This commit is contained in:
huoji
2025-03-20 14:50:58 +08:00
parent 91dca661ba
commit a96ee2e166
3 changed files with 36 additions and 4 deletions

View File

@@ -314,7 +314,7 @@ auto doMalwareScan(int argc, char* argv[]) -> void {
int doSandbox(int argc, char* argv[]) {
std::string filePath = "Z:\\opengl32.dll";
std::string filePath = "C:\\wangkun_muma\\opengl32.dll.bin";
auto peInfo = getPeInfo(filePath);
if (peInfo == nullptr) {
std::cout << "无法加载PE文件: " << filePath << std::endl;

View File

@@ -1,5 +1,5 @@
#pragma once
#define LOG_LEVEL 1
#define LOG_LEVEL 0
#define _CRT_SECURE_NO_WARNINGS
#include <iostream>

View File

@@ -396,8 +396,40 @@ auto Api_URLDownloadToFileW(void* sandbox, uc_engine* uc, uint64_t address)
// 读取URL (宽字符)
std::wstring wUrlString;
if (szURL != 0) {
wchar_t buffer[1024] = {0};
uc_mem_read(uc, szURL, buffer, sizeof(buffer) - sizeof(wchar_t));
wchar_t buffer[4096] = {0};
// 循环读取URL,每次读取一个wchar_t字符
size_t totalRead = 0;
const size_t maxSize =
sizeof(buffer) - sizeof(wchar_t); // 预留null终止符空间
bool readError = false;
while (totalRead < maxSize) {
wchar_t ch = 0;
auto ucError =
uc_mem_read(uc, szURL + totalRead, &ch, sizeof(wchar_t));
if (ucError != UC_ERR_OK) {
readError = true;
break;
}
// 检查是否遇到宽字符终止符(0x0000)
if (ch == 0x0000) {
break;
}
buffer[totalRead / sizeof(wchar_t)] = ch;
totalRead += sizeof(wchar_t);
}
// 确保字符串以宽字符null结尾
buffer[totalRead / sizeof(wchar_t)] = 0x0000;
if (readError) {
printf("[警告] URL读取时发生错误\n");
__debugbreak();
}
wUrlString = buffer;
// 转换为UTF-8字符串用于日志记录