libmwemu 0.24.5

x86 32/64bits and system internals emulator, for securely emulating malware and other stuff.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139

use crate::emu;
use crate::serialization;
use crate::winapi::winapi32::kernel32;

pub fn gateway(addr: u32, emu: &mut emu::Emu) -> String {
    let api = kernel32::guess_api_name(emu, addr);
    let api = api.split("!").last().unwrap_or(&api);
    match api {
        "ShellExecuteA" => ShellExecuteA(emu),
        "ShellExecuteW" => ShellExecuteW(emu),
        _ => {
            if emu.cfg.skip_unimplemented == false {
                if emu.cfg.dump_on_exit && emu.cfg.dump_filename.is_some() {
                    serialization::Serialization::dump(
                        &emu,
                        emu.cfg.dump_filename.as_ref().unwrap(),
                    );
                }

                unimplemented!("atemmpt to call unimplemented API 0x{:x} {}", addr, api);
            }
            log::warn!(
                "calling unimplemented API 0x{:x} {} at 0x{:x}",
                addr,
                api,
                emu.regs().rip
            );
            return api.to_ascii_lowercase();
        }
    }

    String::new()
}

fn ShellExecuteA(emu: &mut emu::Emu) {
    let hwnd = emu
        .maps
        .read_dword(emu.regs().get_esp())
        .expect("shell32!ShellExecuteA error reading hwnd") as u64;
    let lp_operation = emu
        .maps
        .read_dword(emu.regs().get_esp() + 4)
        .expect("shell32!ShellExecuteA error reading lp_operation") as u64;
    let lp_file = emu
        .maps
        .read_dword(emu.regs().get_esp() + 8)
        .expect("shell32!ShellExecuteA error reading lp_file") as u64;
    let lp_parameters = emu
        .maps
        .read_dword(emu.regs().get_esp() + 12)
        .expect("shell32!ShellExecuteA error reading lp_parameters") as u64;
    let lp_directory = emu
        .maps
        .read_dword(emu.regs().get_esp() + 16)
        .expect("shell32!ShellExecuteA error reading lp_directory") as u64;
    let n_show_cmd = emu
        .maps
        .read_dword(emu.regs().get_esp() + 20)
        .expect("shell32!ShellExecuteA error reading n_show_cmd") as u64;

    let operation = if lp_operation != 0 {
        emu.maps.read_string(lp_operation)
    } else {
        "open".to_string()
    };
    let file = emu.maps.read_string(lp_file);
    let params = if lp_parameters != 0 {
        emu.maps.read_string(lp_parameters)
    } else {
        "".to_string()
    };

    log_red!(
        emu,
        "shell32!ShellExecuteA op: {} file: {} params: {}",
        operation,
        file,
        params
    );

    for _ in 0..6 {
        emu.stack_pop32(false);
    }

    emu.regs_mut().rax = 42; // > 32 means success
}

fn ShellExecuteW(emu: &mut emu::Emu) {
    let hwnd = emu
        .maps
        .read_dword(emu.regs().get_esp())
        .expect("shell32!ShellExecuteW error reading hwnd") as u64;
    let lp_operation = emu
        .maps
        .read_dword(emu.regs().get_esp() + 4)
        .expect("shell32!ShellExecuteW error reading lp_operation") as u64;
    let lp_file = emu
        .maps
        .read_dword(emu.regs().get_esp() + 8)
        .expect("shell32!ShellExecuteW error reading lp_file") as u64;
    let lp_parameters = emu
        .maps
        .read_dword(emu.regs().get_esp() + 12)
        .expect("shell32!ShellExecuteW error reading lp_parameters") as u64;
    let lp_directory = emu
        .maps
        .read_dword(emu.regs().get_esp() + 16)
        .expect("shell32!ShellExecuteW error reading lp_directory") as u64;
    let n_show_cmd = emu
        .maps
        .read_dword(emu.regs().get_esp() + 20)
        .expect("shell32!ShellExecuteW error reading n_show_cmd") as u64;

    let operation = if lp_operation != 0 {
        emu.maps.read_wide_string(lp_operation)
    } else {
        "open".to_string()
    };
    let file = emu.maps.read_wide_string(lp_file);
    let params = if lp_parameters != 0 {
        emu.maps.read_wide_string(lp_parameters)
    } else {
        "".to_string()
    };

    log_red!(
        emu,
        "shell32!ShellExecuteW op: {} file: {} params: {}",
        operation,
        file,
        params
    );

    for _ in 0..6 {
        emu.stack_pop32(false);
    }

    emu.regs_mut().rax = 42; // > 32 means success
}