNtCancelIoFileEx(ctx *TrapContext) uint32 {
fileHandle := Handle(ctx.Arg(0))
requestIoStatus := ctx.Arg(1)
ioStatus := ctx.Arg(2)
if ctx.Handles.GetFile(fileHandle) == nil {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidHandle, 0)
return StatusInvalidHandle
}
ioStatusSize := uint64(16)
if ctx.Mem.Mode32 {
ioStatusSize = 8
}
if !validateGuestWrite(ctx.Mem, ioStatus, ioStatusSize) {
return StatusAccessViolation
}
if requestIoStatus != 0 &&
ctx.Mem.ValidateRange(requestIoStatus, ioStatusSize, mmu.PermRead) != nil {
return StatusAccessViolation
}
if nativeIOFor(ctx.Handles).cancelMatching(
fileHandle,
0,
false,
requestIoStatus,
) == 0 {
writeIOStatus(ctx.Mem, ioStatus, StatusNotFound, 0)
return StatusNotFound
}
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, 0)
return StatusSuccess
}
func handleNtCreateDirectoryObject(ctx *TrapContext) uint32 {
handlePtr := ctx.Arg(0)
if handlePtr != 0 {
h := ctx.Handles.Alloc(&GenericHandle{Kind: "Directory"})
ctx.Mem.Write64(handlePtr, uint64(h))
}
return StatusSuccess
}
func handleNtOpenDirectoryObject(ctx *TrapContext) uint32 {
handlePtr := ctx.Arg(0)
if handlePtr != 0 {
h := ctx.Handles.Alloc(&GenericHandle{Kind: "Directory"})
ctx.Mem.Write64(handlePtr, uint64(h))
}
return StatusSuccess
}
func handleNtCreateSymbolicLinkObject(ctx *TrapContext) uint32 {
handlePtr := ctx.Arg(0)
if handlePtr != 0 {
h := ctx.Handles.Alloc(&GenericHandle{Kind: "SymLink"})
ctx.Mem.Write64(handlePtr, uint64(h))
}
return StatusSuccess
}
func handleNtOpenSymbolicLinkObject(ctx *TrapContext) uint32 {
handlePtr := ctx.Arg(0)
objAttr := ctx.Arg(2)
if handlePtr == 0 || objAttr == 0 {
return StatusInvalidParameter
}
_, oaName, _, err := ReadObjectAttributes(ctx, objAttr)
if err != nil || oaName == "" {
return StatusObjectNameNotFound
}
name := strings.ToLower(oaName)
name = strings.ReplaceAll(name, "/", `\`)
target := ""
switch name {
case `\??\nulssectionptr`, `\??\nlssectionptr`:
target = `\Windows\System32\locale.nls`
case `\??\conin$`:
target = `\Device\ConDrv\Input`
case `\??\conout$`:
target = `\Device\ConDrv\Output`
case `\??\pipe\`, `\device\namedpipe`:
target = `\Device\NamedPipe`
case `\systemroot`:
target = `\Windows`
default:
return StatusObjectNameNotFound
}
h := ctx.Handles.Alloc(&SymbolicLinkHandle{Name: oaName, Target: target})
ctx.Mem.Write64(handlePtr, uint64(h))
return StatusSuccess
}
func handleNtQuerySymbolicLinkObject(ctx *TrapContext) uint32 {
linkHandle := Handle(ctx.Arg(0))
linkTarget := ctx.Arg(1) // PUNICODE_STRING
retLen := ctx.Arg(2) // PULONG
if linkTarget == 0 {
return StatusInvalidParameter
}
sl, ok := ctx.Handles.Get(linkHandle).(*SymbolicLinkHandle)
if !ok || sl == nil {
return StatusObjectTypeMismatch
}
ws := encodeUTF16LE(sl.Target)
maxLen, _ := ctx.Mem.Read16(linkTarget + 2) // MaximumLength
bufPtr, _ := ctx.Mem.Read64(linkTarget + 8) // Buffer
if retLen != 0 {
ctx.Mem.Write32(retLen, uint32(len(ws)))
}
if bufPtr == 0 {
return StatusInvalidParameter
}
if uint32(maxLen) < uint32(len(ws)) {
ctx.Mem.Write16(linkTarget+0, 0)
return StatusBufferTooSmall
}
ctx.Mem.Write16(linkTarget+0, uint16(len(ws)))
ctx.Mem.WriteBytes(bufPtr, ws)
if uint32(maxLen) >= uint32(len(ws)+2) {
ctx.Mem.Write16(bufPtr+uint64(len(ws)), 0)
}
return StatusSuccess
}
func handleNtSetSecurityObject(ctx *TrapContext) uint32 { return StatusSuccess }
func handleNtQuerySecurityObject(ctx *TrapContext) uint32 {
_ = Handle(ctx.Arg(0)) // handle
_ = ctx.Arg(1) // security info mask
secDesc := ctx.Arg(2) // buffer
length := uint32(ctx.Arg(3))
retLen := ctx.Arg(4)
const sdLen uint32 = 40 // SECURITY_DESCRIPTOR_RELATIVE minimal size
if retLen != 0 {
ctx.Mem.Write32(retLen, sdLen)
}
if secDesc == 0 {
return StatusInvalidParameter
}
if length < sdLen {
return StatusBufferTooSmall
}
// Absolute-like minimal descriptor compatible with our other SD helpers.
ctx.Mem.Write8(secDesc+0, 1) // Revision
ctx.Mem.Write8(secDesc+1, 0) // Sbz1
ctx.Mem.Write16(secDesc+2, 0) // Control (no owner/group/dacl)
ctx.Mem.Write64(secDesc+8, 0) // Owner
ctx.Mem.Write64(secDesc+16, 0)
ctx.Mem.Write64(secDesc+24, 0) // Group
ctx.Mem.Write64(secDesc+32, 0) // DACL pointer/offset
return StatusSuccess
}
func handleNtSetInformationObject(ctx *TrapContext) uint32 {
h := Handle(ctx.Arg(0))
infoClass := uint32(ctx.Arg(1))
info := ctx.Arg(2)
length := uint32(ctx.Arg(3))
if ctx.Handles.Get(h) == nil {
return StatusInvalidHandle
}
switch infoClass {
case 4: // ObjectHandleFlagInformation
if info == 0 || length < 2 {
return StatusInvalidParameter
}
inherit, _ := ctx.Mem.Read8(info)
protect, _ := ctx.Mem.Read8(info + 1)
var f uint8
if inherit != 0 {
f |= 1
}
if protect != 0 {
f |= 2
}
objectHandleFlags[h] = f
return StatusSuccess
default:
return StatusNotImplemented
}
}
func fileHandleCanLockNative(file *FileHandle) bool {
const (
genericRead = uint32(0x80000000)
genericWrite = uint32(0x40000000)
genericAll = uint32(0x10000000)
)
return file != nil && file.Access&(genericRead|genericWrite|genericAll) != 0
}
func handleNtLockFile(ctx *TrapContext) uint32 {
fileHandle := Handle(ctx.Arg(0))
eventHandle := Handle(ctx.Arg(1))
apcRoutine := ctx.Arg(2)
apcContext := ctx.Arg(3)
ioStatus := ctx.Arg(4)
byteOffset := ctx.Arg(5)
lengthAddr := ctx.Arg(6)
key := uint32(ctx.Arg(7))
failImmediately := ctx.Arg(8) != 0
exclusive := ctx.Arg(9) != 0
file := ctx.Handles.GetFile(fileHandle)
if file == nil {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidHandle, 0)
return StatusInvalidHandle
}
if !fileHandleCanLockNative(file) {
writeIOStatus(ctx.Mem, ioStatus, StatusAccessDenied, 0)
return StatusAccessDenied
}
ioStatusSize := uint64(16)
if ctx.Mem.Mode32 {
ioStatusSize = 8
}
if !validateGuestWrite(ctx.Mem, ioStatus, ioStatusSize) ||
byteOffset == 0 || lengthAddr == 0 ||
ctx.Mem.ValidateRange(byteOffset, 8, mmu.PermRead) != nil ||
ctx.Mem.ValidateRange(lengthAddr, 8, mmu.PermRead) != nil {
return StatusAccessViolation
}
var event *EventHandle
if eventHandle != 0 {
event = ctx.Handles.GetEvent(eventHandle)
if event == nil {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidHandle, 0)
return StatusInvalidHandle
}
}
identity, ok := ctx.FS.FileIdentity(file.FD)
if !ok {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidHandle, 0)
return StatusInvalidHandle
}
start, _ := ctx.Mem.Read64(byteOffset)
length, _ := ctx.Mem.Read64(lengthAddr)
if FileLocksFor(ctx.FS).LockKey(
identity,
file.LockOwner(),
start,
length,
key,
exclusive,
false,
) {
completeNativeIOInline(
ctx,
fileHandle,
file,
ioStatus,
event,
apcRoutine,
apcContext,
StatusSuccess,
0,
)
return StatusSuccess
}
if failImmediately {
writeIOStatus(ctx.Mem, ioStatus, StatusLockNotGranted, 0)
return StatusLockNotGranted
}
const fileFlagOverlapped = uint32(0x40000000)
if file.Flags&fileFlagOverlapped == 0 {
if !FileLocksFor(ctx.FS).LockKey(
identity,
file.LockOwner(),
start,
length,
key,
exclusive,
true,
) {
writeIOStatus(ctx.Mem, ioStatus, StatusCancelled, 0)
return StatusCancelled
}
completeNativeIOInline(
ctx,
fileHandle,
file,
ioStatus,
event,
apcRoutine,
apcContext,
StatusSuccess,
0,
)
return StatusSuccess
}
operation := beginNativeIO(
ctx,
fileHandle,
file,
ioStatus,
event,
apcRoutine,
apcContext,
)
owner := file.LockOwner()
manager := FileLocksFor(ctx.FS)
go func() {
if !manager.LockKeyCancelable(
identity,
owner,
start,
length,
key,
exclusive,
true,
operation.cancel,
) {
operation.complete(StatusCancelled, 0)
return
}
select {
case <-operation.cancel:
manager.UnlockKey(identity, owner, start, length, key)
operation.complete(StatusCancelled, 0)
default:
if !operation.complete(StatusSuccess, 0) {
manager.UnlockKey(identity, owner, start, length, key)
}
}
}()
return StatusPending
}
func handleNtUnlockFile(ctx *TrapContext) uint32 {
fileHandle := Handle(ctx.Arg(0))
ioStatus := ctx.Arg(1)
byteOffset := ctx.Arg(2)
lengthAddr := ctx.Arg(3)
file := ctx.Handles.GetFile(fileHandle)
if file == nil {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidHandle, 0)
return StatusInvalidHandle
}
if !fileHandleCanLockNative(file) {
writeIOStatus(ctx.Mem, ioStatus, StatusAccessDenied, 0)
return StatusAccessDenied
}
ioStatusSize := uint64(16)
if ctx.Mem.Mode32 {
ioStatusSize = 8
}
if !validateGuestWrite(ctx.Mem, ioStatus, ioStatusSize) ||
byteOffset == 0 || lengthAddr == 0 ||
ctx.Mem.ValidateRange(byteOffset, 8, mmu.PermRead) != nil ||
ctx.Mem.ValidateRange(lengthAddr, 8, mmu.PermRead) != nil {
return StatusAccessViolation
}
identity, ok := ctx.FS.FileIdentity(file.FD)
if !ok {
writeIOStatus(ctx.Mem, ioStatus, StatusInvalidHandle, 0)
return StatusInvalidHandle
}
start, _ := ctx.Mem.Read64(byteOffset)
length, _ := ctx.Mem.Read64(lengthAddr)
if !FileLocksFor(ctx.FS).UnlockKey(
identity,
file.LockOwner(),
start,
length,
uint32(ctx.Arg(4)),
) {
writeIOStatus(ctx.Mem, ioStatus, StatusRangeNotLocked, 0)
return StatusRangeNotLocked
}
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, 0)
return StatusSuccess
}
func handleNtCreateMailslotFile(ctx *TrapContext) uint32 {
// NtCreateMailslotFile(FileHandle*, DesiredAccess, ObjectAttributes*, IoStatusBlock*,
// CreateOptions, MailslotQuota, MaximumMessageSize, ReadTimeout*)
handlePtr := ctx.Arg(0)
objAttr := ctx.Arg(2)
ioStatus := ctx.Arg(3)
maxMsg := uint32(ctx.Arg(6))
readTimeoutPtr := ctx.Arg(7)
name := ""
if objAttr != 0 {
_, oaName, _, err := ReadObjectAttributes(ctx, objAttr)
if err == nil {
name = NormalizeObjectName(oaName)
}
}
if name == "" {
name = fmt.Sprintf(`\Device\Mailslot\mailslot-%d`, time.Now().UnixNano())
}
if maxMsg == 0 {
maxMsg = 4096
}
var readTimeout uint32
if readTimeoutPtr != 0 {
if rt, err := ctx.Mem.Read64(readTimeoutPtr); err == nil {
if int64(rt) < 0 {
// Negative values are relative timeout in 100ns units.
readTimeout = uint32((-int64(rt)) / 10000) // to ms
}
}
}
m := NewMailslot(name, maxMsg, readTimeout)
RegisterMailslot(name, m)
h := ctx.Handles.Alloc(m)
if handlePtr != 0 {
ctx.Mem.Write64(handlePtr, uint64(h))
}
writeIOStatus(ctx.Mem, ioStatus, StatusSuccess, 0)
return StatusSuccess
}
func handleNtCreateNamedPipeFile(ctx *TrapContext) uint32 {
handlePtr := ctx.Arg(0)
objAttr := ctx.Arg(2)
var name string
if objAttr != 0 {
_, oaName, _, err := ReadObjectAttributes(ctx, objAttr)
if err == nil {
name = NormalizeObjectName(oaName)
}
}
if name == "" {
name = fmt.Sprintf("pipe-%d", time.Now().UnixNano())
}
pipe := NewServerPipe(name)
RegisterNamedPipe(name, pipe)
h, _ := ctx.Handles.AllocNamed(name, pipe)
if handlePtr != 0 {
ctx.Mem.Write64(handlePtr, uint64(h))
}
return StatusSuccess
}
// signalEventHandle signals a guest event handle if non-zero.
func signalEventHandle(ctx *TrapContext, handle uint64) {
if handle == 0 {
return
}
if eh, ok := ctx.Handles.Get(Handle(handle)).(*EventHandle); ok {
eh.Set()
}
}
func handleNtFsControlFile(ctx *TrapContext) uint32 {
fileHandle := Handle(ctx.Arg(0))
eventHandle := ctx.Arg(1)
_ = ctx.Arg(2) // ApcRoutine
_ = ctx.Arg(3) // ApcContext
ioStatus := ctx.Arg(4)
fsctlCode := uint32(ctx.Arg(5))
_ = ctx.Arg(6) // InputBuffer
_ = ctx.Arg(7) // InputBufferLength
outputBuf := ctx.Arg(8)
outputLen := uint32(ctx.Arg(9))
if ctx.Trace {
fmt.Printf(" NtFsControlFile: fsctl=0x%08x outLen=%d\n", fsctlCode, outputLen)
}
var status uint32 = StatusSuccess
var info uint64
pipe := ctx.Handles.GetNamedPipe(fileHandle)
switch fsctlCode {
case 0x00110000, 0x00110004, 0x00110008, 0x00110010, 0x00110018:
// PIPE_ASSIGN_EVENT / DISCONNECT / LISTEN / QUERY_EVENT / WAIT
if pipe == nil {
status = StatusInvalidHandle
break
}
if fsctlCode == 0x00110018 && outputBuf != 0 && outputLen >= 16 {
avail := uint32(pipe.AvailableBytes())
ctx.Mem.Write32(outputBuf, 0) // pipe state
ctx.Mem.Write32(outputBuf+4, avail) // bytes available
ctx.Mem.Write32(outputBuf+8, 0) // number of messages
ctx.Mem.Write32(outputBuf+12, avail) // message length
info = 16
}
case 0x0011000C: // PIPE_PEEK
if pipe == nil {
status = StatusInvalidHandle
break
}
if outputBuf != 0 && outputLen >= 16 {
avail := uint32(pipe.AvailableBytes())
ctx.Mem.Write32(outputBuf, 0)
ctx.Mem.Write32(outputBuf+4, avail)
ctx.Mem.Write32(outputBuf+8, 0)
ctx.Mem.Write32(outputBuf+12, avail)
info = 16
}
case 0x00110014: // PIPE_TRANSCEIVE
if pipe == nil {
status = StatusInvalidHandle
break
}
inputBuf := ctx.Arg(6)
inputLen := uint32(ctx.Arg(7))
if inputBuf != 0 && inputLen > 0 {
if data, err := ctx.Mem.ReadBytes(inputBuf, int(inputLen)); err == nil {
_ = pipe.PipeWrite(data)
}
}
if outputBuf != 0 && outputLen > 0 {
buf := make([]byte, outputLen)
n := pipe.PipeRead(buf)
if n > 0 {
ctx.Mem.WriteBytes(outputBuf, buf[:n])
}
info = uint64(n)
}
case 0x0009009C: // FSCTL_GET_COMPRESSION
if outputBuf != 0 && outputLen >= 2 {
ctx.Mem.Write16(outputBuf, 0) // COMPRESSION_FORMAT_NONE
info = 2
}
case 0x000900A8: // FSCTL_GET_REPARSE_POINT
status = 0xC0000275 // STATUS_NOT_A_REPARSE_POINT
case 0x004D0008: // FSCTL_GET_NTFS_VOLUME_DATA
status = 0xC0000010 // STATUS_INVALID_DEVICE_REQUEST
case 0x00090028: // FSCTL_SET_COMPRESSION
// Accept silently
case 0x000900C0: // FSCTL_SET_SPARSE
// Accept silently
default:
status = 0xC0000010 // STATUS_INVALID_DEVICE_REQUEST
if ctx.Trace {
fmt.Printf(" NtFsControlFile: unknown FSCTL 0x%08x\n", fsctlCode)
}
}
writeIOStatus(ctx.Mem, ioStatus, status, info)
signalEventHandle(ctx, eventHandle)
return status
}
func handleNtPowerInformation(ctx *TrapContext) uint32 {
infoLevel := uint32(ctx.Arg(0))
_ = ctx.Arg(1) // input buffer
_ = uint32(ctx.Arg(2))
outBuf := ctx.Arg(3)
outLen := uint32(ctx.Arg(4))
switch infoLevel {
case 0: // SystemPowerPolicyAc (best-effort, opaque)
if outBuf != 0 && outLen >= 4 {
ctx.Mem.Write32(outBuf, 0)
}
return StatusSuccess
case 4: // SystemPowerCapabilities
// Caller often expects a non-zeroed structure and success.
if outBuf == 0 || outLen < 64 {
return StatusBufferTooSmall
}
for i := uint32(0); i < outLen && i < 64; i++ {
ctx.Mem.Write8(outBuf+uint64(i), 0)
}
ctx.Mem.Write8(outBuf+0, 1) // PowerButtonPresent
ctx.Mem.Write8(outBuf+1, 1) // SleepButtonPresent
ctx.Mem.Write8(outBuf+2, 1) // LidPresent
ctx.Mem.Write8(outBuf+8, 1) // SystemS1
ctx.Mem.Write8(outBuf+9, 1) // SystemS2
ctx.Mem.Write8(outBuf+10, 1) // SystemS3
return StatusSuccess
case 11: // SystemExecutionState
if outBuf != 0 && outLen >= 4 {
ctx.Mem.Write32(outBuf, 0)
}
return StatusSuccess
case 12: // SystemPowerInformation
if outBuf == 0 || outLen < 24 {
return StatusBufferTooSmall
}
ctx.Mem.Write32(outBuf+0, 1) // MaxIdlenessAllowed
ctx.Mem.Write32(outBuf+4, 1) // Idleness
ctx.Mem.Write32(outBuf+8, 0) // TimeRemaining
ctx.Mem.Write8(outBuf+12, 1) // CoolingMode
return StatusSuccess
case 5: // SystemBatteryState
if outBuf == 0 || outLen < 32 {
return StatusBufferTooSmall
}
for i := uint32(0); i < 32; i++ {
ctx.Mem.Write8(outBuf+uint64(i), 0)
}
// AC online, no battery present (desktop-like behavior)
ctx.Mem.Write8(outBuf+0, 1) // AcOnLine
return StatusSuccess
case 20: // ProcessorInformation
if outBuf == 0 || outLen < 24 {
return StatusBufferTooSmall
}
// Minimal 1-processor entry
ctx.Mem.Write32(outBuf+0, 0) // Number
ctx.Mem.Write32(outBuf+4, 60) // MaxMhz
ctx.Mem.Write32(outBuf+8, 35) // CurrentMhz
ctx.Mem.Write32(outBuf+12, 100) // MhzLimit
ctx.Mem.Write32(outBuf+16, 0) // MaxIdleState
ctx.Mem.Write32(outBuf+20, 0) // CurrentIdleState
return StatusSuccess
default:
return StatusNotImplemented
}
}
func handleNtQueueApcThread(ctx *TrapContext) uint32 { return StatusSuccess }
func handleNtGetNlsSectionPtr(ctx *TrapContext) uint32 {
nlsType := ctx.Arg(0)
nlsID := ctx.Arg(1)
ptrOut := ctx.Arg(3)
sizeOut := ctx.Arg(4)
ravelog.Logf("[ntapi] NtGetNlsSectionPtr type=%d id=%d ptrOut=0x%x sizeOut=0x%x\n",
nlsType, nlsID, ptrOut, sizeOut)
if ctx.Disp == nil || ctx.Disp.sysRoot == "" {
return StatusNotImplemented
}
var data []byte
var err error
switch nlsType {
case 11: // NLS_SECTION_CODEPAGE - c_XXXX.nls
data, err = ctx.Disp.loadNlsFile(uint32(nlsID))
case 9: // NLS_SECTION_SORTKEYS - build minimal valid sort key table
data = BuildSortKeyData()
err = nil
case 12: // NLS_SECTION_NORMALIZE - normNFC/NFD/NFKC/NFKD/IDNA
nameMap := map[uint64]string{
1: "normnfc.nls", 2: "normnfd.nls",
5: "normnfkc.nls", 6: "normnfkd.nls",
13: "normidna.nls",
}
if fname, ok := nameMap[nlsID]; ok {
path := ctx.Disp.sysRoot + "/" + fname
data, err = os.ReadFile(path)
} else {
return StatusNotImplemented
}
default:
return StatusNotImplemented
}
if err != nil {
ravelog.Logf("[ntapi] NtGetNlsSectionPtr: failed to load NLS type=%d id=%d: %v\n", nlsType, nlsID, err)
return StatusNotImplemented
}
// Map the NLS data into guest memory with a page of padding before
// the data so that Wine's negative-offset accesses (ptr[-n]) work.
size := uint64(len(data))
pad := uint64(mmu.PageSize)
allocSize := (size + pad + mmu.PageSize - 1) & mmu.PageMask
base := ctx.Mem.Mmap(0, allocSize, mmu.PermRead|mmu.PermWrite)
dataAddr := base + pad
ctx.Mem.WriteBytes(dataAddr, data)
if ptrOut != 0 {
ctx.Mem.Write64(ptrOut, dataAddr)
}
if sizeOut != 0 {
ctx.Mem.Write64(sizeOut, size)
}
ravelog.Logf("[ntapi] NtGetNlsSectionPtr: mapped type=%d id=%d at 0x%x size=0x%x\n", nlsType, nlsID, dataAddr, size)
return StatusSuccess
}
func handleRtlGetLocaleFileMappingAddress(ctx *TrapContext) uint32 {
// NTSTATUS RtlGetLocaleFileMappingAddress(
// PVOID *BaseAddress, // RCX - OUT
// PULONG DefaultLocaleId, // RDX - OUT (LCID)
// PLARGE_INTEGER DefaultCasingTableSize // R8 - OUT
// )
baseAddrPtr := ctx.Arg(0)
localeIdPtr := ctx.Arg(1)
casingSizePtr := ctx.Arg(2)
// Load locale.nls from sysroot (Wine uses locale.nls, not l_intl.nls)
var data []byte
if ctx.Disp != nil && ctx.Disp.sysRoot != "" {
path := ctx.Disp.sysRoot + "/locale.nls"
if d, err := os.ReadFile(path); err == nil {
data = d
}
}
if data == nil {
// Minimal locale data: just a zeroed page
data = make([]byte, 4096)
}
// Allocate with one extra page of padding before the data so that
// small negative offsets from the returned pointer read valid memory
// (Wine's kernelbase accesses ptr[-n] for header fields).
pad := mmu.PageSize
size := (uint64(len(data)) + uint64(pad) + mmu.PageSize - 1) & mmu.PageMask
base := ctx.Mem.Mmap(0, size, mmu.PermRead|mmu.PermWrite)
dataAddr := base + uint64(pad)
ctx.Mem.WriteBytes(dataAddr, data)
ravelog.Logf("[ntapi] RtlGetLocaleFileMappingAddress: mapped locale.nls at 0x%x size=0x%x\n", dataAddr, len(data))
if baseAddrPtr != 0 {
ctx.Mem.Write64(baseAddrPtr, dataAddr)
}
if localeIdPtr != 0 {
ctx.Mem.Write32(localeIdPtr, 0x0409) // en-US
}
if casingSizePtr != 0 {
ctx.Mem.Write64(casingSizePtr, uint64(len(data)))
}
return StatusSuccess
}
func handleRtlGetProductInfo(ctx *TrapContext) uint32 {
retPtr := ctx.Arg(4)
if retPtr != 0 {
ctx.Mem.Write32(retPtr, 0x65) // PRODUCT_CORE = Windows 10 Home
}
ctx.SetReturn(1) // TRUE
return StatusSuccess
}
func handleRtlGetSystemPreferredUILanguages(ctx *TrapContext) uint32 {
numLangs := ctx.Arg(1)
buf := ctx.Arg(2)
bufLen := ctx.Arg(3)
if numLangs != 0 {
ctx.Mem.Write32(numLangs, 1)
}
if buf != 0 && bufLen != 0 {
lang := "en-US"
maxLen, _ := ctx.Mem.Read32(bufLen)
if maxLen >= uint32((len(lang)+2)*2) {
for i, ch := range lang {
ctx.Mem.Write16(buf+uint64(i)*2, uint16(ch))
}
ctx.Mem.Write16(buf+uint64(len(lang))*2, 0)
ctx.Mem.Write16(buf+uint64(len(lang)+1)*2, 0)
}
ctx.Mem.Write32(bufLen, uint32((len(lang)+2)*2))
}
return StatusSuccess
}
func handleRtlGetUserPreferredUILanguages(ctx *TrapContext) uint32 {
return handleRtlGetSystemPreferredUILanguages(ctx)
}
func handleRtlGetProcessPreferredUILanguages(ctx *TrapContext) uint32 {
return handleRtlGetSystemPreferredUILanguages(ctx)
}
func handleRtlGetThreadPreferredUILanguages(ctx *TrapContext) uint32 {
return handleRtlGetSystemPreferredUILanguages(ctx)
}
func handleRtlGetSystemTimePrecise(ctx *TrapContext) uint32 {
// Returns 100ns intervals since 1601-01-01
now := time.Now()
epoch := time.Date(1601, 1, 1, 0, 0, 0, 0, time.UTC)
intervals := now.Sub(epoch).Nanoseconds() / 100
ctx.SetReturn(uint64(intervals))
return StatusSuccess
}
func handleRtlTimeFieldsToTime(ctx *TrapContext) uint32 {
// RtlTimeFieldsToTime(TIME_FIELDS* tf, LARGE_INTEGER* time)
tf := ctx.Arg(0)
out := ctx.Arg(1)
if tf == 0 || out == 0 {
ctx.SetReturn(0)
return StatusSuccess
}
yr, _ := ctx.Mem.Read16(tf + 0)
mo, _ := ctx.Mem.Read16(tf + 2)
dy, _ := ctx.Mem.Read16(tf + 4)
hr, _ := ctx.Mem.Read16(tf + 6)
mi, _ := ctx.Mem.Read16(tf + 8)
se, _ := ctx.Mem.Read16(tf + 10)
ms, _ := ctx.Mem.Read16(tf + 12)
t := time.Date(int(yr), time.Month(mo), int(dy), int(hr), int(mi), int(se), int(ms)*1e6, time.UTC)
ft := uint64(t.UnixNano()/100 + 116444736000000000)
ctx.Mem.Write64(out, ft)
ctx.SetReturn(1) // TRUE
return StatusSuccess
}
func handleRtlTimeToTimeFields(ctx *TrapContext) uint32 {
// RtlTimeToTimeFields(LARGE_INTEGER* time, TIME_FIELDS* tf)
timePtr := ctx.Arg(0)
tf := ctx.Arg(1)
if timePtr == 0 || tf == 0 {
return StatusSuccess
}
ft, _ := ctx.Mem.Read64(timePtr)
ns := (int64(ft) - 116444736000000000) * 100
t := time.Unix(0, ns).UTC()
ctx.Mem.Write16(tf+0, uint16(t.Year()))
ctx.Mem.Write16(tf+2, uint16(t.Month()))
ctx.Mem.Write16(tf+4, uint16(t.Day()))
ctx.Mem.Write16(tf+6, uint16(t.Hour()))
ctx.Mem.Write16(tf+8, uint16(t.Minute()))
ctx.Mem.Write16(tf+10, uint16(t.Second()))
ctx.Mem.Write16(tf+12, uint16(t.Nanosecond()/1e6))
ctx.Mem.Write16(tf+14, uint16(t.Weekday()))
return StatusSuccess
}
func handleRtlQueryUnbiasedInterruptTime(ctx *TrapContext) uint32 {
ptr := ctx.Arg(0)
if ptr != 0 {
ctx.Mem.Write64(ptr, uint64(time.Now().UnixNano()/100))
}
return StatusSuccess
}
func handleNtSetInformationToken(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlCreateSecurityDescriptor(ctx *TrapContext) uint32 {
sd := ctx.Arg(0)
if sd != 0 {
for i := uint64(0); i < 40; i++ {
ctx.Mem.Write8(sd+i, 0)
}
ctx.Mem.Write8(sd, 1) // Revision
ctx.Mem.Write16(sd+2, 0) // Control
}
return StatusSuccess
}
func handleRtlSetDaclSecurityDescriptor(ctx *TrapContext) uint32 {
sd := ctx.Arg(0)
present := ctx.Arg(1) != 0
dacl := ctx.Arg(2)
defaulted := ctx.Arg(3) != 0
if sd != 0 {
control, _ := ctx.Mem.Read16(sd + 2)
control &^= 0x0004 | 0x0008
if present {
control |= 0x0004
ctx.Mem.Write64(sd+28, dacl)
} else {
ctx.Mem.Write64(sd+28, 0)
}
if defaulted {
control |= 0x0008
}
ctx.Mem.Write16(sd+2, control)
}
return StatusSuccess
}
func handleRtlGetDaclSecurityDescriptor(ctx *TrapContext) uint32 {
sd := ctx.Arg(0)
pbPresent := ctx.Arg(1)
ppDacl := ctx.Arg(2)
pbDefaulted := ctx.Arg(3)
if pbPresent != 0 {
present := uint32(0)
if sd != 0 {
control, _ := ctx.Mem.Read16(sd + 2)
if control&0x0004 != 0 {
present = 1
}
}
ctx.Mem.Write32(pbPresent, present)
}
if ppDacl != 0 {
var dacl uint64
if sd != 0 {
dacl, _ = ctx.Mem.Read64(sd + 28)
}
ctx.Mem.Write64(ppDacl, dacl)
}
if pbDefaulted != 0 {
defaulted := uint32(0)
if sd != 0 {
control, _ := ctx.Mem.Read16(sd + 2)
if control&0x0008 != 0 {
defaulted = 1
}
}
ctx.Mem.Write32(pbDefaulted, defaulted)
}
return StatusSuccess
}
func handleRtlCreateAcl(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlAddAccessAllowedAce(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlAddAccessAllowedAceEx(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlAllocateAndInitializeSid(ctx *TrapContext) uint32 {
sidPtr := ctx.Arg(0)
if sidPtr != 0 {
sid := ctx.Mem.Mmap(0, 28, mmu.PermRead|mmu.PermWrite)
ctx.Mem.Write8(sid, 1) // Revision
ctx.Mem.Write8(sid+1, 1) // SubAuthorityCount
ctx.Mem.Write64(sidPtr, sid)
}
return StatusSuccess
}
func handleRtlFreeSid(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlCopySid(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlEqualSid(ctx *TrapContext) uint32 {
ctx.SetReturn(1) // TRUE
return StatusSuccess
}
func handleRtlLengthSid(ctx *TrapContext) uint32 {
ctx.SetReturn(12)
return StatusSuccess
}
func handleRtlInitializeSid(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlValidSid(ctx *TrapContext) uint32 {
ctx.SetReturn(1) // TRUE
return StatusSuccess
}
func handleRtlSubAuthorityCountSid(ctx *TrapContext) uint32 {
sid := ctx.Arg(0)
if sid != 0 {
ctx.SetReturn(sid + 1) // pointer to SubAuthorityCount byte
}
return StatusSuccess
}
func handleRtlSubAuthoritySid(ctx *TrapContext) uint32 {
sid := ctx.Arg(0)
idx := ctx.Arg(1)
if sid != 0 {
ctx.SetReturn(sid + 8 + idx*4)
}
return StatusSuccess
}
func handleRtlIdentifierAuthoritySid(ctx *TrapContext) uint32 {
sid := ctx.Arg(0)
if sid != 0 {
ctx.SetReturn(sid + 2) // pointer to IdentifierAuthority
}
return StatusSuccess
}
func handleNtPrivilegeCheck(ctx *TrapContext) uint32 {
result := ctx.Arg(2)
if result != 0 {
ctx.Mem.Write8(result, 1) // privileges held
}
return StatusSuccess
}
func handleNtAdjustPrivilegesToken(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlQueryActivationContextApplicationSettings(ctx *TrapContext) uint32 {
return 0xC015000F // STATUS_SXS_KEY_NOT_FOUND
}
func handleRtlFindActivationContextSectionString(ctx *TrapContext) uint32 {
return 0xC000008B // STATUS_SXS_SECTION_NOT_FOUND
}
func handleRtlFindActivationContextSectionGuid(ctx *TrapContext) uint32 {
return 0xC000008B
}
func handleRtlActivateActivationContext(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlDeactivateActivationContext(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlGetActiveActivationContext(ctx *TrapContext) uint32 {
cookie := ctx.Arg(0)
if cookie != 0 {
ctx.Mem.Write64(cookie, 0)
}
return StatusSuccess
}
func handleRtlAddRefActivationContext(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlReleaseActivationContext(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlCreateActivationContext(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlZombifyActivationContext(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlFreeActivationContextStack(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlQueryInformationActivationContext(ctx *TrapContext) uint32 {
// RtlQueryInformationActivationContext(Flags, ActCtx, SubInst, Class, Buffer, BufSize, RetLen)
_ = ctx.Arg(0) // flags
_ = ctx.Arg(1) // activation context handle
_ = ctx.Arg(2) // sub instance index
infoClass := uint32(ctx.Arg(3))
buf := ctx.Arg(4)
bufSize := uint32(ctx.Arg(5))
retLen := ctx.Arg(6)
var needed uint32
switch infoClass {
case 1: // ActivationContextBasicInformation
needed = 16
case 2: // ActivationContextDetailedInformation
needed = 32
default:
return StatusNotImplemented
}
if retLen != 0 {
ctx.Mem.Write32(retLen, needed)
}
if buf == 0 || bufSize < needed {
return StatusBufferTooSmall
}
for i := uint32(0); i < needed; i++ {
ctx.Mem.Write8(buf+uint64(i), 0)
}
return StatusSuccess
}
func handleRtlQueueWorkItem(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlCreateTimer(ctx *TrapContext) uint32 {
timerPtr := ctx.Arg(1)
if timerPtr != 0 {
h := ctx.Handles.Alloc(&GenericHandle{Kind: "RtlTimer"})
ctx.Mem.Write64(timerPtr, uint64(h))
}
return StatusSuccess
}
func handleRtlDeleteTimer(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlUpdateTimer(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlCreateTimerQueue(ctx *TrapContext) uint32 {
queuePtr := ctx.Arg(0)
if queuePtr != 0 {
h := ctx.Handles.Alloc(&GenericHandle{Kind: "TimerQueue"})
ctx.Mem.Write64(queuePtr, uint64(h))
}
return StatusSuccess
}
func handleRtlDeleteTimerQueueEx(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlRegisterWait(ctx *TrapContext) uint32 {
waitPtr := ctx.Arg(0)
if waitPtr != 0 {
h := ctx.Handles.Alloc(&GenericHandle{Kind: "Wait"})
ctx.Mem.Write64(waitPtr, uint64(h))
}
return StatusSuccess
}
func handleRtlDeregisterWait(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlDeregisterWaitEx(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlSetIoCompletionCallback(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlGUIDFromString(ctx *TrapContext) uint32 {
return StatusSuccess
}
func handleRtlFindMessage(ctx *TrapContext) uint32 {
// RtlFindMessage(Base, Type, LangId, MsgId, MessageEntry**)
_ = ctx.Arg(0)
_ = ctx.Arg(1)
_ = ctx.Arg(2)
_ = ctx.Arg(3)
entryOut := ctx.Arg(4)
if entryOut == 0 {
return StatusInvalidParameter
}
// MESSAGE_RESOURCE_ENTRY: Length(2), Flags(2), Text[]
msg := []byte("stub message\x00")
entry := ctx.Mem.Mmap(0, uint64(4+len(msg)), mmu.PermRead|mmu.PermWrite)
ctx.Mem.Write16(entry+0, uint16(4+len(msg)))
ctx.Mem.Write16(entry+2, 0) // ANSI
ctx.Mem.WriteBytes(entry+4, msg)
ctx.Mem.Write64(entryOut, entry)
return StatusSuccess
}
func handleRtlFormatMessage(ctx *TrapContext) uint32 {
// Best-effort formatter: copy source WCHAR string to destination.
src := ctx.Arg(0) // PWSTR source
_ = ctx.Arg(1) // width
_ = ctx.Arg(2) // ignore inserts
_ = ctx.Arg(3) // arguments
dst := ctx.Arg(4) // PWSTR destination
dstBytes := uint32(ctx.Arg(5))
retLen := ctx.Arg(6)
if src == 0 || dst == 0 || dstBytes < 2 {
return StatusInvalidParameter
}
text := readGuestStringUTF16(ctx.Mem, src, 4096)
if text == "" {
ctx.Mem.Write16(dst, 0)
if retLen != 0 {
ctx.Mem.Write32(retLen, 0)
}
return StatusSuccess
}
utf16b := encodeUTF16LE(text)
maxCopy := int(dstBytes - 2)
if maxCopy < 0 {
maxCopy = 0
}
if len(utf16b) > maxCopy {
utf16b = utf16b[:maxCopy]
}
ctx.Mem.WriteBytes(dst, utf16b)
ctx.Mem.Write16(dst+uint64(len(utf16b)), 0)
if retLen != 0 {
ctx.Mem.Write32(retLen, uint32(len(utf16b)))
}
return StatusSuccess
}
func minUint32(a, b uint32) uint32 {
if a < b {
return a
}
return b
}
func handleRtlUTF8ToUnicodeN(ctx *TrapContext) uint32 {
dst := ctx.Arg(0)
dstMax := uint32(ctx.Arg(1))
resultLenPtr := ctx.Arg(2)
src := ctx.Arg(3)
srcLen := uint32(ctx.Arg(4))
written := uint32(0)
i := uint32(0)
for i < srcLen && written+2 <= dstMax {
b, err := ctx.Mem.Read8(src + uint64(i))
if err != nil {
break
}
if b < 0x80 {
if dst != 0 {
ctx.Mem.Write16(dst+uint64(written), uint16(b))
}
written += 2
i++
} else if b < 0xE0 && i+1 < srcLen {
b2, _ := ctx.Mem.Read8(src + uint64(i+1))
ch := uint16(b&0x1F)<<6 | uint16(b2&0x3F)
if dst != 0 {
ctx.Mem.Write16(dst+uint64(written), ch)
}
written += 2
i += 2
} else if b < 0xF0 && i+2 < srcLen {
b2, _ := ctx.Mem.Read8(src + uint64(i+1))
b3, _ := ctx.Mem.Read8(src + uint64(i+2))
ch := uint16(b&0x0F)<<12 | uint16(b2&0x3F)<<6 | uint16(b3&0x3F)
if dst != 0 {
ctx.Mem.Write16(dst+uint64(written), ch)
}
written += 2
i += 3
} else {
if dst != 0 {
ctx.Mem.Write16(dst+uint64(written), '?')
}
written += 2
i++
}
}
if resultLenPtr != 0 {
ctx.Mem.Write32(resultLenPtr, written)
}
return StatusSuccess
}
func handleRtlUnicodeToUTF8N(ctx *TrapContext) uint32 {
dst := ctx.Arg(0)
dstMax := uint32(ctx.Arg(1))
resultLenPtr := ctx.Arg(2)
src := ctx.Arg(3)
srcLen := uint32(ctx.Arg(4))
written := uint32(0)
for i := uint32(0); i+2 <= srcLen && written < dstMax; i += 2 {
ch, _ := ctx.Mem.Read16(src + uint64(i))
if ch < 0x80 {
if dst != 0 {
ctx.Mem.Write8(dst+uint64(written), uint8(ch))
}
written++
} else if ch < 0x800 {
if written+2 > dstMax {
break
}
if dst != 0 {
ctx.Mem.Write8(dst+uint64(written), uint8(0xC0|(ch>>6)))
ctx.Mem.Write8(dst+uint64(written+1), uint8(0x80|(ch&0x3F)))
}
written += 2
} else {
if written+3 > dstMax {
break
}
if dst != 0 {
ctx.Mem.Write8(dst+uint64(written), uint8(0xE0|(ch>>12)))
ctx.Mem.Write8(dst+uint64(written+1), uint8(0x80|((ch>>6)&0x3F)))
ctx.Mem.Write8(dst+uint64(written+2), uint8(0x80|(ch&0x3F)))
}
written += 3
}
}
if resultLenPtr != 0 {
ctx.Mem.Write32(resultLenPtr, written)
}
return StatusSuccess
}
func handleRtlIsNormalizedString(ctx *TrapContext) uint32 {
resultPtr := ctx.Arg(2)
if resultPtr != 0 {
ctx.Mem.Write8(resultPtr, 1) // already normalized
}
return StatusSuccess
}
func handleRtlNormalizeString(ctx *TrapContext) uint32 {
return StatusSuccess
}
func handleRtlSleepConditionVariableCS(ctx *TrapContext) uint32 {
return StatusSuccess
}
func handleRtlSleepConditionVariableSRW(ctx *TrapContext) uint32 {
return StatusSuccess
}
func handleRtlWaitOnAddress(ctx *TrapContext) uint32 {
return StatusSuccess
}
func handleDbgBreakPoint(ctx *TrapContext) uint32 {
return StatusSuccess // ignore breakpoints
}
func handleNtNotifyChangeKey(ctx *TrapContext) uint32 { return StatusSuccess }
func handleNtNotifyChangeDirectoryFile(ctx *TrapContext) uint32 { return StatusSuccess }
// Etw stubs
func handleEtwEventRegister(ctx *TrapContext) uint32 { return StatusSuccess }
func handleEtwEventUnregister(ctx *TrapContext) uint32 { return StatusSuccess }
func handleEtwEventWrite(ctx *TrapContext) uint32 { return StatusSuccess }
func handleEtwEventEnabled(ctx *TrapContext) uint32 {
ctx.SetReturn(0) // not enabled
return StatusSuccess
}
func handleNtQueryFullAttributesFile(ctx *TrapContext) uint32 {
return 0xC0000034 // STATUS_OBJECT_NAME_NOT_FOUND
}
func handleNtCompareObjects(ctx *TrapContext) uint32 {
h1 := ctx.Arg(0)
h2 := ctx.Arg(1)
if h1 == h2 {
return StatusSuccess
}
return StatusNotImplemented
}
func handleNtSetSystemInformation(ctx *TrapContext) uint32 { return StatusSuccess }
func handleNtSetSystemTime(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlWow64EnableFsRedirection(ctx *TrapContext) uint32 { return StatusSuccess }
func handleRtlWow64EnableFsRedirectionEx(ctx *TrapContext) uint32 { return StatusSuccess }
// handleLdrDisableThreadCalloutsForDll disables DLL_THREAD_ATTACH/DETACH notifications.
func handleLdrDisableThreadCalloutsForDll(ctx *TrapContext) uint32 {
ctx.SetReturn(0) // STATUS_SUCCESS
return StatusSuccess
}
// handleLdrFindResource_U navigates the PE resource directory tree.
// LdrFindResource_U(HMODULE hModule, LDR_RESOURCE_INFO *info, ULONG level, IMAGE_RESOURCE_DATA_ENTRY **entry)
func handleLdrFindResource_U(ctx *TrapContext) uint32 {
hModule := ctx.Arg(0) // module base address
infoPtr := ctx.Arg(1) // LDR_RESOURCE_INFO*
level := ctx.Arg(2) // number of levels (typically 3)
entryPtr := ctx.Arg(3) // output IMAGE_RESOURCE_DATA_ENTRY**
if hModule == 0 || entryPtr == 0 {
return 0xC0000135 // STATUS_DLL_NOT_FOUND
}
// Read resource directory RVA from PE headers in guest memory
rsrcRVA, rsrcSize := peResourceDir(ctx.Mem, hModule)
if rsrcRVA == 0 || rsrcSize == 0 {
return 0xC0000135 // STATUS_RESOURCE_TYPE_NOT_FOUND
}
rsrcBase := hModule + uint64(rsrcRVA)
// LDR_RESOURCE_INFO: Type (+0), Name (+8), Language (+16) - all ULONG_PTR (8 bytes on x64)
var resType, resName, resLang uint64
if infoPtr != 0 {
resType, _ = ctx.Mem.Read64(infoPtr)
if level >= 2 {
resName, _ = ctx.Mem.Read64(infoPtr + 8)
}
if level >= 3 {
resLang, _ = ctx.Mem.Read64(infoPtr + 16)
}
}
// Navigate resource directory tree
dirAddr := rsrcBase
// Level 1: find type
if level >= 1 {
found, isDir := findResourceEntry(ctx.Mem, dirAddr, rsrcBase, uint32(resType))
if found == 0 {
return 0xC0000135 // STATUS_RESOURCE_TYPE_NOT_FOUND
}
if !isDir {
// Leaf at level 1 - unlikely but handle it
ctx.Mem.Write64(entryPtr, found)
return StatusSuccess
}
dirAddr = found
}
// Level 2: find name/ID
if level >= 2 {
found, isDir := findResourceEntry(ctx.Mem, dirAddr, rsrcBase, uint32(resName))
if found == 0 {
// If name lookup fails and name is a string pointer, try first entry
found, isDir = findResourceFirstEntry(ctx.Mem, dirAddr, rsrcBase)
if found == 0 {
return 0xC0000089 // STATUS_RESOURCE_NAME_NOT_FOUND
}
}
if !isDir {
ctx.Mem.Write64(entryPtr, found)
return StatusSuccess
}
dirAddr = found
}
// Level 3: find language (pick best match or first)
if level >= 3 {
var found uint64
if resLang != 0 {
found, _ = findResourceEntry(ctx.Mem, dirAddr, rsrcBase, uint32(resLang))
}
if found == 0 {
// Try neutral (0x0000) or English
found = pickBestResourceLang(ctx.Mem, dirAddr, rsrcBase)
}
if found == 0 {
return 0xC000008A // STATUS_RESOURCE_LANG_NOT_FOUND
}
ctx.Mem.Write64(entryPtr, found)
return StatusSuccess
}
return 0xC000008A
}
// handleLdrAccessResource returns the address and size of a resource data entry.
// LdrAccessResource(HMODULE hModule, IMAGE_RESOURCE_DATA_ENTRY *entry, void **ptr, ULONG *size)
func handleLdrAccessResource(ctx *TrapContext) uint32 {
hModule := ctx.Arg(0)
entryAddr := ctx.Arg(1)
ptrOut := ctx.Arg(2)
sizeOut := ctx.Arg(3)
if hModule == 0 || entryAddr == 0 {
return 0xC0000135
}
// IMAGE_RESOURCE_DATA_ENTRY: OffsetToData(4), Size(4), CodePage(4), Reserved(4)
dataRVA, _ := ctx.Mem.Read32(entryAddr)
dataSize, _ := ctx.Mem.Read32(entryAddr + 4)
dataAddr := hModule + uint64(dataRVA)
if ptrOut != 0 {
ctx.Mem.Write64(ptrOut, dataAddr)
}
if sizeOut != 0 {
ctx.Mem.Write32(sizeOut, dataSize)
}
return StatusSuccess
}
// peResourceDir reads the resource directory RVA and size from PE headers in guest memory.
func peResourceDir(mem *mmu.MMU, baseAddr uint64) (rva, size uint32) {
// Check MZ signature
mz, _ := mem.Read16(baseAddr)
if mz != 0x5A4D {
return 0, 0
}
// e_lfanew at offset 0x3C
lfanew, _ := mem.Read32(baseAddr + 0x3C)
peAddr := baseAddr + uint64(lfanew)
// Check PE signature
peSig, _ := mem.Read32(peAddr)
if peSig != 0x00004550 {
return 0, 0
}
// Optional header starts at PE+24
// For PE32+ (64-bit), data directories start at optional header + 0x70
// Resource table is directory entry 2 (each entry = 8 bytes)
optHdr := peAddr + 24
rva, _ = mem.Read32(optHdr + 0x70 + 2*8) // resource dir RVA
size, _ = mem.Read32(optHdr + 0x70 + 2*8 + 4) // resource dir size
return rva, size
}
// findResourceEntry searches a resource directory for an entry with the given ID.
func findResourceEntry(mem *mmu.MMU, dirAddr, rsrcBase uint64, id uint32) (addr uint64, isDir bool) {
numNamed, _ := mem.Read16(dirAddr + 12)
numID, _ := mem.Read16(dirAddr + 14)
total := int(numNamed) + int(numID)
entryBase := dirAddr + 16
for i := 0; i < total; i++ {
eid, _ := mem.Read32(entryBase + uint64(i)*8)
off, _ := mem.Read32(entryBase + uint64(i)*8 + 4)
if eid == id {
isSubDir := off&0x80000000 != 0
return rsrcBase + uint64(off&0x7FFFFFFF), isSubDir
}
}
return 0, false
}
// findResourceFirstEntry returns the first entry in a resource directory.
func findResourceFirstEntry(mem *mmu.MMU, dirAddr, rsrcBase uint64) (addr uint64, isDir bool) {
numNamed, _ := mem.Read16(dirAddr + 12)
numID, _ := mem.Read16(dirAddr + 14)
total := int(numNamed) + int(numID)
if total == 0 {
return 0, false
}
off, _ := mem.Read32(dirAddr + 16 + 4) // first entry's offset
isSubDir := off&0x80000000 != 0
return rsrcBase + uint64(off&0x7FFFFFFF), isSubDir
}
// pickBestResourceLang picks the best language entry: neutral (0), English (0x09), or first.
func pickBestResourceLang(mem *mmu.MMU, dirAddr, rsrcBase uint64) uint64 {
numNamed, _ := mem.Read16(dirAddr + 12)
numID, _ := mem.Read16(dirAddr + 14)
total := int(numNamed) + int(numID)
if total == 0 {
return 0
}
entryBase := dirAddr + 16
var fallback uint64
for i := 0; i < total; i++ {
langID, _ := mem.Read32(entryBase + uint64(i)*8)
off, _ := mem.Read32(entryBase + uint64(i)*8 + 4)
addr := rsrcBase + uint64(off&0x7FFFFFFF)
if i == 0 {
fallback = addr
}
if langID == 0x0000 || langID&0xFF == 0x09 {
return addr
}
}
return fallback
}
// handleVsnprintf implements _vsnprintf(buf, count, fmt, args).
// We do a minimal implementation that reads the format string and copies it without formatting.
func handleVsnprintf(ctx *TrapContext) uint32 {
buf := ctx.Arg(0)
count := ctx.Arg(1)
fmtAddr := ctx.Arg(2)
if buf == 0 || count == 0 || fmtAddr == 0 {
ctx.SetReturn(0)
return StatusSuccess
}
// Read format string
var fmtBytes []byte
for i := uint64(0); i < 4096; i++ {
b, _ := ctx.Mem.Read8(fmtAddr + i)
if b == 0 {
break
}
fmtBytes = append(fmtBytes, b)
}
// Simple: just copy format string as-is (no substitution)
// This is enough for Wine debug output which uses it for logging
n := uint64(len(fmtBytes))
if n >= count {
n = count - 1
}
for i := uint64(0); i < n; i++ {
ctx.Mem.Write8(buf+i, fmtBytes[i])
}
ctx.Mem.Write8(buf+n, 0)
ctx.SetReturn(n)
return StatusSuccess
}
// handleVsnwprintf implements _vsnwprintf(buf, count, fmt, args).
func handleVsnwprintf(ctx *TrapContext) uint32 {
buf := ctx.Arg(0)
count := ctx.Arg(1)
fmtAddr := ctx.Arg(2)
if buf == 0 || count == 0 || fmtAddr == 0 {
ctx.SetReturn(0)
return StatusSuccess
}
// Read wide format string
var fmtChars []uint16
for i := uint64(0); i < 4096; i++ {
ch, _ := ctx.Mem.Read16(fmtAddr + i*2)
if ch == 0 {
break
}
fmtChars = append(fmtChars, ch)
}
n := uint64(len(fmtChars))
if n >= count {
n = count - 1
}
for i := uint64(0); i < n; i++ {
ctx.Mem.Write16(buf+i*2, fmtChars[i])
}
ctx.Mem.Write16(buf+n*2, 0)
ctx.SetReturn(n)
return StatusSuccess
}
// handleRtlFindClearBitsAndSet finds 'count' contiguous clear bits in a bitmap,
// sets them, and returns the starting index (or 0xFFFFFFFF if not found).
func handleRtlFindClearBitsAndSet(ctx *TrapContext) uint32 {
bitmapAddr := ctx.Arg(0)
numBits := uint32(ctx.Arg(1))
hintIdx := uint32(ctx.Arg(2))
if bitmapAddr == 0 || numBits == 0 {
ctx.SetReturn(0xFFFFFFFF)
return StatusSuccess
}
// RTL_BITMAP: { ULONG SizeOfBitMap; PULONG Buffer; }
sizeOfBitMap, _ := ctx.Mem.Read32(bitmapAddr)
bufferAddr, _ := ctx.Mem.Read64(bitmapAddr + 8)
if bufferAddr == 0 || sizeOfBitMap == 0 {
ctx.SetReturn(0xFFFFFFFF)
return StatusSuccess
}
// Search for numBits contiguous clear bits starting from hintIdx
for start := hintIdx; start+numBits <= sizeOfBitMap; start++ {
found := true
for bit := uint32(0); bit < numBits; bit++ {
idx := start + bit
wordIdx := idx / 32
bitIdx := idx % 32
word, _ := ctx.Mem.Read32(bufferAddr + uint64(wordIdx)*4)
if word&(1<<bitIdx) != 0 {
found = false
start = start + bit // skip ahead
break
}
}
if found {
// Set the bits
for bit := uint32(0); bit < numBits; bit++ {
idx := start + bit
wordIdx := idx / 32
bitIdx := idx % 32
addr := bufferAddr + uint64(wordIdx)*4
word, _ := ctx.Mem.Read32(addr)
word |= 1 << bitIdx
ctx.Mem.Write32(addr, word)
}
ctx.SetReturn(uint64(start))
return StatusSuccess
}
}
// Wrap around from 0 if hint was > 0
if hintIdx > 0 {
for start := uint32(0); start+numBits <= hintIdx; start++ {
found := true
for bit := uint32(0); bit < numBits; bit++ {
idx := start + bit
wordIdx := idx / 32
bitIdx := idx % 32
word, _ := ctx.Mem.Read32(bufferAddr + uint64(wordIdx)*4)
if word&(1<<bitIdx) != 0 {
found = false
start = start + bit
break
}
}
if found {
for bit := uint32(0); bit < numBits; bit++ {
idx := start + bit
wordIdx := idx / 32
bitIdx := idx % 32
addr := bufferAddr + uint64(wordIdx)*4
word, _ := ctx.Mem.Read32(addr)
word |= 1 << bitIdx
ctx.Mem.Write32(addr, word)
}
ctx.SetReturn(uint64(start))
return StatusSuccess
}
}
}
ctx.SetReturn(0xFFFFFFFF)
return StatusSuccess
}
// handleLdrQueryImageFileExecutionOptions is a stub - returns not found.
func handleLdrQueryImageFileExecutionOptions(ctx *TrapContext) uint32 {
ctx.SetReturn(uint64(StatusObjectNameNotFound))
return StatusObjectNameNotFound
}
// handleRtlReleasePath frees a path returned by LdrGetDllPath.
func handleRtlReleasePath(ctx *TrapContext) uint32 {
return StatusSuccess
}
// handleNtUserInitializeClientPfnArrays registers user32's client-side callback table.
func handleNtUserInitializeClientPfnArrays(ctx *TrapContext) uint32 {
ctx.SetReturn(0)
return StatusSuccess
}
// handleNtUserGetSystemDpiForProcess returns the system DPI.
func handleNtUserGetSystemDpiForProcess(ctx *TrapContext) uint32 {
ctx.SetReturn(96) // standard DPI
return StatusSuccess
}
// ======================== ATOM TABLE ========================
var atomCounter uint32 = 0xC000 // Start from 0xC000 (application atoms)
var atomTable = map[string]uint32{}
var objectHandleFlags = map[Handle]uint8{} // bit0=inherit, bit1=protect from close
func handleNtAddAtom(ctx *TrapContext) uint32 {
namePtr := ctx.Arg(0)
nameLen := ctx.Arg(1) // length in bytes
atomPtr := ctx.Arg(2) // output RTL_ATOM*
name := ""
if namePtr != 0 && nameLen > 0 {
name = readGuestStringUTF16(ctx.Mem, namePtr, int(nameLen))
}
atom, ok := atomTable[name]
if !ok {
atom = atomCounter
atomCounter++
atomTable[name] = atom
}
if atomPtr != 0 {
ctx.Mem.Write16(atomPtr, uint16(atom))
}
return StatusSuccess
}
func handleNtDeleteAtom(ctx *TrapContext) uint32 {
return StatusSuccess
}
func handleNtFindAtom(ctx *TrapContext) uint32 {
namePtr := ctx.Arg(0)
nameLen := ctx.Arg(1)
atomPtr := ctx.Arg(2)
name := ""
if namePtr != 0 && nameLen > 0 {
name = readGuestStringUTF16(ctx.Mem, namePtr, int(nameLen))
}
atom, ok := atomTable[name]
if !ok {
return StatusObjectNameNotFound
}
if atomPtr != 0 {
ctx.Mem.Write16(atomPtr, uint16(atom))
}
return StatusSuccess
}
func handleNtQueryInformationAtom(ctx *TrapContext) uint32 {
atom := uint32(ctx.Arg(0))
infoClass := uint32(ctx.Arg(1))
outBuf := ctx.Arg(2)
outLen := uint32(ctx.Arg(3))
retLen := ctx.Arg(4)
var atomName string
for k, v := range atomTable {
if v == atom {
atomName = k
break
}
}
if atomName == "" {
return StatusObjectNameNotFound
}
switch infoClass {
case 0: // AtomBasicInformation
nameUTF16 := encodeUTF16LE(atomName)
needed := uint32(8 + len(nameUTF16))
if retLen != 0 {
ctx.Mem.Write32(retLen, needed)
}
if outBuf == 0 || outLen < needed {
return StatusBufferTooSmall
}
ctx.Mem.Write16(outBuf+0, uint16(atom)) // Atom
ctx.Mem.Write16(outBuf+2, uint16(len(nameUTF16))) // NameLength (bytes)
ctx.Mem.Write16(outBuf+4, 1) // UsageCount
ctx.Mem.Write16(outBuf+6, 0) // Flags
ctx.Mem.WriteBytes(outBuf+8, nameUTF16) // Name
return StatusSuccess
case 1: // AtomTableInformation (minimal)
if retLen != 0 {
ctx.Mem.Write32(retLen, 4)
}
if outBuf == 0 || outLen < 4 {
return StatusBufferTooSmall
}
ctx.Mem.Write32(outBuf, uint32(len(atomTable)))
return StatusSuccess
default:
return StatusNotImplemented
}
}
// ======================== NtUserCallOneParam / NtUserCallTwoParam ========================
func handleNtUserCallOneParam(ctx *TrapContext) uint32 {
param := ctx.Arg(0)
code := ctx.Arg(1) // function code
if ctx.Trace {
fmt.Printf(" NtUserCallOneParam: code=%d param=0x%x\n", code, param)
}
switch code {
case 11: // ONEPARAM_ROUTINE_GETSYSTEMMETRICS
ctx.SetReturn(getSystemMetric(uint32(param)))
case 21: // ONEPARAM_ROUTINE_SETCARETBLINKTIME
ctx.SetReturn(1) // TRUE
case 26: // ONEPARAM_ROUTINE_SETPROCESSDEFAULTLAYOUT
ctx.SetReturn(1)
case 28: // ONEPARAM_ROUTINE_CREATEEMPTYCURSOROBJECT
h := ctx.Handles.Alloc(&GenericHandle{Kind: "cursor"})
ctx.SetReturn(uint64(h))
case 37: // ONEPARAM_ROUTINE_GETDPIFORMONITOR
ctx.SetReturn(96) // 96 DPI
case 73: // ONEPARAM_ROUTINE_RELEASEDC
ctx.SetReturn(1)
default:
ctx.SetReturn(0)
}
return StatusSuccess
}
func getSystemMetric(index uint32) uint64 {
switch index {
case 0: // SM_CXSCREEN
return 1920
case 1: // SM_CYSCREEN
return 1080
case 2: // SM_CXVSCROLL
return 17
case 3: // SM_CYHSCROLL
return 17
case 4: // SM_CYCAPTION
return 23
case 5: // SM_CXBORDER
return 1
case 6: // SM_CYBORDER
return 1
case 7: // SM_CXDLGFRAME / SM_CXFIXEDFRAME
return 3
case 8: // SM_CYDLGFRAME / SM_CYFIXEDFRAME
return 3
case 11: // SM_CXHTHUMB
return 17
case 12: // SM_CYICON
return 32
case 13: // SM_CXCURSOR (also SM_CXICON)
return 32
case 14: // SM_CYCURSOR
return 32
case 15: // SM_CYMENU
return 20
case 16: // SM_CXFULLSCREEN
return 1920
case 17: // SM_CYFULLSCREEN
return 1017 // 1080 - caption - menu
case 18: // SM_CYKANJIWINDOW
return 0
case 20: // SM_CXHSCROLL
return 17
case 21: // SM_CYVSCROLL
return 17
case 22: // SM_CXMIN
return 136
case 23: // SM_CYMIN
return 39
case 24: // SM_CXSIZE
return 36
case 25: // SM_CYSIZE
return 36
case 26: // SM_CXFRAME / SM_CXSIZEFRAME
return 4
case 27: // SM_CYFRAME / SM_CYSIZEFRAME
return 4
case 28: // SM_CXMINTRACK
return 136
case 29: // SM_CYMINTRACK
return 39
case 30: // SM_CXDOUBLECLK
return 4
case 31: // SM_CYDOUBLECLK
return 4
case 32: // SM_CXICONSPACING
return 75
case 33: // SM_CYICONSPACING
return 75
case 34: // SM_MENUDROPALIGNMENT
return 0
case 36: // SM_CXDRAG
return 4
case 37: // SM_CYDRAG
return 4
case 43: // SM_SWAPBUTTON
return 0
case 45: // SM_CXEDGE (SM_CXBORDER*2)
return 2
case 46: // SM_CYEDGE (SM_CYBORDER*2)
return 2
case 47: // SM_CXMINSPACING
return 160
case 48: // SM_CYMINSPACING
return 24
case 49: // SM_CXSMICON
return 16
case 50: // SM_CYSMICON
return 16
case 51: // SM_CYSMCAPTION
return 23
case 52: // SM_CXSMSIZE
return 12
case 53: // SM_CYSMSIZE
return 14
case 54: // SM_CXMENUSIZE
return 18
case 55: // SM_CYMENUSIZE
return 18
case 67: // SM_IMMENABLED
return 0
case 70: // SM_CMETRICS
return 76
case 75: // SM_CXFOCUSBORDER
return 1
case 76: // SM_CYFOCUSBORDER
return 1
case 78: // SM_CXPADDEDBORDER
return 4
case 80: // SM_DIGITIZER
return 0
default:
return 0
}
}
func handleNtUserCallTwoParam(ctx *TrapContext) uint32 {
// param1 := ctx.Arg(0)
// param2 := ctx.Arg(1)
// code := ctx.Arg(2)
ctx.SetReturn(0) // generic success
return StatusSuccess
}
// ---- SList (Singly-Linked List) operations ----
// SLIST_HEADER is 16 bytes: { NextEntry uint64; Depth uint16; CpuId uint16; pad uint32 }
func handleRtlInitializeSListHead(ctx *TrapContext) uint32 {
head := ctx.Arg(0)
if head != 0 {
ctx.Mem.Write64(head, 0) // NextEntry = NULL
ctx.Mem.Write64(head+8, 0) // Depth=0, CpuId=0
}
return StatusSuccess
}
func handleRtlInterlockedFlushSList(ctx *TrapContext) uint32 {
head := ctx.Arg(0)
if head == 0 {
ctx.SetReturn(0)
return StatusSuccess
}
first, _ := ctx.Mem.Read64(head)
ctx.Mem.Write64(head, 0) // clear list
ctx.Mem.Write64(head+8, 0) // depth=0
ctx.SetReturn(first)
return StatusSuccess
}
func handleRtlInterlockedPopEntrySList(ctx *TrapContext) uint32 {
head := ctx.Arg(0)
if head == 0 {
ctx.SetReturn(0)
return StatusSuccess
}
first, _ := ctx.Mem.Read64(head)
if first == 0 {
ctx.SetReturn(0)
return StatusSuccess
}
next, _ := ctx.Mem.Read64(first) // SLIST_ENTRY.Next
ctx.Mem.Write64(head, next)
// Decrement depth
depthWord, _ := ctx.Mem.Read16(head + 8)
if depthWord > 0 {
ctx.Mem.Write16(head+8, depthWord-1)
}
ctx.SetReturn(first)
return StatusSuccess
}
func handleRtlInterlockedPushEntrySList(ctx *TrapContext) uint32 {
head := ctx.Arg(0)
entry := ctx.Arg(1)
if head == 0 || entry == 0 {
ctx.SetReturn(0)
return StatusSuccess
}
oldFirst, _ := ctx.Mem.Read64(head)
ctx.Mem.Write64(entry, oldFirst) // entry->Next = old first
ctx.Mem.Write64(head, entry) // head->NextEntry = entry
// Increment depth
depthWord, _ := ctx.Mem.Read16(head + 8)
ctx.Mem.Write16(head+8, depthWord+1)
ctx.SetReturn(oldFirst)
return StatusSuccess
}
func handleRtlQueryDepthSList(ctx *TrapContext) uint32 {
head := ctx.Arg(0)
if head == 0 {
ctx.SetReturn(0)
return StatusSuccess
}
depth, _ := ctx.Mem.Read16(head + 8)
ctx.SetReturn(uint64(depth))
return StatusSuccess
}
// ---- Performance Counter ----
var perfFreq uint64 = 1_000_000_000 // 1GHz (nanosecond resolution)
func handleRtlQueryPerformanceCounter(ctx *TrapContext) uint32 {
out := ctx.Arg(0) // LARGE_INTEGER*
if out != 0 {
ctx.Mem.Write64(out, uint64(time.Now().UnixNano()))
}
ctx.SetReturn(1) // TRUE
return StatusSuccess
}
func handleRtlQueryPerformanceFrequency(ctx *TrapContext) uint32 {
out := ctx.Arg(0) // LARGE_INTEGER*
if out != 0 {
ctx.Mem.Write64(out, perfFreq)
}
ctx.SetReturn(1) // TRUE
return StatusSuccess
}
// ---- Misc ----
func handleRtlRandom(ctx *TrapContext) uint32 {
seedPtr := ctx.Arg(0) // ULONG*
var seed uint32
if seedPtr != 0 {
v, _ := ctx.Mem.Read32(seedPtr)
seed = v
}
// Simple LCG
seed = seed*214013 + 2531011
if seedPtr != 0 {
ctx.Mem.Write32(seedPtr, seed)
}
ctx.SetReturn(uint64(seed >> 16 & 0x7FFF))
return StatusSuccess
}
func handleWineGetHostVersion(ctx *TrapContext) uint32 {
// wine_get_host_version(const char **sysname, const char **release)
sysname := ctx.Arg(0)
release := ctx.Arg(1)
if sysname != 0 {
buf := ctx.Mem.Mmap(0, 16, mmu.PermRead|mmu.PermWrite)
for i, b := range []byte("Linux") {
ctx.Mem.Write8(buf+uint64(i), b)
}
ctx.Mem.Write8(buf+5, 0)
ctx.Mem.Write64(sysname, buf)
}
if release != 0 {
buf := ctx.Mem.Mmap(0, 16, mmu.PermRead|mmu.PermWrite)
for i, b := range []byte("6.1.0") {
ctx.Mem.Write8(buf+uint64(i), b)
}
ctx.Mem.Write8(buf+5, 0)
ctx.Mem.Write64(release, buf)
}
return StatusSuccess
}
// ======================== NtGdi* - GDI Object Stubs ========================
// GDI object type codes (for GdiSharedHandleTable entry+0x0E).
const (
gdiObjDC = 0x01
gdiObjBrush = 0x02
gdiObjPen = 0x03
gdiObjPal = 0x05
gdiObjFont = 0x06
gdiObjBitmap = 0x07
gdiObjRegion = 0x08
)
const gdiEntrySize = 24
// allocGdiHandle allocates a handle and writes a corresponding entry in the
// GDI shared handle table so gdi32 user-mode code can validate it.
func allocGdiHandle(ctx *TrapContext, kind string, objType byte) Handle {
h := ctx.Handles.Alloc(&GenericHandle{Kind: kind})
idx := uint64(h) & 0xFFFF
if ctx.State.GdiTableAddr != 0 && idx < 0x4000 {
entry := ctx.State.GdiTableAddr + idx*gdiEntrySize
ctx.Mem.Write8(entry+0x0E, objType)
}
return h
}
func handleNtGdiCreateBitmap(ctx *TrapContext) uint32 {
// NtGdiCreateBitmap(width, height, planes, bpp, bits)
w := ctx.Arg(0)
h := ctx.Arg(1)
if ctx.Trace {
fmt.Printf(" NtGdiCreateBitmap: %dx%d planes=%d bpp=%d\n", w, h, ctx.Arg(2), ctx.Arg(3))
}
handle := allocGdiHandle(ctx, "bitmap", gdiObjBitmap)
ctx.SetReturn(uint64(handle))
return StatusSuccess
}
func handleNtGdiCreatePatternBrushInternal(ctx *TrapContext) uint32 {
bitmapHandle := ctx.Arg(0)
if ctx.Trace {
fmt.Printf(" NtGdiCreatePatternBrushInternal: bitmap=0x%x\n", bitmapHandle)
}
handle := allocGdiHandle(ctx, "brush", gdiObjBrush)
ctx.SetReturn(uint64(handle))
return StatusSuccess
}
func handleNtGdiDeleteObjectApp(ctx *TrapContext) uint32 {
h := Handle(ctx.Arg(0))
// Clear GDI table entry
idx := uint64(h) & 0xFFFF
if ctx.State.GdiTableAddr != 0 && idx < 0x4000 {
entry := ctx.State.GdiTableAddr + idx*gdiEntrySize
ctx.Mem.Write8(entry+0x0E, 0)
}
ctx.Handles.Close(h)
ctx.SetReturn(1) // TRUE
return StatusSuccess
}
func handleNtGdiSelectBitmap(ctx *TrapContext) uint32 {
// Returns previous bitmap handle (fake)
ctx.SetReturn(ctx.Arg(1)) // return the bitmap being selected
return StatusSuccess
}
func handleNtGdiSelectBrush(ctx *TrapContext) uint32 {
ctx.SetReturn(ctx.Arg(1))
return StatusSuccess
}
func handleNtGdiSelectPen(ctx *TrapContext) uint32 {
ctx.SetReturn(ctx.Arg(1))
return StatusSuccess
}
func handleNtGdiSelectFont(ctx *TrapContext) uint32 {
ctx.SetReturn(ctx.Arg(1))
return StatusSuccess
}
func handleNtGdiCreateSolidBrush(ctx *TrapContext) uint32 {
handle := allocGdiHandle(ctx, "brush", gdiObjBrush)
ctx.SetReturn(uint64(handle))
return StatusSuccess
}
func handleNtGdiCreatePen(ctx *TrapContext) uint32 {
handle := allocGdiHandle(ctx, "pen", gdiObjPen)
ctx.SetReturn(uint64(handle))
return StatusSuccess
}
func handleNtGdiCreateRectRgn(ctx *TrapContext) uint32 {
handle := allocGdiHandle(ctx, "region", gdiObjRegion)
ctx.SetReturn(uint64(handle))
return StatusSuccess
}
func handleNtGdiCreateCompatibleDC(ctx *TrapContext) uint32 {
handle := allocGdiHandle(ctx, "dc", gdiObjDC)
ctx.SetReturn(uint64(handle))
return StatusSuccess
}
// handleNtGdiGetStockObject returns a ReactOS-format stock-object HGDIOBJ for a
// stock index (WHITE_BRUSH=0 ... DC_PEN=19). The handle encodes the object type in
// bits 16-22 (GDILoObjType_LO_*_TYPE) plus the stock mask (0x00800000); gdi32
// caches it and passes it to SelectObject/GetObject. Stock objects share a fixed
// low index range so they never collide with allocated handles.
func handleNtGdiGetStockObject(ctx *TrapContext) uint32 {
idx := ctx.Arg(0)
var loType uint32
switch {
case idx <= 5 || idx == 18: // WHITE..DKGRAY..HOLLOW brush, DC_BRUSH
loType = 0x00100000 // LO_BRUSH_TYPE
case (idx >= 6 && idx <= 8) || idx == 19: // WHITE/BLACK/NULL pen, DC_PEN
loType = 0x00300000 // LO_PEN_TYPE
case idx >= 10 && idx <= 17: // stock fonts (OEM..DEFAULT_GUI)
loType = 0x000a0000 // LO_FONT_TYPE (GDIObjType_LFONT_TYPE << 16)
case idx == 9 || idx == 14: // *_PALETTE
loType = 0x00080000 // LO_PALETTE_TYPE
default:
loType = 0x00100000
}
// stock index lives in the reserved low table range [0x20, 0x40)
handle := 0x00800000 | loType | (0x20 + uint32(idx&0x1F))
ctx.SetReturn(uint64(handle))
return StatusSuccess
}
func handleNtGdiCreateCompatibleBitmap(ctx *TrapContext) uint32 {
handle := allocGdiHandle(ctx, "bitmap", gdiObjBitmap)
ctx.SetReturn(uint64(handle))
return StatusSuccess
}
func handleNtGdiHfontCreate(ctx *TrapContext) uint32 {
handle := allocGdiHandle(ctx, "font", gdiObjFont)
ctx.SetReturn(uint64(handle))
return StatusSuccess
}
func handleNtGdiExtGetObjectW(ctx *TrapContext) uint32 {
// Returns the size of data written (0 = error, but return 1 for basic compat)
ctx.SetReturn(0)
return StatusSuccess
}
func handleNtGdiGetDeviceCaps(ctx *TrapContext) uint32 {
index := ctx.Arg(1)
var val uint64
switch index {
case 8: // HORZRES
val = 1920
case 10: // VERTRES
val = 1080
case 12: // BITSPIXEL
val = 32
case 14: // PLANES
val = 1
case 88: // LOGPIXELSX
val = 96
case 90: // LOGPIXELSY
val = 96
case 118: // DESKTOPHORZRES
val = 1920
case 117: // DESKTOPVERTRES
val = 1080
default:
val = 0
}
ctx.SetReturn(val)
return StatusSuccess
}
func handleNtGdiGetAndSetDCDword(ctx *TrapContext) uint32 {
resultPtr := ctx.Arg(3)
if resultPtr != 0 {
ctx.Mem.Write32(resultPtr, 0)
}
ctx.SetReturn(1) // TRUE
return StatusSuccess
}
func handleNtGdiSaveDC(ctx *TrapContext) uint32 {
ctx.SetReturn(1) // Save level 1
return StatusSuccess
}
func handleNtGdiRestoreDC(ctx *TrapContext) uint32 {
ctx.SetReturn(1)
return StatusSuccess
}
func handleNtGdiCombineRgn(ctx *TrapContext) uint32 {
ctx.SetReturn(1) // NULLREGION
return StatusSuccess
}
func handleNtGdiGetRgnBox(ctx *TrapContext) uint32 {
rectPtr := ctx.Arg(1)
if rectPtr != 0 {
ctx.Mem.Write32(rectPtr, 0) // left
ctx.Mem.Write32(rectPtr+4, 0) // top
ctx.Mem.Write32(rectPtr+8, 0) // right
ctx.Mem.Write32(rectPtr+12, 0) // bottom
}
ctx.SetReturn(1) // NULLREGION
return StatusSuccess
}
func handleNtGdiSetRectRgn(ctx *TrapContext) uint32 {
ctx.SetReturn(1) // TRUE
return StatusSuccess
}
func handleNtGdiOffsetRgn(ctx *TrapContext) uint32 {
ctx.SetReturn(1) // NULLREGION
return StatusSuccess
}
func handleNtGdiPatBlt(ctx *TrapContext) uint32 {
ctx.SetReturn(1) // TRUE
return StatusSuccess
}
func handleNtGdiBitBlt(ctx *TrapContext) uint32 {
ctx.SetReturn(1) // TRUE
return StatusSuccess
}
func handleNtGdiOpenDCW(ctx *TrapContext) uint32 {
handle := allocGdiHandle(ctx, "dc", gdiObjDC)
ctx.SetReturn(uint64(handle))
return StatusSuccess
}
func handleNtGdiGetTextMetricsW(ctx *TrapContext) uint32 {
tmPtr := ctx.Arg(1)
if tmPtr != 0 {
// Fill TEXTMETRICW with reasonable defaults (60 bytes)
for i := uint64(0); i < 60; i += 4 {
ctx.Mem.Write32(tmPtr+i, 0)
}
ctx.Mem.Write32(tmPtr+0, 16) // tmHeight
ctx.Mem.Write32(tmPtr+4, 12) // tmAscent
ctx.Mem.Write32(tmPtr+8, 4) // tmDescent
ctx.Mem.Write32(tmPtr+20, 8) // tmAveCharWidth
ctx.Mem.Write32(tmPtr+24, 16) // tmMaxCharWidth
}
ctx.SetReturn(1) // TRUE
return StatusSuccess
}
func handleNtGdiFlush(ctx *TrapContext) uint32 {
ctx.SetReturn(1) // TRUE
return StatusSuccess
}
// ======================== CRT HANDLERS (complex, trap-based) ========================
func handleStrtol(ctx *TrapContext) uint32 {
strAddr := ctx.Arg(0)
endptrAddr := ctx.Arg(1)
base := ctx.Arg(2)
s := readCString(ctx.Mem, strAddr, 64)
val, _ := strconvParseInt(s, int(base))
ctx.CPU.SetSyscallReturn(uint64(val))
ctx.ReturnOverridden = true
if endptrAddr != 0 {
ctx.Mem.Write64(endptrAddr, strAddr+uint64(len(s)))
}
return 0
}
func handleWcstol(ctx *TrapContext) uint32 {
strAddr := ctx.Arg(0)
endptrAddr := ctx.Arg(1)
base := ctx.Arg(2)
s := readWideString(ctx.Mem, strAddr, 64)
val, _ := strconvParseInt(s, int(base))
ctx.CPU.SetSyscallReturn(uint64(val))
ctx.ReturnOverridden = true
if endptrAddr != 0 {
ctx.Mem.Write64(endptrAddr, strAddr+uint64(len(s)*2))
}
return 0
}
func handleWcstoul(ctx *TrapContext) uint32 {
strAddr := ctx.Arg(0)
endptrAddr := ctx.Arg(1)
base := ctx.Arg(2)
s := readWideString(ctx.Mem, strAddr, 64)
val, _ := strconvParseUint(s, int(base))
ctx.CPU.SetSyscallReturn(val)
ctx.ReturnOverridden = true
if endptrAddr != 0 {
ctx.Mem.Write64(endptrAddr, strAddr+uint64(len(s)*2))
}
return 0
}
func handleStrnicmp(ctx *TrapContext) uint32 {
s1Addr := ctx.Arg(0)
s2Addr := ctx.Arg(1)
n := ctx.Arg(2)
for i := uint64(0); i < n; i++ {
c1, _ := ctx.Mem.Read8(s1Addr + i)
c2, _ := ctx.Mem.Read8(s2Addr + i)
if c1 == 0 && c2 == 0 {
return 0
}
l1, l2 := toLowerByte(c1), toLowerByte(c2)
if l1 != l2 {
if l1 < l2 {
ctx.CPU.SetSyscallReturn(^uint64(0)) // -1
} else {
ctx.CPU.SetSyscallReturn(1)
}
ctx.ReturnOverridden = true
return 0
}
if c1 == 0 {
return 0
}
}
return 0
}
func handleWcsicmp(ctx *TrapContext) uint32 {
s1Addr := ctx.Arg(0)
s2Addr := ctx.Arg(1)
for i := uint64(0); ; i += 2 {
c1, _ := ctx.Mem.Read16(s1Addr + i)
c2, _ := ctx.Mem.Read16(s2Addr + i)
l1, l2 := toLowerWide(c1), toLowerWide(c2)
if l1 != l2 {
if l1 < l2 {
ctx.CPU.SetSyscallReturn(^uint64(0))
} else {
ctx.CPU.SetSyscallReturn(1)
}
ctx.ReturnOverridden = true
return 0
}
if c1 == 0 {
return 0
}
}
}
func handleWcsnicmp(ctx *TrapContext) uint32 {
s1Addr := ctx.Arg(0)
s2Addr := ctx.Arg(1)
n := ctx.Arg(2)
for i := uint64(0); i < n; i++ {
c1, _ := ctx.Mem.Read16(s1Addr + i*2)
c2, _ := ctx.Mem.Read16(s2Addr + i*2)
l1, l2 := toLowerWide(c1), toLowerWide(c2)
if l1 != l2 {
if l1 < l2 {
ctx.CPU.SetSyscallReturn(^uint64(0))
} else {
ctx.CPU.SetSyscallReturn(1)
}
ctx.ReturnOverridden = true
return 0
}
if c1 == 0 {
return 0
}
}
return 0
}
func handleIsalpha(ctx *TrapContext) uint32 {
c := byte(ctx.Arg(0))
if (c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') {
ctx.CPU.SetSyscallReturn(1)
ctx.ReturnOverridden = true
}
return 0
}
func handleIslower(ctx *TrapContext) uint32 {
c := byte(ctx.Arg(0))
if c >= 'a' && c <= 'z' {
ctx.CPU.SetSyscallReturn(1)
ctx.ReturnOverridden = true
}
return 0
}
func handleIsxdigit(ctx *TrapContext) uint32 {
c := byte(ctx.Arg(0))
if (c >= '0' && c <= '9') || (c >= 'A' && c <= 'F') || (c >= 'a' && c <= 'f') {
ctx.CPU.SetSyscallReturn(1)
ctx.ReturnOverridden = true
}
return 0
}
func handleStrpbrk(ctx *TrapContext) uint32 {
strAddr := ctx.Arg(0)
charsAddr := ctx.Arg(1)
accept := readCString(ctx.Mem, charsAddr, 256)
acceptSet := make(map[byte]bool)
for _, c := range []byte(accept) {
acceptSet[c] = true
}
for i := uint64(0); ; i++ {
c, _ := ctx.Mem.Read8(strAddr + i)
if c == 0 {
break
}
if acceptSet[c] {
ctx.CPU.SetSyscallReturn(strAddr + i)
ctx.ReturnOverridden = true
return 0
}
}
ctx.CPU.SetSyscallReturn(0)
ctx.ReturnOverridden = true
return 0
}
func handleWcspbrk(ctx *TrapContext) uint32 {
strAddr := ctx.Arg(0)
charsAddr := ctx.Arg(1)
acceptSet := make(map[uint16]bool)
for i := uint64(0); ; i += 2 {
c, _ := ctx.Mem.Read16(charsAddr + i)
if c == 0 {
break
}
acceptSet[c] = true
}
for i := uint64(0); ; i += 2 {
c, _ := ctx.Mem.Read16(strAddr + i)
if c == 0 {
break
}
if acceptSet[c] {
ctx.CPU.SetSyscallReturn(strAddr + i)
ctx.ReturnOverridden = true
return 0
}
}
ctx.CPU.SetSyscallReturn(0)
ctx.ReturnOverridden = true
return 0
}
func handleWcscspn(ctx *TrapContext) uint32 {
strAddr := ctx.Arg(0)
rejectAddr := ctx.Arg(1)
rejectSet := make(map[uint16]bool)
for i := uint64(0); ; i += 2 {
c, _ := ctx.Mem.Read16(rejectAddr + i)
if c == 0 {
break
}
rejectSet[c] = true
}
count := uint64(0)
for i := uint64(0); ; i += 2 {
c, _ := ctx.Mem.Read16(strAddr + i)
if c == 0 || rejectSet[c] {
break
}
count++
}
ctx.CPU.SetSyscallReturn(count)
ctx.ReturnOverridden = true
return 0
}
func handleWcsspn(ctx *TrapContext) uint32 {
strAddr := ctx.Arg(0)
acceptAddr := ctx.Arg(1)
acceptSet := make(map[uint16]bool)
for i := uint64(0); ; i += 2 {
c, _ := ctx.Mem.Read16(acceptAddr + i)
if c == 0 {
break
}
acceptSet[c] = true
}
count := uint64(0)
for i := uint64(0); ; i += 2 {
c, _ := ctx.Mem.Read16(strAddr + i)
if c == 0 || !acceptSet[c] {
break
}
count++
}
ctx.CPU.SetSyscallReturn(count)
ctx.ReturnOverridden = true
return 0
}
func handleWcsstr(ctx *TrapContext) uint32 {
haystackAddr := ctx.Arg(0)
needleAddr := ctx.Arg(1)
needle := readWideChars(ctx.Mem, needleAddr, 256)
if len(needle) == 0 {
ctx.CPU.SetSyscallReturn(haystackAddr)
ctx.ReturnOverridden = true
return 0
}
for i := uint64(0); ; i += 2 {
c, _ := ctx.Mem.Read16(haystackAddr + i)
if c == 0 {
break
}
if c == needle[0] {
match := true
for j := 1; j < len(needle); j++ {
h, _ := ctx.Mem.Read16(haystackAddr + i + uint64(j*2))
if h != needle[j] {
match = false
break
}
}
if match {
ctx.CPU.SetSyscallReturn(haystackAddr + i)
ctx.ReturnOverridden = true
return 0
}
}
}
ctx.CPU.SetSyscallReturn(0)
ctx.ReturnOverridden = true
return 0
}
// helpers
func toLowerByte(c byte) byte {
if c >= 'A' && c <= 'Z' {
return c + 0x20
}
return c
}
func toLowerWide(c uint16) uint16 {
if c >= 'A' && c <= 'Z' {
return c + 0x20
}
return c
}
func readWideChars(mem *mmu.MMU, addr uint64, maxChars int) []uint16 {
var result []uint16
for i := 0; i < maxChars; i++ {
c, err := mem.Read16(addr + uint64(i*2))
if err != nil || c == 0 {
break
}
result = append(result, c)
}
return result
}
func readWideString(mem *mmu.MMU, addr uint64, maxChars int) string {
chars := readWideChars(mem, addr, maxChars)
buf := make([]byte, 0, len(chars))
for _, c := range chars {
if c < 128 {
buf = append(buf, byte(c))
} else {
buf = append(buf, '?')
}
}
return string(buf)
}
func readCString(mem *mmu.MMU, addr uint64, maxLen int) string {
var buf []byte
for i := 0; i < maxLen; i++ {
b, err := mem.Read8(addr + uint64(i))
if err != nil || b == 0 {
break
}
buf = append(buf, b)
}
return string(buf)
}
func strconvParseInt(s string, base int) (int64, error) {
i := 0
for i < len(s) && (s[i] == ' ' || s[i] == '\t' || s[i] == '\n' || s[i] == '\r') {
i++
}
if i >= len(s) {
return 0, nil
}
neg := false
if s[i] == '-' {
neg = true
i++
} else if s[i] == '+' {
i++
}
if base == 0 {
if i+1 < len(s) && s[i] == '0' && (s[i+1] == 'x' || s[i+1] == 'X') {
base = 16
i += 2
} else if i < len(s) && s[i] == '0' {
base = 8
i++
} else {
base = 10
}
}
var val int64
for i < len(s) {
c := s[i]
var digit int64
if c >= '0' && c <= '9' {
digit = int64(c - '0')
} else if c >= 'a' && c <= 'f' {
digit = int64(c-'a') + 10
} else if c >= 'A' && c <= 'F' {
digit = int64(c-'A') + 10
} else {
break
}
if digit >= int64(base) {
break
}
val = val*int64(base) + digit
i++
}
if neg {
val = -val
}
return val, nil
}
func strconvParseUint(s string, base int) (uint64, error) {
v, err := strconvParseInt(s, base)
return uint64(v), err
}
// ──────────────────────────────────────────────────────────
// Wave 10: RtlEncodePointer / RtlDecodePointer
// Windows Vista+ uses a per-process cookie XOR to encode pointers
// stored in function pointer tables (CRT uses this heavily).
// Reference: wine/dlls/ntdll/misc.c, reactos/lib/rtl/process.c
// ──────────────────────────────────────────────────────────
// processCookie is a process-wide random value used for pointer encoding.
// In Windows it is stored at PEB+0x700, but for HLE purposes we keep it here.
var processCookie = func() uint64 {
var b [8]byte
unix.Getrandom(b[:], 0)
v := uint64(b[0]) | uint64(b[1])<<8 | uint64(b[2])<<16 | uint64(b[3])<<24 |
uint64(b[4])<<32 | uint64(b[5])<<40 | uint64(b[6])<<48 | uint64(b[7])<<56
if v == 0 {
v = 0xDEADBEEFCAFEBABE
}
return v
}()
func handleRtlEncodePointer(ctx *TrapContext) uint32 {
ptr := ctx.Arg(0)
ctx.SetReturn(ptr ^ processCookie)
return StatusSuccess
}
func handleRtlDecodePointer(ctx *TrapContext) uint32 {
ptr := ctx.Arg(0)
ctx.SetReturn(ptr ^ processCookie)
return StatusSuccess
}
func handleRtlEncodeSystemPointer(ctx *TrapContext) uint32 {
ptr := ctx.Arg(0)
ctx.SetReturn(ptr ^ processCookie)
return StatusSuccess
}
func handleRtlDecodeSystemPointer(ctx *TrapContext) uint32 {
ptr := ctx.Arg(0)
ctx.SetReturn(ptr ^ processCookie)
return StatusSuccess
}
// ──────────────────────────────────────────────────────────
// NtTerminateThread - terminate a specific thread
// Reference: reactos/ntoskrnl/ps/kill.c
// ──────────────────────────────────────────────────────────
func handleNtTerminateThread(ctx *TrapContext) uint32 {
// NtTerminateThread(ThreadHandle, ExitStatus)
// ThreadHandle == NULL or current thread → exit the process (single-threaded HLE)
hThread := ctx.Arg(0)
exitCode := uint32(ctx.Arg(1))
_ = hThread
// In single-threaded HLE, terminating any thread terminates the process
os.Exit(int(exitCode))
return StatusSuccess
}
// ──────────────────────────────────────────────────────────
// NtCreateJobObject / NtOpenJobObject / NtAssignProcessToJobObject
// Reference: reactos/ntoskrnl/ps/job.c
// ──────────────────────────────────────────────────────────
func handleNtCreateJobObject(ctx *TrapContext) uint32 {
outHandle := ctx.Arg(0)
// arg1=DesiredAccess, arg2=ObjectAttributes
name := ""
j := NewJobHandle(name)
h := ctx.Handles.Alloc(j)
if outHandle != 0 {
ctx.Mem.Write64(outHandle, uint64(h))
}
return StatusSuccess
}
func handleNtOpenJobObject(ctx *TrapContext) uint32 {
outHandle := ctx.Arg(0)
j := NewJobHandle("")
h := ctx.Handles.Alloc(j)
if outHandle != 0 {
ctx.Mem.Write64(outHandle, uint64(h))
}
return StatusSuccess
}
func handleNtAssignProcessToJobObject(ctx *TrapContext) uint32 {
hJob := Handle(ctx.Arg(0))
// hProcess := Handle(ctx.Arg(1))
j := ctx.Handles.GetJob(hJob)
if j != nil {
j.AddProcess(ctx.State.ProcessId)
}
return StatusSuccess
}
func handleNtQueryInformationJobObject(ctx *TrapContext) uint32 {
// NtQueryInformationJobObject(JobHandle, InfoClass, Info, InfoLen, ReturnLen*)
// Class 1 = JobObjectBasicAccountingInformation - return zeros (no limits)
infoPtr := ctx.Arg(2)
infoLen := ctx.Arg(3)
retLen := ctx.Arg(4)
if infoPtr != 0 && infoLen > 0 {
for i := uint64(0); i < infoLen; i++ {
ctx.Mem.Write8(infoPtr+i, 0)
}
}
if retLen != 0 {
ctx.Mem.Write32(retLen, uint32(infoLen))
}
return StatusSuccess
}
// ──────────────────────────────────────────────────────────
// NtCreateThread / NtCreateThreadEx (stub - Raven is single-threaded for now)
// Reference: reactos/ntoskrnl/ps/thread.c
// ──────────────────────────────────────────────────────────
func handleNtCreateThread(ctx *TrapContext) uint32 {
// NtCreateThread(ThreadHandle*, Access, ObjAttr*, ProcessHandle,
//
// ClientId*, ThreadContext*, InitialTeb*, Suspended)
//
// We don't support true multi-threaded guests; return a pseudo-handle.
outHandle := ctx.Arg(0)
tid := 1
if ctx.State != nil && ctx.State.ThreadId != 0 {
tid = int(ctx.State.ThreadId)
}
h := ctx.Handles.Alloc(&ThreadHandle{
TID: tid,
Done: make(chan struct{}),
Priority: 8,
})
if outHandle != 0 {
ctx.Mem.Write64(outHandle, uint64(h))
}
return StatusSuccess
}
func handleNtCreateThreadEx(ctx *TrapContext) uint32 {
outHandle := ctx.Arg(0)
tid := 1
if ctx.State != nil && ctx.State.ThreadId != 0 {
tid = int(ctx.State.ThreadId)
}
h := ctx.Handles.Alloc(&ThreadHandle{
TID: tid,
Done: make(chan struct{}),
Priority: 8,
})
if outHandle != 0 {
ctx.Mem.Write64(outHandle, uint64(h))
}
return StatusSuccess
}
// ──────────────────────────────────────────────────────────
// NtSetTimerEx - extended timer with flags
// ──────────────────────────────────────────────────────────
func handleNtSetTimerEx(ctx *TrapContext) uint32 {
return handleNtSetTimer(ctx)
}
// ──────────────────────────────────────────────────────────
// RtlAddFunctionTable / RtlInstallFunctionTableCallback / RtlDeleteFunctionTable
// Used by MSVC for x64 exception handling (SEH) - we return TRUE (registered).
// Reference: wine/dlls/ntdll/unwind.c
// ──────────────────────────────────────────────────────────
func handleRtlAddFunctionTable(ctx *TrapContext) uint32 {
if AddDynamicFunctionTable(ctx.Mem, ctx.Arg(0), uint32(ctx.Arg(1)), ctx.Arg(2)) {
ctx.SetReturn(1)
} else {
ctx.SetReturn(0)
}
return StatusSuccess
}
func handleRtlInstallFunctionTableCallback(ctx *TrapContext) uint32 {
if InstallDynamicFunctionTableCallback(ctx.Arg(0), ctx.Arg(1), ctx.Arg(2), ctx.Arg(3), ctx.Arg(4)) {
ctx.SetReturn(1)
} else {
ctx.SetReturn(0)
}
return StatusSuccess
}
func handleRtlDeleteFunctionTable(ctx *TrapContext) uint32 {
if DeleteDynamicFunctionTable(ctx.Arg(0)) {
ctx.SetReturn(1)
} else {
ctx.SetReturn(0)
}
return StatusSuccess
}
func handleRtlAddGrowableFunctionTable(ctx *TrapContext) uint32 {
ctx.SetReturn(0) // STATUS_SUCCESS
return StatusSuccess
}
func handleRtlGrowFunctionTable(ctx *TrapContext) uint32 {
return StatusSuccess
}
func handleRtlDeleteGrowableFunctionTable(ctx *TrapContext) uint32 {
return StatusSuccess
}
// ──────────────────────────────────────────────────────────
// RtlVirtualUnwind - x64 SEH virtual unwind
// Reference: wine/dlls/ntdll/signal_x86_64.c
// ──────────────────────────────────────────────────────────
func handleRtlVirtualUnwind(ctx *TrapContext) uint32 {
contextRecord, err := ReadAMD64Context(ctx.Mem, ctx.Arg(4))
if err != nil {
ctx.SetReturn(0)
return StatusSuccess
}
functionEntry := ReadRuntimeFunctionEntry(ctx.Mem, ctx.Arg(3))
if functionEntry == nil {
trampoline := AllocTrampoline(ctx.Mem)
guestCall := func(addr uint64, args []uint64) (uint64, error) {
return CallGuestFunction(ctx.CPU, ctx.Mem, trampoline, addr, args, ctx.Trace)
}
functionEntry, _, _ = LookupFunctionEntry(ctx.Mem, ctx.Arg(2), guestCall)
}
handlerAddr, handlerData, establisherFrame, err := VirtualUnwind(
ctx.Mem,
uint32(ctx.Arg(0)),
ctx.Arg(1),
ctx.Arg(2),
functionEntry,
contextRecord,
)
if err == nil {
_ = WriteAMD64Context(ctx.Mem, ctx.Arg(4), contextRecord)
if ctx.Arg(5) != 0 {
ctx.Mem.Write64(ctx.Arg(5), handlerData)
}
if ctx.Arg(6) != 0 {
ctx.Mem.Write64(ctx.Arg(6), establisherFrame)
}
}
ctx.SetReturn(handlerAddr)
return StatusSuccess
}
// ──────────────────────────────────────────────────────────
// NtAreMappedFilesTheSame
// ──────────────────────────────────────────────────────────
func handleNtAreMappedFilesTheSame(ctx *TrapContext) uint32 {
if ctx.Arg(0) == ctx.Arg(1) {
return StatusSuccess
}
return 0xC0000002 // STATUS_NOT_SAME_DEVICE
}
const (
cmResourceTypePort = 1
cmResourceTypeMemory = 3
cmResourceTypeMemoryLarge = 7
cmResourceMemoryLargeMask = 0x0e00
cmResourceMemoryLarge40 = 0x0200
cmResourceMemoryLarge48 = 0x0400
cmResourceMemoryLarge64 = 0x0800
)
func decodeMemIoLength(resourceType byte, flags uint16, encoded uint32) (uint64, bool) {
switch resourceType {
case cmResourceTypePort, cmResourceTypeMemory:
return uint64(encoded), true
case cmResourceTypeMemoryLarge:
var shift uint
switch flags & cmResourceMemoryLargeMask {
case cmResourceMemoryLarge40:
shift = 8
case cmResourceMemoryLarge48:
shift = 16
case cmResourceMemoryLarge64:
shift = 32
default:
return 0, false
}
return uint64(encoded) << shift, true
default:
return 0, false
}
}
func setUint64Return(ctx *TrapContext, value uint64) {
if ctx.CPU.GetArch() == arch.ArchI386 {
if regs, ok := ctx.CPU.(RegisterWriter); ok {
regs.WriteReg(regRDX, value>>32)
}
ctx.SetReturn(uint64(uint32(value)))
return
}
ctx.SetReturn(value)
}
func handleRtlCmDecodeMemIoResource(ctx *TrapContext) uint32 {
descriptor := ctx.Arg(0)
startOut := ctx.Arg(1)
resourceType, typeErr := ctx.Mem.Read8(descriptor)
flags, flagsErr := ctx.Mem.Read16(descriptor + 2)
start, startErr := ctx.Mem.Read64(descriptor + 4)
encodedLength, lengthErr := ctx.Mem.Read32(descriptor + 12)
if typeErr != nil || flagsErr != nil || startErr != nil || lengthErr != nil {
setUint64Return(ctx, 0)
return StatusSuccess
}
length, valid := decodeMemIoLength(resourceType, flags, encodedLength)
if !valid {
setUint64Return(ctx, 0)
return StatusSuccess
}
if startOut != 0 {
ctx.Mem.Write64(startOut, start)
}
setUint64Return(ctx, length)
return StatusSuccess
}
func handleRtlIoDecodeMemIoResource(ctx *TrapContext) uint32 {
descriptor := ctx.Arg(0)
alignmentOut := ctx.Arg(1)
minimumOut := ctx.Arg(2)
maximumOut := ctx.Arg(3)
resourceType, typeErr := ctx.Mem.Read8(descriptor + 1)
flags, flagsErr := ctx.Mem.Read16(descriptor + 4)
encodedLength, lengthErr := ctx.Mem.Read32(descriptor + 8)
encodedAlignment, alignmentErr := ctx.Mem.Read32(descriptor + 12)
minimum, minimumErr := ctx.Mem.Read64(descriptor + 16)
maximum, maximumErr := ctx.Mem.Read64(descriptor + 24)
if typeErr != nil || flagsErr != nil || lengthErr != nil || alignmentErr != nil ||
minimumErr != nil || maximumErr != nil {
setUint64Return(ctx, 0)
return StatusSuccess
}
length, validLength := decodeMemIoLength(resourceType, flags, encodedLength)
alignment, validAlignment := decodeMemIoLength(resourceType, flags, encodedAlignment)
if !validLength || !validAlignment {
setUint64Return(ctx, 0)
return StatusSuccess
}
if alignmentOut != 0 {
ctx.Mem.Write64(alignmentOut, alignment)
}
if minimumOut != 0 {
ctx.Mem.Write64(minimumOut, minimum)
}
if maximumOut != 0 {
ctx.Mem.Write64(maximumOut, maximum)
}
setUint64Return(ctx, length)
return StatusSuccess
}
Reference in new issue View Git Blame Copy Permalink