Generic Test framework

src/dumpulator/dumpulator.py

@@ -855,9 +855,13 @@ def _hook_code_exception(uc: Uc, address, size, dp: Dumpulator):
         raise err
 
 def _hook_mem(uc: Uc, access, address, size, value, dp: Dumpulator):
+    fetch_accesses = [UC_MEM_FETCH, UC_MEM_FETCH_PROT, UC_MEM_FETCH_UNMAPPED]
     if access == UC_MEM_FETCH_UNMAPPED and address >= FORCE_KILL_ADDR - 0x10 and address <= FORCE_KILL_ADDR + 0x10 and dp.kill_me is not None:
         dp.error(f"forced exit memory operation {access} of {address:x}[{size:x}] = {value:X}")
         return False
+    if dp.exception.final and access in fetch_accesses:
+        dp.info(f"fetch from {hex(address)}[{size}] already reported")
+        return False
     # TODO: figure out why when you start executing at 0 this callback is triggered more than once
     try:
         # Extract exception information
@@ -868,10 +872,11 @@ def _hook_mem(uc: Uc, access, address, size, value, dp: Dumpulator):
         exception.memory_size = size
         exception.memory_value = value
         exception.context = uc.context_save()
-        tb = uc.ctl_request_cache(dp.regs.cip)
-        exception.tb_start = tb.pc
-        exception.tb_size = tb.size
-        exception.tb_icount = tb.icount
+        if access not in fetch_accesses:
+            tb = uc.ctl_request_cache(dp.regs.cip)
+            exception.tb_start = tb.pc
+            exception.tb_size = tb.size
+            exception.tb_icount = tb.icount
 
         # Print exception info
         final = dp.trace or dp.exception.code_hook_h is not None
@@ -922,7 +927,8 @@ def _hook_mem(uc: Uc, access, address, size, value, dp: Dumpulator):
 
         # Remove the translation block cache for this block
         # Without doing this single stepping the block won't work
-        uc.ctl_remove_cache(exception.tb_start, exception.tb_start + exception.tb_size)
+        if exception.tb_start != 0:
+            uc.ctl_remove_cache(exception.tb_start, exception.tb_start + exception.tb_size)
 
         # Install the code hook to single step the basic block again.
         # This will prevent translation block caching and give us the correct cip
@@ -1059,6 +1065,7 @@ def _hook_interrupt(uc: Uc, number, dp: Dumpulator):
         exception.type = ExceptionType.Interrupt
         exception.interrupt_number = number
         exception.context = uc.context_save()
+        # TODO: this might crash if cip is not valid memory
         tb = uc.ctl_request_cache(dp.regs.cip)
         exception.tb_start = tb.pc
         exception.tb_size = tb.size

src/dumpulator/modules.py

@@ -14,6 +14,7 @@ def __init__(self, address: int, ordinal: int, name: str, forward: Tuple[str, st
 class Module:
     def __init__(self, pe: pefile.PE, path: str):
         self.pe = pe
+        path = path.replace("/", "\\")
         self.path = path
         self.name = path.split("\\")[-1]
         self._exports_by_address: Dict[int, int] = {}

src/dumpulator/ntsyscalls.py

@@ -630,7 +630,7 @@ def ZwCancelTimer(dp: Dumpulator,
                   TimerHandle: HANDLE,
                   CurrentState: P(BOOLEAN)
                   ):
-    raise NotImplementedError()
+    return STATUS_SUCCESS
 
 @syscall
 def ZwCancelTimer2(dp: Dumpulator,

tests/DumpulatorTests/.gitignore

@@ -0,0 +1,5 @@
+bin/
+_obj/
+.vs/
+*.user
+*.exp

tests/DumpulatorTests/DumpulatorTests.sln

@@ -0,0 +1,43 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.3.32922.545
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Loader", "Loader\Loader.vcxproj", "{8F7621EE-2179-4E66-B058-B11C5908CF3E}"
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Tests", "Tests\Tests.vcxproj", "{F33082EB-B49F-4630-B919-B9B18C86E358}"
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "HarnessMinimal", "HarnessMinimal\HarnessMinimal.vcxproj", "{CBD65637-B773-430B-AF11-A0AFEB699D8F}"
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "HarnessFull", "HarnessFull\HarnessFull.vcxproj", "{1FD2D0B5-53E2-4E9E-AA4B-2E822ABD2D49}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Release|Win32 = Release|Win32
+		Release|x64 = Release|x64
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{8F7621EE-2179-4E66-B058-B11C5908CF3E}.Release|Win32.ActiveCfg = Release|Win32
+		{8F7621EE-2179-4E66-B058-B11C5908CF3E}.Release|Win32.Build.0 = Release|Win32
+		{8F7621EE-2179-4E66-B058-B11C5908CF3E}.Release|x64.ActiveCfg = Release|x64
+		{8F7621EE-2179-4E66-B058-B11C5908CF3E}.Release|x64.Build.0 = Release|x64
+		{F33082EB-B49F-4630-B919-B9B18C86E358}.Release|Win32.ActiveCfg = Release|Win32
+		{F33082EB-B49F-4630-B919-B9B18C86E358}.Release|Win32.Build.0 = Release|Win32
+		{F33082EB-B49F-4630-B919-B9B18C86E358}.Release|x64.ActiveCfg = Release|x64
+		{F33082EB-B49F-4630-B919-B9B18C86E358}.Release|x64.Build.0 = Release|x64
+		{CBD65637-B773-430B-AF11-A0AFEB699D8F}.Release|Win32.ActiveCfg = Release|Win32
+		{CBD65637-B773-430B-AF11-A0AFEB699D8F}.Release|Win32.Build.0 = Release|Win32
+		{CBD65637-B773-430B-AF11-A0AFEB699D8F}.Release|x64.ActiveCfg = Release|x64
+		{CBD65637-B773-430B-AF11-A0AFEB699D8F}.Release|x64.Build.0 = Release|x64
+		{1FD2D0B5-53E2-4E9E-AA4B-2E822ABD2D49}.Release|Win32.ActiveCfg = Release|Win32
+		{1FD2D0B5-53E2-4E9E-AA4B-2E822ABD2D49}.Release|Win32.Build.0 = Release|Win32
+		{1FD2D0B5-53E2-4E9E-AA4B-2E822ABD2D49}.Release|x64.ActiveCfg = Release|x64
+		{1FD2D0B5-53E2-4E9E-AA4B-2E822ABD2D49}.Release|x64.Build.0 = Release|x64
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {B2416A67-4257-41D9-AD43-263D0467D10D}
+	EndGlobalSection
+EndGlobal

tests/DumpulatorTests/HarnessFull/HarnessFull.cpp

@@ -0,0 +1,23 @@
+
+#include <winsock2.h>
+#include <ws2tcpip.h>
+#include <Windows.h>
+#include <CommCtrl.h>
+
+int EntryPoint(void* peb)
+{
+	WSADATA wsa;
+	WSAStartup(0, &wsa);
+	CoInitialize(0);
+	ShellExecuteW(0, L"open", L".", nullptr, nullptr, SW_SHOWNORMAL);
+	MessageBeep(MB_ICONERROR);
+	InitCommonControls();
+	HKEY key;
+	RegOpenKeyW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", &key);
+	BCRYPT_ALG_HANDLE alg;
+	BCryptOpenAlgorithmProvider(&alg, BCRYPT_RC4_ALGORITHM, nullptr, 0);
+	HCRYPTPROV prov;
+	CryptAcquireContextW(&prov, nullptr, nullptr, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT);
+	__debugbreak(); // Dump here
+	return 0;
+}