libmwemu 0.25.4

x86 32/64bits and system internals emulator, for securely emulating malware and other stuff.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143

use crate::{
    emu::Emu, regs_aarch64::RegsAarch64, regs64::Regs64, threading::context::ArchThreadState,
};

impl Emu {
    // Forwarding methods for thread-specific fields
    pub fn regs(&self) -> &Regs64 {
        match &self.threads[self.current_thread_id].arch {
            ArchThreadState::X86 { regs, .. } => regs,
            _ => unreachable!("regs() called on aarch64 emu"),
        }
    }

    pub fn regs_mut(&mut self) -> &mut Regs64 {
        match &mut self.threads[self.current_thread_id].arch {
            ArchThreadState::X86 { regs, .. } => regs,
            _ => unreachable!("regs_mut() called on aarch64 emu"),
        }
    }

    // AArch64 register accessors
    pub fn regs_aarch64(&self) -> &RegsAarch64 {
        match &self.threads[self.current_thread_id].arch {
            ArchThreadState::AArch64 { regs, .. } => regs,
            _ => unreachable!("regs_aarch64 called on non-aarch64 emu"),
        }
    }

    pub fn regs_aarch64_mut(&mut self) -> &mut RegsAarch64 {
        match &mut self.threads[self.current_thread_id].arch {
            ArchThreadState::AArch64 { regs, .. } => regs,
            _ => unreachable!("regs_aarch64_mut called on non-aarch64 emu"),
        }
    }

    // Unified program counter for shared code paths
    pub fn pc(&self) -> u64 {
        match &self.threads[self.current_thread_id].arch {
            ArchThreadState::X86 { regs, .. } => regs.rip,
            ArchThreadState::AArch64 { regs, .. } => regs.pc,
        }
    }

    pub fn set_pc(&mut self, addr: u64) {
        match &mut self.threads[self.current_thread_id].arch {
            ArchThreadState::X86 { regs, .. } => regs.rip = addr,
            ArchThreadState::AArch64 { regs, .. } => regs.pc = addr,
        }
    }

    // Unified stack pointer
    pub fn sp(&self) -> u64 {
        match &self.threads[self.current_thread_id].arch {
            ArchThreadState::X86 { regs, .. } => regs.rsp,
            ArchThreadState::AArch64 { regs, .. } => regs.sp,
        }
    }

    pub fn set_sp(&mut self, addr: u64) {
        match &mut self.threads[self.current_thread_id].arch {
            ArchThreadState::X86 { regs, .. } => regs.rsp = addr,
            ArchThreadState::AArch64 { regs, .. } => regs.sp = addr,
        }
    }

    pub fn set_pre_op_regs(&mut self, new_regs: Regs64) {
        self.trace_mut_x86().pre_regs = new_regs;
    }

    pub fn set_post_op_regs(&mut self, new_regs: Regs64) {
        self.trace_mut_x86().post_regs = new_regs;
    }

    pub fn pre_op_regs(&self) -> &Regs64 {
        &self.trace_ref_x86().pre_regs
    }

    pub fn pre_op_regs_mut(&mut self) -> &mut Regs64 {
        &mut self.trace_mut_x86().pre_regs
    }

    pub fn post_op_regs(&self) -> &Regs64 {
        &self.trace_ref_x86().post_regs
    }

    pub fn post_op_regs_mut(&mut self) -> &mut Regs64 {
        &mut self.trace_mut_x86().post_regs
    }

    pub fn pre_op_regs_aarch64(&self) -> &RegsAarch64 {
        &self.trace_ref_aarch64().pre_regs
    }
    pub fn pre_op_regs_aarch64_mut(&mut self) -> &mut RegsAarch64 {
        &mut self.trace_mut_aarch64().pre_regs
    }

    pub fn post_op_regs_aarch64_mut(&mut self) -> &mut RegsAarch64 {
        &mut self.trace_mut_aarch64().post_regs
    }

    pub fn post_op_regs_aarch64(&self) -> &RegsAarch64 {
        &self.trace_ref_aarch64().post_regs
    }

    #[inline(always)]
    fn trace_ref_x86(&self) -> &crate::threading::context::X86TraceSnapshot {
        match &self.threads[self.current_thread_id].arch {
            crate::threading::context::ArchThreadState::X86 { .. } => {}
            _ => unreachable!("x86 trace snapshot requested on aarch64 thread"),
        }
        self.threads[self.current_thread_id].arch.x86_trace_ref()
    }

    fn trace_mut_x86(&mut self) -> &mut crate::threading::context::X86TraceSnapshot {
        match &mut self.threads[self.current_thread_id].arch {
            crate::threading::context::ArchThreadState::X86 { .. } => {}
            _ => unreachable!("x86 trace snapshot requested on aarch64 thread"),
        }
        self.threads[self.current_thread_id].arch.x86_trace_mut()
    }

    #[inline(always)]
    fn trace_mut_aarch64(&mut self) -> &mut crate::threading::context::AArch64TraceSnapshot {
        match &mut self.threads[self.current_thread_id].arch {
            crate::threading::context::ArchThreadState::AArch64 { .. } => {}
            _ => unreachable!("aarch64 trace snapshot requested on x86 thread"),
        }
        self.threads[self.current_thread_id]
            .arch
            .aarch64_trace_mut()
    }

    #[inline(always)]
    fn trace_ref_aarch64(&self) -> &crate::threading::context::AArch64TraceSnapshot {
        match &self.threads[self.current_thread_id].arch {
            crate::threading::context::ArchThreadState::AArch64 { .. } => {}
            _ => unreachable!("aarch64 trace snapshot requested on x86 thread"),
        }
        self.threads[self.current_thread_id]
            .arch
            .aarch64_trace_ref()
    }
}