Common_Ntapi: Error handling via logs

This commit is contained in:
Andrea Michael Maria Molino 2025-06-20 18:29:11 +02:00
parent 7b0249d9ca
commit 51270ca175
No known key found for this signature in database
GPG Key ID: C2EB4F51F978F9A8
3 changed files with 120 additions and 30 deletions

View File

@ -67,6 +67,7 @@ bool ParseFilterRule(Filter& instance, Iterator begin, Iterator end) {
CLS(Common) \
SUB(Common, Filesystem) \
SUB(Common, Memory) \
SUB(Common, NtApi) \
CLS(Core) \
SUB(Core, Linker) \
SUB(Core, Devices) \

View File

@ -33,6 +33,7 @@ enum class Class : u8 {
Common, ///< Library routines
Common_Filesystem, ///< Filesystem interface library
Common_Memory, ///< Memory mapping and management functions
Common_Ntapi, ///< Native Windows API
Core, ///< LLE emulation core
Core_Linker, ///< The module linker
Core_Devices, ///< Devices emulation

View File

@ -4,6 +4,7 @@
#ifdef _WIN32
#include "ntapi.h"
#include "logging/log.h"
NtClose_t NtClose = nullptr;
NtSetInformationFile_t NtSetInformationFile = nullptr;
@ -15,14 +16,101 @@ namespace Common::NtApi {
void Initialize() {
HMODULE nt_handle = GetModuleHandleA("ntdll.dll");
if(nt_handle == NULL){
LPVOID message_buffer;
DWORD buffer_len = FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_HMODULE | FORMAT_MESSAGE_IGNORE_INSERTS,
NULL,
GetLastError(),
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
(LPTSTR) &message_buffer,
0, NULL );
if(buffer_len){
std::string message((LPCSTR)message_buffer, (LPCSTR)message_buffer + buffer_len);
LocalFree(message_buffer);
LOG_WARNING(Common_Ntapi, "{}", message);
}
}
// http://stackoverflow.com/a/31411628/4725495
NtClose = (NtClose_t)GetProcAddress(nt_handle, "NtClose");
NtSetInformationFile =
(NtSetInformationFile_t)GetProcAddress(nt_handle, "NtSetInformationFile");
if(NtClose == NULL){
LPVOID message_buffer;
DWORD buffer_len = FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
NULL,
GetLastError(),
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
(LPTSTR) &message_buffer,
0, NULL );
if(buffer_len){
std::string message((LPCSTR)message_buffer, (LPCSTR)message_buffer + buffer_len);
LocalFree(message_buffer);
LOG_WARNING(Common_Ntapi, "{}", message);
}
}
NtSetInformationFile = (NtSetInformationFile_t)GetProcAddress(nt_handle, "NtSetInformationFile");
if(NtSetInformationFile == NULL){
LPVOID message_buffer;
DWORD buffer_len = FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
NULL,
GetLastError(),
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
(LPTSTR) &message_buffer,
0, NULL );
if(buffer_len){
std::string message((LPCSTR)message_buffer, (LPCSTR)message_buffer + buffer_len);
LocalFree(message_buffer);
LOG_WARNING(Common_Ntapi, "{}", message);
}
}
NtCreateThread = (NtCreateThread_t)GetProcAddress(nt_handle, "NtCreateThread");
if(NtCreateThread == NULL){
LPVOID message_buffer;
DWORD buffer_len = FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
NULL,
GetLastError(),
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
(LPTSTR) &message_buffer,
0, NULL );
if(buffer_len){
std::string message((LPCSTR)message_buffer, (LPCSTR)message_buffer + buffer_len);
LocalFree(message_buffer);
LOG_WARNING(Common_Ntapi, "{}", message);
}
}
NtTerminateThread = (NtTerminateThread_t)GetProcAddress(nt_handle, "NtTerminateThread");
if(NtTerminateThread == NULL){
LPVOID message_buffer;
DWORD buffer_len = FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
NULL,
GetLastError(),
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
(LPTSTR) &message_buffer,
0, NULL );
if(buffer_len){
std::string message((LPCSTR)message_buffer, (LPCSTR)message_buffer + buffer_len);
LocalFree(message_buffer);
LOG_WARNING(Common_Ntapi, "{}", message);
}
}
NtQueueApcThreadEx = (NtQueueApcThreadEx_t)GetProcAddress(nt_handle, "NtQueueApcThreadEx");
if(NtQueueApcThreadEx == NULL){
LPVOID message_buffer;
DWORD buffer_len = FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
NULL,
GetLastError(),
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
(LPTSTR) &message_buffer,
0, NULL );
if(buffer_len){
std::string message((LPCSTR)message_buffer, (LPCSTR)message_buffer + buffer_len);
LocalFree(message_buffer);
LOG_WARNING(Common_Ntapi, "{}", message);
}
}
}
} // namespace Common::NtApi