int32_t env_w32_hook__execv(struct emu_env *env, struct emu_env_hook *hook)
{
logDebug(env->emu, "Hook me Captain Cook!\n");
logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__);
struct emu_cpu *c = emu_cpu_get(env->emu);
uint32_t eip_save;
POP_DWORD(c, &eip_save);
/*
intptr_t _execv(
const char *cmdname,
const char *const *argv
);
intptr_t _wexecv(
const wchar_t *cmdname,
const wchar_t *const *argv
);
*/
uint32_t p_cmdname;
POP_DWORD(c, &p_cmdname);
struct emu_string *cmdname = emu_string_new();
emu_memory_read_string(c->mem, p_cmdname, cmdname, 512);
uint32_t p_argv;
POP_DWORD(c, &p_argv);
if ( env->profile != NULL )
{
emu_profile_function_add(env->profile, "_execv");
emu_profile_argument_add_ptr(env->profile, "const char *", "cmdname", p_cmdname);
emu_profile_argument_add_string(env->profile, "", "", emu_string_char(cmdname));
emu_profile_argument_add_ptr(env->profile, "const char *const *", "argv", p_argv);
emu_profile_argument_add_none(env->profile);
emu_profile_function_returnvalue_int_set(env->profile, "int ", 0);
}
emu_string_free(cmdname);
emu_cpu_eip_set(c, eip_save);
return 0;
}
int32_t env_w32_hook_fclose(struct emu_env *env, struct emu_env_hook *hook)
{
logDebug(env->emu, "Hook me Captain Cook!\n");
logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__);
struct emu_cpu *c = emu_cpu_get(env->emu);
uint32_t eip_save;
POP_DWORD(c, &eip_save);
/*
int _fcloseall( void );
int fclose( FILE *stream );
*/
uint32_t p_stream;
MEM_DWORD_READ(c, c->reg[esp], &p_stream);
logDebug(env->emu, "fclose(0x%08x)\n", p_stream);
emu_cpu_reg32_set(c, eax, 0);
if (env->profile != NULL)
{
emu_profile_function_add(env->profile, "fclose");
emu_profile_argument_add_ptr(env->profile, "FILE *", "stream", p_stream);
emu_profile_argument_add_none(env->profile);
emu_profile_function_returnvalue_int_set(env->profile, "int", 0);
}
emu_cpu_eip_set(c, eip_save);
return 0;
}
int32_t env_linux_hook_execve(struct emu_env *env, struct emu_env_hook *hook)
{
printf("execve\n");
struct emu_cpu *c = emu_cpu_get(env->emu);
struct emu_string *name = emu_string_new();
emu_memory_read_string(emu_memory_get(c->emu), c->reg[ebx], name, 255);
if ( env->profile != NULL )
{
emu_profile_function_add(env->profile, "execve");
emu_profile_argument_add_ptr(env->profile, "const char *", "dateiname", c->reg[ebx]);
emu_profile_argument_add_string(env->profile, "", "", emu_string_char(name));
// emu_profile_argument_add_ptr(env->profile, "", "", c->reg[ecx]);
emu_profile_argument_array_start(env->profile, "const char *", "argv[]");
}
uint32_t p_array = c->reg[ecx];
uint32_t p_arg = -1;
emu_memory_read_dword(emu_memory_get(c->emu), p_array, &p_arg);
int i=1;
// char **argv = NULL;
while (p_arg != 0)
{
// argv = realloc(argv, (i+1) * sizeof(char *));
// argv[i] = NULL;
struct emu_string *arg = emu_string_new();
emu_memory_read_string(emu_memory_get(c->emu), p_arg, arg, 128);
// argv[i-1] = strdup(emu_string_char(arg));
if( emu_string_char(arg) == NULL )
{
emu_string_free(arg);
break;
}
if ( env->profile != NULL )
{
emu_profile_argument_add_ptr(env->profile, "", "", p_array+((i-1)*4));
emu_profile_argument_add_ptr(env->profile, "", "", p_arg);
emu_profile_argument_add_string(env->profile, "", "", emu_string_char(arg));
}
emu_string_free(arg);
emu_memory_read_dword(emu_memory_get(c->emu), p_array+(i*4), &p_arg);
i++;
}
if ( env->profile != NULL )
{
emu_profile_argument_add_ptr(env->profile, "", "", p_arg);
emu_profile_argument_add_none(env->profile);
// printf("arg is %s\n", emu_string_char(arg));
emu_profile_argument_array_end(env->profile);
emu_profile_argument_add_ptr(env->profile, "const char *", "envp[]", c->reg[edx]);
emu_profile_argument_add_none(env->profile);
emu_profile_function_returnvalue_int_set(env->profile, "int", 0);
}
printf("int execve (const char *dateiname=%08x={%s}, const char * argv[], const char *envp[]);\n",
c->reg[ebx],
emu_string_char(name));
emu_string_free(name);
return 0;
}
int32_t env_linux_hook_socketcall(struct emu_env *env, struct emu_env_hook *hook)
{
struct emu_cpu *c = emu_cpu_get(env->emu);
#define AL(x) (x)
static unsigned char nargs[18]={AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
AL(3),AL(3),AL(4),AL(4),AL(4),AL(6),
AL(6),AL(2),AL(5),AL(5),AL(3),AL(3)};
#undef AL
uint32_t a[6];
int i;
for ( i=0;i<nargs[c->reg[ebx]];i++ )
{
emu_memory_read_dword(emu_memory_get(c->emu),c->reg[ecx]+4*i,a+i);
}
uint32_t returnvalue = 0;
switch ( c->reg[ebx] )
{
case 1: // SYS_SOCKET
printf("int socket(int domain=%i, int type=%i, int protocol=%i);\n",
a[0],
a[1],
a[2]);
if (hook->hook.lin->userhook != NULL)
returnvalue = hook->hook.lin->userhook(env, hook, a[0], a[1], a[2]);
else
returnvalue = 14;
if ( env->profile != NULL )
{
emu_profile_function_add(env->profile, "socket");
emu_profile_argument_add_int(env->profile, "int", "domain", a[0]);
emu_profile_argument_add_int(env->profile, "int", "type", a[1]);
emu_profile_argument_add_int(env->profile, "int", "protocol", a[2]);
emu_profile_function_returnvalue_int_set(env->profile, "int", returnvalue);
}
emu_cpu_reg32_set(c, eax, returnvalue);
break;
case 2: // SYS_BIND
{
/*
printf("int bind(int sockfd=%i, struct sockaddr *my_addr=%08x={host %s port %i}, int addrlen);\n",
a[0],
a[1], inet_ntoa(*(struct in_addr *)&((struct sockaddr_in *)&sa)->sin_addr), ntohs(((struct sockaddr_in *)&sa)->sin_port)
);
*/
struct sockaddr sa;
memset(&sa, 0, sizeof(struct sockaddr));
emu_memory_read_block(emu_memory_get(c->emu), a[1], &sa, sizeof(struct sockaddr));
if (hook->hook.lin->userhook != NULL)
returnvalue = hook->hook.lin->userhook(env, hook, a[0], &sa, a[2]);
else
returnvalue = 0;
if (env->profile != NULL)
{
emu_profile_function_add(env->profile, "bind");
emu_profile_argument_add_int(env->profile, "int", "sockfd", a[0]);
emu_profile_argument_add_sockaddr_ptr(env->profile, "my_addr", a[1], sa);
emu_profile_argument_add_int(env->profile, "int", "addrlen", a[2]);
emu_profile_function_returnvalue_int_set(env->profile, "int", returnvalue);
}
emu_cpu_reg32_set(c, eax, returnvalue);
}
break;
case 3: // SYS_CONNECT
{
printf("connect\n");
struct sockaddr sa;
memset(&sa, 0, sizeof(struct sockaddr));
emu_memory_read_block(emu_memory_get(c->emu), a[1], &sa, sizeof(struct sockaddr));
if (hook->hook.lin->userhook != NULL)
returnvalue = hook->hook.lin->userhook(env, hook, a[0], &sa, a[2]);
else
returnvalue = 0;
if (env->profile != NULL)
{
emu_profile_function_add(env->profile, "connect");
emu_profile_argument_add_int(env->profile, "int", "sockfd", a[0]);
emu_profile_argument_add_sockaddr_ptr(env->profile, "serv_addr", a[1], sa);
emu_profile_argument_add_int(env->profile, "int", "addrlen", a[2]);
emu_profile_function_returnvalue_int_set(env->profile, "int", returnvalue);
}
emu_cpu_reg32_set(c, eax, returnvalue);
}
break;
case 4: // SYS_LISTEN
printf("int listen(int s=%i, int backlog=%i);\n",
a[0],
a[1]);
if (hook->hook.lin->userhook != NULL)
returnvalue = hook->hook.lin->userhook(env, hook, a[0], a[1]);
else
returnvalue = 0;
if (env->profile != NULL)
{
emu_profile_function_add(env->profile, "listen");
emu_profile_argument_add_int(env->profile, "int", "s", a[0]);
emu_profile_argument_add_int(env->profile, "int", "backlog", a[1]);
emu_profile_function_returnvalue_int_set(env->profile, "int", returnvalue);
}
emu_cpu_reg32_set(c, eax, returnvalue);
break;
case 5: // SYS_ACCEPT
printf("int accept(int s=%i, struct sockaddr *addr=%08x, int *addrlen=%08x);\n",
a[0],
a[1],
a[2]);
struct sockaddr sa;
memset(&sa, 0, sizeof(struct sockaddr));
emu_memory_read_block(emu_memory_get(c->emu), a[1], &sa, sizeof(struct sockaddr));
if (hook->hook.lin->userhook != NULL)
returnvalue = hook->hook.lin->userhook(env, hook, a[0], &sa, a[2]);
else
returnvalue = 19;
if (env->profile != NULL)
{
emu_profile_function_add(env->profile, "accept");
emu_profile_argument_add_int(env->profile, "int", "sockfd", a[0]);
emu_profile_argument_add_ptr(env->profile, "sockaddr_in *", "addr", a[1]);
emu_profile_argument_add_none(env->profile);
emu_profile_argument_add_ptr(env->profile, "int", "addrlen", a[2]);
emu_profile_argument_add_none(env->profile);
emu_profile_function_returnvalue_int_set(env->profile, "int", returnvalue);
}
emu_cpu_reg32_set(c, eax, returnvalue);
break;
case 6: // SYS_GETSOCKNAME
printf("sys_getsockname(2)\n");
break;
case 7: // SYS_GETPEERNAME
printf("sys_getpeername(2)\n");
break;
case 8: // SYS_SOCKETPAIR
printf("sys_socketpair(2)\n");
break;
case 9: // SYS_SEND
printf("sys_send(2)\n");
break;
case 10: // SYS_RECV
printf("sys_recv(2)\n");
break;
case 11: // SYS_SENDTO
printf("sys_sendto(2)\n");
break;
case 12: // SYS_RECVFROM
printf("sys_recvfrom(2)\n");
break;
case 13: // SYS_SHUTDOWN
printf("sys_shutdown(2)\n");
break;
case 14: // SYS_SETSOCKOPT
printf("sys_setsockopt(2)\n");
break;
case 15: // SYS_GETSOCKOPT
printf("sys_getsockopt(2)\n");
break;
case 16: // SYS_SENDMSG
printf("sys_sendmsg(2)\n");
break;
case 17: // SYS_RECVMSG
printf("sys_recvmsg(2)\n");
break;
default:
printf("syscall %i (%x) unknown", c->reg[ebx], c->reg[ebx]);
}
return 0;
}
int32_t env_w32_hook_fwrite(struct emu_env *env, struct emu_env_hook *hook)
{
logDebug(env->emu, "Hook me Captain Cook!\n");
logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__);
struct emu_cpu *c = emu_cpu_get(env->emu);
uint32_t eip_save;
POP_DWORD(c, &eip_save);
/*
size_t fwrite( const void *buffer, size_t size, size_t count, FILE *stream );
*/
uint32_t p_buffer;
MEM_DWORD_READ(c, c->reg[esp], &p_buffer);
uint32_t size;
MEM_DWORD_READ(c, (c->reg[esp]+4), &size);
uint32_t count;
MEM_DWORD_READ(c, (c->reg[esp]+8), &count);
unsigned char *buffer = malloc(size*count);
emu_memory_read_block(emu_memory_get(env->emu), p_buffer, buffer, size*count);
uint32_t p_stream;
MEM_DWORD_READ(c, c->reg[esp]+12, &p_stream);
uint32_t returnvalue;
if ( hook->hook.win->userhook != NULL )
{
returnvalue = hook->hook.win->userhook(env, hook,
buffer,
size,
count,
p_stream);
}else
{
returnvalue = size*count;
}
logDebug(env->emu, "fwrite(0x%08x, %d, %d, 0x%08x)\n", p_buffer, size, count, p_stream);
emu_cpu_reg32_set(c, eax, returnvalue);
if ( env->profile != NULL )
{
emu_profile_function_add(env->profile, "fwrite");
emu_profile_function_returnvalue_int_set(env->profile, "size_t", returnvalue);
emu_profile_argument_add_ptr(env->profile, "const void *", "buffer", p_buffer);
emu_profile_argument_add_bytea(env->profile, "", "", buffer, size*count);
emu_profile_argument_add_int(env->profile, "size_t", "size", size);
emu_profile_argument_add_int(env->profile, "count_t", "count", count);
emu_profile_argument_add_ptr(env->profile, "FILE *", "stream", p_stream);
emu_profile_argument_add_none(env->profile);
}
free(buffer);
emu_cpu_eip_set(c, eip_save);
return 0;
}
int32_t env_w32_hook_fopen(struct emu_env *env, struct emu_env_hook *hook)
{
logDebug(env->emu, "Hook me Captain Cook!\n");
logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__);
struct emu_cpu *c = emu_cpu_get(env->emu);
uint32_t eip_save;
POP_DWORD(c, &eip_save);
/*
FILE *fopen( const char *filename, const char *mode );
FILE *_wfopen( const wchar_t *filename, const wchar_t *mode );
*/
uint32_t p_filename;
MEM_DWORD_READ(c, c->reg[esp], &p_filename);
struct emu_string *filename = emu_string_new();
emu_memory_read_string(c->mem, p_filename, filename, 512);
uint32_t p_mode;
MEM_DWORD_READ(c, c->reg[esp]+4, &p_mode);
struct emu_string *mode = emu_string_new();
emu_memory_read_string(c->mem, p_mode, mode, 512);
// printf("fopen(%s, %s)\n", emu_string_char(filename), (char *)mode->data);
uint32_t returnvalue;
if ( hook->hook.win->userhook != NULL )
{
returnvalue = hook->hook.win->userhook(env, hook,
emu_string_char(filename),
emu_string_char(mode));
}else
{
returnvalue = 0x89898989;
}
emu_cpu_reg32_set(c, eax, returnvalue);
if (env->profile != NULL)
{
emu_profile_function_add(env->profile, "fopen");
emu_profile_argument_add_ptr(env->profile, "const char *", "filename", p_filename);
emu_profile_argument_add_string(env->profile, "", "", emu_string_char(filename));
emu_profile_argument_add_ptr(env->profile, "const char *", "mode", p_mode);
emu_profile_argument_add_string(env->profile, "", "", emu_string_char(mode));
emu_profile_function_returnvalue_ptr_set(env->profile, "FILE *", returnvalue);
emu_profile_argument_add_none(env->profile);
}
emu_string_free(filename);
emu_string_free(mode);
emu_cpu_eip_set(c, eip_save);
return 0;
}