libmwemu 0.24.3

x86 32/64bits and system internals emulator, for securely emulating malware and other stuff.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

mod advapi32;
mod crypt32;
mod dnsapi;
mod iphlpapi;
pub mod kernel32;
mod kernelbase;
mod libgcc;
mod mscoree;
mod msvcrt;
mod ntdll;
mod ntoskrnl;
mod oleaut32;
mod shell32;
mod shlwapi;
mod urlmon;
mod user32;
mod wincrt;
mod wininet;
mod ws2_32;

use crate::emu;

pub fn gateway(addr: u32, name: &str, emu: &mut emu::Emu) {
    emu.regs_mut().sanitize32();
    match name {
        "kernel32.text" => kernel32::gateway(addr, emu),
        "kernel32.rdata" => kernel32::gateway(addr, emu),
        "ntdll.text" => ntdll::gateway(addr, emu),
        "user32.text" => user32::gateway(addr, emu),
        "ws2_32.text" => ws2_32::gateway(addr, emu),
        "wininet.text" => wininet::gateway(addr, emu),
        "advapi32.text" => advapi32::gateway(addr, emu),
        "crypt32.text" => crypt32::gateway(addr, emu),
        "dnsapi.text" => dnsapi::gateway(addr, emu),
        "mscoree.text" => mscoree::gateway(addr, emu),
        "msvcrt.text" => msvcrt::gateway(addr, emu),
        "shell32.text" => shell32::gateway(addr, emu),
        "shlwapi.text" => shlwapi::gateway(addr, emu),
        "urlmon.text" => urlmon::gateway(addr, emu),
        "oleaut32.text" => oleaut32::gateway(addr, emu),
        "kernelbase.text" => kernelbase::gateway(addr, emu),
        "iphlpapi.text" => iphlpapi::gateway(addr, emu),
        "libgcc_s_dw2-1.text" => libgcc::gateway(addr, emu),
        "api-ms-win-crt-runtime-l1-1-0.text" => wincrt::gateway(addr, emu),
        "ntoskrnl.text" => ntoskrnl::gateway(addr, emu),
        "ntoskrnlPAGE" => ntoskrnl::gateway(addr, emu),
        "not_loaded" => {
            // TODO: banzai check?
            emu.pe32.as_ref().unwrap().import_addr_to_name(addr)
        }
        _ => panic!(
            "/!\\ winapi32 gateway: trying to execute on {} at 0x{:x}",
            name, addr
        ),
    };
    emu.call_stack_mut().pop();
}