fix up

ai_anti_malware/sandbox_api_emu.cpp

@@ -1891,6 +1891,130 @@ auto Api_WideCharToMultiByte(void* sandbox, uc_engine* uc, uint64_t address)
                  &result);
 }
 
+// 实现 InitializeSListHead API
+auto Api_InitializeSListHead(void* sandbox, uc_engine* uc, uint64_t address)
+    -> void {
+    auto context = static_cast<Sandbox*>(sandbox);
+    uint64_t ListHead = 0;
+
+    // 获取参数
+    if (context->GetPeInfo()->isX64) {
+        // x64: rcx = ListHead
+        uc_reg_read(uc, UC_X86_REG_RCX, &ListHead);
+    } else {
+        // x86: 从栈上读取参数
+        uint32_t esp_address = 0;
+        uint32_t temp_listhead = 0;
+        uc_reg_read(uc, UC_X86_REG_ESP, &esp_address);
+        esp_address += 0x4;  // 跳过返回地址
+        uc_mem_read(uc, esp_address, &temp_listhead, sizeof(uint32_t));
+        ListHead = temp_listhead;
+    }
+
+    if (ListHead != 0) {
+        if (context->GetPeInfo()->isX64) {
+            // 64位系统的SLIST_HEADER结构 (16字节对齐)
+            struct SLIST_HEADER64 {
+                union {
+                    struct {
+                        ULONGLONG Alignment;
+                        ULONGLONG Region;
+                    } DUMMYSTRUCTNAME;
+                    struct {
+                        ULONGLONG Depth : 16;
+                        ULONGLONG Sequence : 48;
+                        ULONGLONG Reserved : 4;
+                        ULONGLONG NextEntry : 60;
+                    } HeaderX64;
+                };
+            } header = {0};
+
+            // 初始化Depth和Sequence为0
+            header.HeaderX64.Depth = 0;
+            header.HeaderX64.Sequence = 0;
+            header.HeaderX64.Reserved = 0;
+            header.HeaderX64.NextEntry = 0;
+
+            // 写入初始化的结构
+            uc_mem_write(uc, ListHead, &header, sizeof(SLIST_HEADER64));
+        } else {
+            // 32位系统的SLIST_HEADER结构 (8字节)
+            struct SLIST_HEADER32 {
+                union {
+                    ULONGLONG Alignment;
+                    struct {
+                        SLIST_ENTRY* Next;
+                        WORD Depth;
+                        WORD Sequence;
+                    } Header32;
+                };
+            } header = {0};
+
+            // 初始化Next、Depth和Sequence为0
+            header.Header32.Next = nullptr;
+            header.Header32.Depth = 0;
+            header.Header32.Sequence = 0;
+
+            // 写入初始化的结构
+            uc_mem_write(uc, ListHead, &header, sizeof(SLIST_HEADER32));
+        }
+    }
+
+    printf("[*] InitializeSListHead: ListHead=0x%llx\n", ListHead);
+}
+
+// 实现 GetEnvironmentStringsW API
+auto Api_GetEnvironmentStringsW(void* sandbox, uc_engine* uc, uint64_t address)
+    -> void {
+    auto context = static_cast<Sandbox*>(sandbox);
+    uint64_t envBlock = context->GetEnvBlockBase();
+    uc_reg_write(uc,
+                 context->GetPeInfo()->isX64 ? UC_X86_REG_RAX : UC_X86_REG_EAX,
+                 &envBlock);
+}
+
+// 实现 FreeEnvironmentStringsW API
+auto Api_FreeEnvironmentStringsW(void* sandbox, uc_engine* uc, uint64_t address)
+    -> void {
+    auto context = static_cast<Sandbox*>(sandbox);
+    uint64_t lpszEnvironmentBlock = 0;
+
+    // 获取参数
+    if (context->GetPeInfo()->isX64) {
+        // x64: rcx = lpszEnvironmentBlock
+        uc_reg_read(uc, UC_X86_REG_RCX, &lpszEnvironmentBlock);
+    } else {
+        // x86: 从栈上读取参数
+        uint32_t esp_address = 0;
+        uint32_t temp_block = 0;
+        uc_reg_read(uc, UC_X86_REG_ESP, &esp_address);
+        esp_address += 0x4;  // 跳过返回地址
+        uc_mem_read(uc, esp_address, &temp_block, sizeof(uint32_t));
+        lpszEnvironmentBlock = temp_block;
+    }
+
+    // 检查传入的地址是否是我们之前分配的环境块地址
+    BOOL success = (lpszEnvironmentBlock == context->GetEnvBlockBase());
+
+    if (!success) {
+        // 如果地址无效，设置错误码
+        DWORD error = ERROR_INVALID_PARAMETER;
+        if (context->GetPeInfo()->isX64) {
+            context->GetTeb64()->LastErrorValue = error;
+        } else {
+            context->GetTeb32()->LastErrorValue = error;
+        }
+    }
+
+    printf("[*] FreeEnvironmentStringsW: Block=0x%llx, Success=%d\n",
+           lpszEnvironmentBlock, success);
+
+    // 返回操作是否成功
+    uc_reg_write(uc,
+                 context->GetPeInfo()->isX64 ? UC_X86_REG_RAX : UC_X86_REG_EAX,
+                 &success);
+}
+
 auto Sandbox::InitApiHooks() -> void {
     auto FakeApi_GetSystemTimeAsFileTime =
         _fakeApi{.func = Api_GetSystemTimeAsFileTime, .paramCount = 1};
@@ -1949,6 +2073,12 @@ auto Sandbox::InitApiHooks() -> void {
         _fakeApi{.func = Api_AreFileApisANSI, .paramCount = 0};
     auto FakeApi_WideCharToMultiByte =
         _fakeApi{.func = Api_WideCharToMultiByte, .paramCount = 8};
+    auto FakeApi_InitializeSListHead =
+        _fakeApi{.func = Api_InitializeSListHead, .paramCount = 1};
+    auto FakeApi_GetEnvironmentStringsW =
+        _fakeApi{.func = Api_GetEnvironmentStringsW, .paramCount = 0};
+    auto FakeApi_FreeEnvironmentStringsW =
+        _fakeApi{.func = Api_FreeEnvironmentStringsW, .paramCount = 1};
 
     api_map = {
         {"GetSystemTimeAsFileTime",
@@ -1999,6 +2129,12 @@ auto Sandbox::InitApiHooks() -> void {
          std::make_shared<_fakeApi>(FakeApi_AreFileApisANSI)},
         {"WideCharToMultiByte",
          std::make_shared<_fakeApi>(FakeApi_WideCharToMultiByte)},
+        {"InitializeSListHead",
+         std::make_shared<_fakeApi>(FakeApi_InitializeSListHead)},
+        {"GetEnvironmentStringsW",
+         std::make_shared<_fakeApi>(FakeApi_GetEnvironmentStringsW)},
+        {"FreeEnvironmentStringsW",
+         std::make_shared<_fakeApi>(FakeApi_FreeEnvironmentStringsW)},
     };
 }
 auto Sandbox::EmulateApi(uc_engine* uc, uint64_t address, uint64_t rip,
@@ -2023,10 +2159,10 @@ auto Sandbox::EmulateApi(uc_engine* uc, uint64_t address, uint64_t rip,
             uc_mem_read(uc, rsp, &return_address, 8);
 
             // x64下，前4个参数通过寄存器传递，超过的部分通过栈传递
-            int stack_params = (paramCount > 4) ? (paramCount - 4) : 0;
+            // int stack_params = (paramCount > 4) ? (paramCount - 4) : 0;
             // 调整栈指针：每个参数8字节 + 返回地址8字节
-            rsp += (stack_params * 8) + 8;
-
+            // rsp += (stack_params * 8) + 8;
+            rsp += 8;
             // 设置RIP为返回地址
             uc_reg_write(uc, UC_X86_REG_RIP, &return_address);
         } else {  // 32位系统