libmwemu 0.24.3

x86 32/64bits and system internals emulator, for securely emulating malware and other stuff.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

use crate::emu::Emu;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum ApiAbi {
    Aarch64,
    X86_64,
}

impl ApiAbi {
    #[inline]
    pub fn from_emu(emu: &Emu) -> Self {
        if emu.cfg.arch.is_x64() {
            Self::X86_64
        } else {
            Self::Aarch64
        }
    }

    #[inline]
    pub fn arg(self, emu: &Emu, idx: usize) -> u64 {
        match self {
            Self::Aarch64 => {
                let regs = emu.regs_aarch64();
                regs.x.get(idx).copied().unwrap_or_else(|| {
                    panic!("AArch64 API arg{} is out of range", idx);
                })
            }
            Self::X86_64 => match idx {
                0 => {
                    let regs = emu.regs();
                    regs.rdi
                }
                1 => {
                    let regs = emu.regs();
                    regs.rsi
                }
                2 => {
                    let regs = emu.regs();
                    regs.rdx
                }
                3 => {
                    let regs = emu.regs();
                    regs.rcx
                }
                4 => {
                    let regs = emu.regs();
                    regs.r8
                }
                5 => {
                    let regs = emu.regs();
                    regs.r9
                }
                _ => panic!("x86_64 API arg{} is out of range", idx),
            },
        }
    }

    #[inline]
    pub fn set_ret(self, emu: &mut Emu, value: u64) {
        match self {
            Self::Aarch64 => emu.regs_aarch64_mut().x[0] = value,
            Self::X86_64 => emu.regs_mut().rax = value,
        }
    }
}