Notes

/// @file
#pragma once

#include <Windows.h>
#include "MirageControlDefinition.h"
#include "Types.h"
#include "VirtualProcess.h"
#include "EmulatorEmulator.h"
#include "Thread.h"
#include "....commonTokenizerW.h"

/**
@class Mirage
@brief 미라지 클래스

미라지 본체
*/
__declspec(align(16))
class Mirage
{
private:
BOOL ready_;

UINT32 GetMainModuleEntryPoint();

BOOL CallTLS();

BOOL CreateImportInfo();

public:
AAL xpAAL;
MirageProcess process;
MirageThread mainThread;
EMULATOR_CALLBACK callbacks;
FILE* traceOutput; // * 편의상 Dispose에서 초기화하지 않는 필드

Mirage();
~Mirage();

/// @brief 기본적인 미라지 환경을 구성
BOOL Ready(const MirageEnvironment* env);

/// @brief 가상으로 실행할 이미지를 로드합니다
BOOL LoadMainModuleImage(LPCWSTR imagePath);

/// @brief 사용된 모든 리소스를 정리하고 초기상태로 되돌림
BOOL Dispose();

private:
void DisplayMnemonicPre(IN BYTE* opcode, IN X86_CPU_CONTEXT* context, IN X86_CPU_CONTEXT* backupContext);

void DisplayMnemonicPost(IN X86_CPU_CONTEXT* context, IN X86_CPU_CONTEXT* backupContext);

void CallMemoryAccessCallbacks(X86_CPU_CONTEXT* context, EMULATOR_CALLBACK* callback, BYTE* instructionRealAddress);

public:
BOOL OneStep(IN X86_CPU_CONTEXT* context);

BOOL HandleMirageCall(X86_CPU_CONTEXT* context, UINT32 code);

BOOL HandleException(X86_CPU_CONTEXT* context);

void RunSubroutine(IN MirageThread* runThread);

BOOL Run(MIRAGE_ADDRESS startAddress = 0);

BOOL RunWithCount(MIRAGE_ADDRESS startAddress, UINT32 count);

// callback
public:
VOID Register1BytePreCallback(BYTE opcode, FLOW_CATCH_CALLBACK callbackFunction, void* extra);

VOID Register1BytePostCallback(BYTE opcode, FLOW_CATCH_CALLBACK callbackFunction, void* extra);
VOID Unregister1BytePostCallback(BYTE opcode);

VOID RegisterMemoryAccessCallback(MEMORY_ACCESS_CALLBACK_TYPE callbackType, MEMORY_ACCESS_CALLBACK callbackFunction);

VOID RegisterJumpAlikeInstructionPostCallback(FLOW_CATCH_CALLBACK callbackFunction, void* extra);
VOID UnregisterJumpAlikeInstructionPostCallback();

// snapshot
public:
BOOL CreateSnapshot(LPCWSTR snapshotFileName);

BOOL LoadSnapshot(LPCWSTR snapshotFileName);

// dump
private:
void GatherImportFunctionInfo(void* startAddress,
int size,
std::vector<UINT32*>& api);

UINT32* FindIAT(WORD numberOfSections, IMAGE_SECTION_HEADER* sectionHeader);

void CreateImportSection(WORD numberOfSections,
IMAGE_SECTION_HEADER* dumpSectionHeader,
BYTE* dumpBuffer,
IMAGE_SECTION_HEADER* sectionHeader,
BYTE* &dumpEndPointer);

SIZE_T CreateImportInfo(UINT32* iat, IMPORT_INFO &importInfo);

public:
BOOL Dump(LPCWSTR orgFileName OPTIONAL, UINT32 newEntryPointRva, LPCWSTR dumpFileName);

// tracing
void PrintContext(IN X86_CPU_CONTEXT* context, FILE* disassemblyOut);

void PrintAffectedRegister(IN X86_CPU_CONTEXT* oldContext, IN X86_CPU_CONTEXT* newContext, FILE* disassemblyOut);

// convenience
public:
void* ConvertMirageToRealAddress(MIRAGE_ADDRESS mirageAddress);
};