emu_env_w32.h File Reference

#include <stdint.h>

Include dependency graph for emu_env_w32.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Classes
struct	emu_env_w32
Functions
struct emu_env_w32 *	emu_env_w32_new (struct emu *e)
void	emu_env_w32_free (struct emu_env_w32 *env)
int32_t	emu_env_w32_load_dll (struct emu_env_w32 *env, char *path)
int32_t	emu_env_w32_export_hook (struct emu_env *env, const char *exportname, uint32_t(*fnhook)(struct emu_env *env, struct emu_env_hook *hook,...), void *userdata)
struct emu_env_hook *	emu_env_w32_eip_check (struct emu_env *env)

---

Function Documentation

struct emu_env_hook* emu_env_w32_eip_check

(

struct emu_env *

env

)

[read]

Check if eip is within a loaded dll,

• call the dll's export function

Parameters:

env

the env

Returns:

on success: pointer to the dll_export on failure: NULL

References emu_env_w32_dll::baseaddr, emu_cpu_eip_get(), emu_cpu_get(), emu_hashtable_search(), emu_env_w32_dll::exports_by_fnptr, logDebug, and emu_hashtable_item::value.

Referenced by emu_shellcode_run_and_track().

Here is the call graph for this function:

int32_t emu_env_w32_export_hook	(	struct emu_env *	env,
		const char *	exportname,
		uint32_t(*)(struct emu_env *env, struct emu_env_hook *hook,...)	fnhook,
		void *	userdata
	)

Hook an dll export from a dll

Parameters:

	env	the env
	exportname	the exportname, f.e. "socket"
	fnhook	pointer to the hook function

Returns:

on success: 0 on failure: -1

References emu_hashtable_search(), and emu_hashtable_item::value.

Here is the call graph for this function:

void emu_env_w32_free

(

struct emu_env_w32 *

env

)

Free the emu_env_w32, free all dlls etc

Parameters:

env

the env to free

References emu_env_w32_dll_free(), and emu_env_w32::loaded_dlls.

Here is the call graph for this function:

int32_t emu_env_w32_load_dll	(	struct emu_env_w32 *	env,
		char *	path
	)

References emu_env_w32_known_dll_segment::address, emu_env_w32_dll::baseaddr, emu_env_w32_known_dll::baseaddress, emu_env_w32_dll::dllname, emu_env_w32_known_dll::dllname, emu_env_w32::emu, emu_env_w32_dll_exports_copy(), emu_env_w32_dll_new(), emu_memory_get(), emu_memory_write_block(), emu_env_w32_known_dll::imagesize, emu_env_w32_dll::imagesize, emu_env_w32::loaded_dlls, logDebug, emu_env_w32_known_dll::memory_segments, and emu_env_w32_known_dll_segment::segment_size.

Referenced by emu_env_w32_new(), and env_w32_hook_LoadLibrayA().

Here is the call graph for this function:

struct emu_env_w32* emu_env_w32_new

(

struct emu *

e

)

[read]

Create a new emu_env_w32 environment

Parameters:

e

the emulation to create the w32 process environment in

Returns:

on success: pointer to the emu_env_w32 create on failure: NULL

References emu_env_w32_known_dll::baseaddress, emu_env_w32_known_dll::dllname, emu_env_w32::emu, emu_env_w32_load_dll(), emu_memory_get(), emu_memory_segment_get(), emu_memory_segment_select(), emu_memory_write_block(), emu_memory_write_dword(), and s_fs.

Here is the call graph for this function: