libmwemu 0.24.0

x86 32/64bits and system internals emulator, for securely emulating malware and other stuff.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

use crate::emu;

pub fn GetSystemDirectoryW(emu: &mut emu::Emu) {
    let out_buff_ptr = emu.regs().rcx;
    let size = emu.regs().rdx as u32;

    log_red!(
        emu,
        "kernel32!GetSystemDirectoryW lpBuffer: 0x{:x} uSize: {}",
        out_buff_ptr,
        size
    );

    let system_dir = emu.cfg.system_directory.clone();
    let required_length = system_dir.len() + 1; // +1 for null terminator

    // If buffer is NULL, return required size
    if out_buff_ptr == 0 {
        emu.regs_mut().rax = required_length as u64;
        return;
    }

    // Check if buffer is mapped
    if !emu.maps.is_mapped(out_buff_ptr) {
        log::error!(
            "GetSystemDirectoryW: lpBuffer 0x{:x} is not mapped",
            out_buff_ptr
        );
        emu.regs_mut().rax = 0; // Failure
        return;
    }

    // If buffer is too small, return required size
    if (size as usize) < required_length {
        log::warn!(
            "GetSystemDirectoryW: Buffer too small. Need {} chars, got {}",
            required_length,
            size
        );
        emu.regs_mut().rax = required_length as u64;
        return;
    }

    // Buffer is large enough, write the directory
    emu.maps.write_wide_string(out_buff_ptr, &system_dir);

    log_red!(
        emu,
        "GetSystemDirectoryW returning: '{}' (length: {})",
        system_dir,
        system_dir.len()
    );

    // Return number of characters written (NOT including null terminator)
    emu.regs_mut().rax = system_dir.len() as u64;
}