int32_t env_w32_hook__execv(struct emu_env *env, struct emu_env_hook *hook)
{
logDebug(env->emu, "Hook me Captain Cook!\n");
logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__);
struct emu_cpu *c = emu_cpu_get(env->emu);
uint32_t eip_save;
POP_DWORD(c, &eip_save);
/*
intptr_t _execv(
const char *cmdname,
const char *const *argv
);
intptr_t _wexecv(
const wchar_t *cmdname,
const wchar_t *const *argv
);
*/
uint32_t p_cmdname;
POP_DWORD(c, &p_cmdname);
struct emu_string *cmdname = emu_string_new();
emu_memory_read_string(c->mem, p_cmdname, cmdname, 512);
uint32_t p_argv;
POP_DWORD(c, &p_argv);
if ( env->profile != NULL )
{
emu_profile_function_add(env->profile, "_execv");
emu_profile_argument_add_ptr(env->profile, "const char *", "cmdname", p_cmdname);
emu_profile_argument_add_string(env->profile, "", "", emu_string_char(cmdname));
emu_profile_argument_add_ptr(env->profile, "const char *const *", "argv", p_argv);
emu_profile_argument_add_none(env->profile);
emu_profile_function_returnvalue_int_set(env->profile, "int ", 0);
}
emu_string_free(cmdname);
emu_cpu_eip_set(c, eip_save);
return 0;
}
int32_t __stdcall new_user_hook_LoadLibraryA(struct emu_env_w32 *win, struct emu_env_w32_dll_export *ex)
{
/* LoadLibraryA(LPCTSTR lpFileName); */
struct emu_string *dllstr = emu_string_new();
uint32_t eip_save;
uint32_t dllname_ptr;
POP_DWORD(cpu, &eip_save);
POP_DWORD(cpu, &dllname_ptr);
emu_memory_read_string(mem, dllname_ptr, dllstr, 256);
char *dllname = emu_string_char(dllstr);
printf("%x\tLoadLibraryA(%s) = 0x7800000\t\n", cpu->eip , dllname);
printf("\t--> HOOK RAN OK returns to: %x\n", eip_save);
cpu->reg[eax] = 0x7800000;
emu_string_free(dllstr);
emu_cpu_eip_set(cpu, eip_save);
return 0;
}
int32_t env_linux_hook_execve(struct emu_env *env, struct emu_env_hook *hook)
{
printf("execve\n");
struct emu_cpu *c = emu_cpu_get(env->emu);
struct emu_string *name = emu_string_new();
emu_memory_read_string(emu_memory_get(c->emu), c->reg[ebx], name, 255);
if ( env->profile != NULL )
{
emu_profile_function_add(env->profile, "execve");
emu_profile_argument_add_ptr(env->profile, "const char *", "dateiname", c->reg[ebx]);
emu_profile_argument_add_string(env->profile, "", "", emu_string_char(name));
// emu_profile_argument_add_ptr(env->profile, "", "", c->reg[ecx]);
emu_profile_argument_array_start(env->profile, "const char *", "argv[]");
}
uint32_t p_array = c->reg[ecx];
uint32_t p_arg = -1;
emu_memory_read_dword(emu_memory_get(c->emu), p_array, &p_arg);
int i=1;
// char **argv = NULL;
while (p_arg != 0)
{
// argv = realloc(argv, (i+1) * sizeof(char *));
// argv[i] = NULL;
struct emu_string *arg = emu_string_new();
emu_memory_read_string(emu_memory_get(c->emu), p_arg, arg, 128);
// argv[i-1] = strdup(emu_string_char(arg));
if( emu_string_char(arg) == NULL )
{
emu_string_free(arg);
break;
}
if ( env->profile != NULL )
{
emu_profile_argument_add_ptr(env->profile, "", "", p_array+((i-1)*4));
emu_profile_argument_add_ptr(env->profile, "", "", p_arg);
emu_profile_argument_add_string(env->profile, "", "", emu_string_char(arg));
}
emu_string_free(arg);
emu_memory_read_dword(emu_memory_get(c->emu), p_array+(i*4), &p_arg);
i++;
}
if ( env->profile != NULL )
{
emu_profile_argument_add_ptr(env->profile, "", "", p_arg);
emu_profile_argument_add_none(env->profile);
// printf("arg is %s\n", emu_string_char(arg));
emu_profile_argument_array_end(env->profile);
emu_profile_argument_add_ptr(env->profile, "const char *", "envp[]", c->reg[edx]);
emu_profile_argument_add_none(env->profile);
emu_profile_function_returnvalue_int_set(env->profile, "int", 0);
}
printf("int execve (const char *dateiname=%08x={%s}, const char * argv[], const char *envp[]);\n",
c->reg[ebx],
emu_string_char(name));
emu_string_free(name);
return 0;
}
int32_t env_w32_hook_fopen(struct emu_env *env, struct emu_env_hook *hook)
{
logDebug(env->emu, "Hook me Captain Cook!\n");
logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__);
struct emu_cpu *c = emu_cpu_get(env->emu);
uint32_t eip_save;
POP_DWORD(c, &eip_save);
/*
FILE *fopen( const char *filename, const char *mode );
FILE *_wfopen( const wchar_t *filename, const wchar_t *mode );
*/
uint32_t p_filename;
MEM_DWORD_READ(c, c->reg[esp], &p_filename);
struct emu_string *filename = emu_string_new();
emu_memory_read_string(c->mem, p_filename, filename, 512);
uint32_t p_mode;
MEM_DWORD_READ(c, c->reg[esp]+4, &p_mode);
struct emu_string *mode = emu_string_new();
emu_memory_read_string(c->mem, p_mode, mode, 512);
// printf("fopen(%s, %s)\n", emu_string_char(filename), (char *)mode->data);
uint32_t returnvalue;
if ( hook->hook.win->userhook != NULL )
{
returnvalue = hook->hook.win->userhook(env, hook,
emu_string_char(filename),
emu_string_char(mode));
}else
{
returnvalue = 0x89898989;
}
emu_cpu_reg32_set(c, eax, returnvalue);
if (env->profile != NULL)
{
emu_profile_function_add(env->profile, "fopen");
emu_profile_argument_add_ptr(env->profile, "const char *", "filename", p_filename);
emu_profile_argument_add_string(env->profile, "", "", emu_string_char(filename));
emu_profile_argument_add_ptr(env->profile, "const char *", "mode", p_mode);
emu_profile_argument_add_string(env->profile, "", "", emu_string_char(mode));
emu_profile_function_returnvalue_ptr_set(env->profile, "FILE *", returnvalue);
emu_profile_argument_add_none(env->profile);
}
emu_string_free(filename);
emu_string_free(mode);
emu_cpu_eip_set(c, eip_save);
return 0;
}
