libmwemu 0.24.5

x86 32/64bits and system internals emulator, for securely emulating malware and other stuff.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

use crate::tests::helpers;
use crate::*;

#[test]
fn pe64_loader_sets_entrypoint_and_maps_main_image() {
    helpers::setup();

    let mut emu = emu64();
    emu.cfg.maps_folder = helpers::win64_maps_folder();
    emu.load_code(&helpers::test_data_path("exe64win_msgbox.bin"));

    assert!(emu.pe64.is_some(), "PE64 metadata should be loaded");
    assert!(
        emu.maps.is_mapped(emu.regs().rip),
        "RIP should point to mapped memory"
    );

    let map_name = emu.maps.get_addr_name(emu.regs().rip).unwrap_or("unknown");
    assert!(
        map_name.contains("exe64win_msgbox"),
        "entrypoint should belong to sample image map, got {}",
        map_name
    );

    assert!(
        emu.maps.get_map_by_name("exe64win_msgbox.pe").is_some(),
        "main PE header map should exist"
    );
}

#[test]
fn pe64_loader_adds_core_ldr_modules() {
    helpers::setup();

    let mut emu = emu64();
    emu.cfg.maps_folder = helpers::win64_maps_folder();
    emu.load_code(&helpers::test_data_path("exe64win_msgbox.bin"));

    assert!(emu.maps.get_map_by_name("ntdll.pe").is_some());
    assert!(emu.maps.get_map_by_name("kernel32.pe").is_some());
    assert!(emu.maps.get_map_by_name("kernelbase.pe").is_some());
}

#[test]
fn pe64_loader_normalizes_api_set_dependencies() {
    helpers::setup();

    let mut emu = emu64();
    emu.cfg.maps_folder = helpers::win64_maps_folder();
    emu.load_code(&helpers::test_data_path("exe64win_mingw.bin"));

    let mut pe = emu.pe64.take().expect("PE64 metadata should be present");
    let deps = pe.get_dependencies(&mut emu);
    emu.pe64 = Some(pe);
    assert!(!deps.is_empty(), "dependencies should not be empty");
    assert!(
        deps.iter().all(|d| !d.starts_with("api-ms-win-")),
        "api-set dependencies should be normalized, got {:?}",
        deps
    );
    assert!(
        deps.iter().any(|d| d == "kernelbase"),
        "normalized dependencies should include kernelbase, got {:?}",
        deps
    );
}