admin/awesome_anti_virus_engine
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update & fix logic bug

Browse Source
This commit is contained in:
Huoji's
2025-03-20 04:56:31 +08:00
parent 3a6e331f31
commit 91dca661ba
5 changed files with 243 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
ai_anti_malware/sandbox_api_emu.cpp
View File

@@ -1359,6 +1359,9 @@ auto Sandbox::InitApiHooks() -> void {
_fakeApi{.func = Api_GetStringTypeW, .paramCount = 4};
auto FakeApi_LCMapStringW =
_fakeApi{.func = Api_LCMapStringW, .paramCount = 6};
auto FakeApi__initterm_e =
_fakeApi{.func = Api__initterm_e, .paramCount = 2};
auto FakeApi_getenv = _fakeApi{.func = Api_getenv, .paramCount = 1};
api_map = {
{"GetSystemTimeAsFileTime",
@@ -1492,8 +1495,10 @@ auto Sandbox::InitApiHooks() -> void {
{"TlsFree", std::make_shared<_fakeApi>(FakeApi_TlsFree)},
{"FlsAlloc", std::make_shared<_fakeApi>(FakeApi_FlsAlloc)},
{"FlsGetValue", std::make_shared<_fakeApi>(FakeApi_FlsGetValue)},
{"_initterm_e", std::make_shared<_fakeApi>(FakeApi__initterm_e)},
{"GetStringTypeW", std::make_shared<_fakeApi>(FakeApi_GetStringTypeW)},
{"LCMapStringW", std::make_shared<_fakeApi>(FakeApi_LCMapStringW)},
{"getenv", std::make_shared<_fakeApi>(FakeApi_getenv)},
};
}
auto Sandbox::EmulateApi(uc_engine* uc, uint64_t address, uint64_t rip,
@@ -1548,6 +1553,6 @@ auto Sandbox::EmulateApi(uc_engine* uc, uint64_t address, uint64_t rip,
return true;
}
printf("ApiName: %s not found\n", ApiName.c_str());
//uc_emu_stop(uc);
uc_emu_stop(uc);
return false;
}