71 lines
2.2 KiB
C++
71 lines
2.2 KiB
C++
#pragma once
|
|
#include "sandbox.h"
|
|
|
|
namespace sandboxCallbacks {
|
|
static void handleCodeRun(uc_engine* uc, uint64_t address, uint32_t size,
|
|
void* userData) {
|
|
auto* sandbox = static_cast<Sandbox*>(userData);
|
|
if (!sandbox) return;
|
|
|
|
// 读取当前执行的代码
|
|
uint8_t* codeBuffer = new uint8_t[size];
|
|
if (uc_mem_read(uc, address, codeBuffer, size) != UC_ERR_OK) {
|
|
delete[] codeBuffer;
|
|
return;
|
|
}
|
|
|
|
// 使用Capstone反汇编
|
|
cs_insn* instruction;
|
|
size_t instructionCount =
|
|
cs_disasm(sandbox->GetCapstoneHandle(), codeBuffer, size, address, 0,
|
|
&instruction);
|
|
|
|
if (instructionCount > 0) {
|
|
// 打印地址和反汇编结果
|
|
printf("0x%016" PRIx64 " %-12s %s\n", instruction[0].address,
|
|
instruction[0].mnemonic, instruction[0].op_str);
|
|
cs_free(instruction, instructionCount);
|
|
}
|
|
|
|
delete[] codeBuffer;
|
|
}
|
|
|
|
static void handleMemoryRead(uc_engine* uc, uc_mem_type type, uint64_t address,
|
|
int size, int64_t value, void* userData) {
|
|
auto* sandbox = static_cast<Sandbox*>(userData);
|
|
if (!sandbox) return;
|
|
|
|
uint64_t regRax, regRip;
|
|
uc_reg_read(uc,
|
|
sandbox->GetPeInfo()->isX64 ? UC_X86_REG_RAX : UC_X86_REG_EAX,
|
|
®Rax);
|
|
uc_reg_read(uc,
|
|
sandbox->GetPeInfo()->isX64 ? UC_X86_REG_RIP : UC_X86_REG_EIP,
|
|
®Rip);
|
|
|
|
uint64_t readAddress;
|
|
auto readError =
|
|
uc_mem_read(sandbox->GetUnicornHandle(), address, &readAddress, size);
|
|
printf(
|
|
"[handleMemoryRead] Address: %p Size: %p Rax: %p Rip: %p Error: %d "
|
|
"ReadData: %p\n",
|
|
address, size, regRax, regRip, readError, readAddress);
|
|
}
|
|
|
|
static void handleMemoryUnmapRead(uc_engine* uc, uc_mem_type type,
|
|
uint64_t address, int size, int64_t value,
|
|
void* userData) {
|
|
// 待实现
|
|
}
|
|
|
|
static void handleMemoryWrite(uc_engine* uc, uc_mem_type type, uint64_t address,
|
|
int size, int64_t value, void* userData) {
|
|
// 待实现
|
|
}
|
|
|
|
static void handleSyscall(uc_engine* uc, void* userData) {
|
|
// 待实现
|
|
}
|
|
|
|
} // namespace sandboxCallbacks
|