libmwemu 0.24.5

x86 32/64bits and system internals emulator, for securely emulating malware and other stuff.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96

use crate::emu;
use crate::winapi::helper;

pub fn FindResourceW(emu: &mut emu::Emu) {
    let handle = emu.regs().rcx as usize;
    let lpName = emu.regs().rdx as usize;
    let lpType = emu.regs().r8 as usize;

    let x: Option<(u64, usize)>;

    if lpName > 0xff && lpType > 0xff {
        let name = emu.maps.read_wide_string(lpName as u64);
        let ntype = emu.maps.read_wide_string(lpType as u64);
        log_red!(
            emu,
            "** {} kernel32!FindResourceW {:x} `{}` `{}`",
            emu.pos,
            handle,
            name,
            ntype
        );

        x = emu
            .pe32
            .as_ref()
            .unwrap()
            .get_resource(None, None, Some(&name), Some(&ntype));
    } else if lpName > 0xff && lpType <= 0xff {
        let name = emu.maps.read_wide_string(lpName as u64);
        log_red!(
            emu,
            "** {} kernel32!FindResourceW {:x} `{}` {}",
            emu.pos,
            handle,
            name,
            lpType
        );

        x = emu
            .pe32
            .as_ref()
            .unwrap()
            .get_resource(Some(lpType as u32), None, Some(&name), None);
    } else if lpName <= 0xff && lpType > 0xff {
        let ntype = emu.maps.read_wide_string(lpType as u64);
        log_red!(
            emu,
            "** {} kernel32!FindResourceW {:x} `{}` {}",
            emu.pos,
            handle,
            lpName,
            ntype
        );

        x = emu
            .pe32
            .as_ref()
            .unwrap()
            .get_resource(None, Some(lpName as u32), None, Some(&ntype));
    } else if lpName <= 0xff && lpType <= 0xff {
        log_red!(
            emu,
            "** {} kernel32!FindResourceW {:x} `{}` {}",
            emu.pos,
            handle,
            lpName,
            lpType
        );

        x = emu.pe32.as_ref().unwrap().get_resource(
            Some(lpType as u32),
            Some(lpName as u32),
            None,
            None,
        );
    } else {
        unreachable!();
    }

    for _ in 0..3 {
        emu.stack_pop32(false);
    }

    if x.is_none() {
        log::trace!("{} resource not found!", emu.pos);
        emu.regs_mut().rax = 0;
        return;
    }

    let (addr, size) = x.unwrap();

    log::trace!("resource addr: 0x{:x} sz: {}", addr, size);
    let hndl = helper::handler_create(&format!("rsrc://{:x}_{}", addr, size));

    emu.regs_mut().rax = hndl;
}