@@ -1362,6 +1362,29 @@ def ZwDeviceIoControlFile(dp: Dumpulator,
1362
1362
OutputBuffer : PVOID ,
1363
1363
OutputBufferLength : ULONG
1364
1364
):
1365
+ if FileHandle == dp .console_handle :
1366
+ assert IoControlCode == 0x500016
1367
+ data = InputBuffer .read (InputBufferLength )
1368
+ print (f"InputBuffer: { data .hex ()} " )
1369
+
1370
+ # TODO: this is totally wrong, but seems to work?
1371
+ if dp .ptr_size () == 4 :
1372
+ buf = InputBuffer .ptr
1373
+ params = struct .unpack ("<IIII" , dp .read (buf , 4 * 4 ))
1374
+ for i , p in enumerate (params ):
1375
+ print (f"params[{ i } ] = { p } " )
1376
+
1377
+ length = dp .read_ptr (buf + 4 * 4 )
1378
+ buffer = dp .read_ptr (buf + 4 * 4 + dp .ptr_size ())
1379
+
1380
+ ptr1 = dp .read_ptr (buf + 0x18 )
1381
+ ptr2 = dp .read_ptr (buf + 0x28 )
1382
+ print (f"ptr1: { ptr1 :x} , ptr2: { ptr2 :x} " )
1383
+ dp .write_ptr (ptr2 , 0xffffffff )
1384
+ print (f"{ dp .read_ptr (ptr1 ):x} " )
1385
+
1386
+ print (f"Length: { length } , Buffer: 0x{ buffer :x} " )
1387
+ return STATUS_SUCCESS
1365
1388
raise NotImplementedError ()
1366
1389
1367
1390
@syscall
@@ -2240,7 +2263,7 @@ def ZwOpenSection(dp: Dumpulator,
2240
2263
DesiredAccess : ACCESS_MASK ,
2241
2264
ObjectAttributes : P (OBJECT_ATTRIBUTES )
2242
2265
):
2243
- raise NotImplementedError ()
2266
+ return STATUS_NOT_IMPLEMENTED
2244
2267
2245
2268
@syscall
2246
2269
def ZwOpenSemaphore (dp : Dumpulator ,
@@ -2950,7 +2973,7 @@ def ZwQueryVirtualMemory(dp: Dumpulator,
2950
2973
MemoryInformationLength : SIZE_T ,
2951
2974
ReturnLength : P (SIZE_T )
2952
2975
):
2953
- raise NotImplementedError ()
2976
+ return STATUS_NOT_IMPLEMENTED
2954
2977
2955
2978
@syscall
2956
2979
def ZwQueryVolumeInformationFile (dp : Dumpulator ,
@@ -3035,6 +3058,19 @@ def ZwReadFile(dp: Dumpulator,
3035
3058
ByteOffset : P (LARGE_INTEGER ),
3036
3059
Key : P (ULONG )
3037
3060
):
3061
+ if FileHandle == dp .stdin_handle :
3062
+ result = b"some console input"
3063
+
3064
+ assert Buffer != 0
3065
+ assert len (result ) <= Length
3066
+
3067
+ Buffer .write (result )
3068
+
3069
+ # https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_io_status_block
3070
+ dp .write_ptr (IoStatusBlock .ptr , STATUS_SUCCESS )
3071
+ dp .write_ptr (IoStatusBlock .ptr + dp .ptr_size (), len (result ))
3072
+
3073
+ return STATUS_SUCCESS
3038
3074
raise NotImplementedError ()
3039
3075
3040
3076
@syscall
@@ -3451,7 +3487,7 @@ def ZwSetEvent(dp: Dumpulator,
3451
3487
EventHandle : HANDLE ,
3452
3488
PreviousState : P (LONG )
3453
3489
):
3454
- raise NotImplementedError ()
3490
+ return STATUS_NOT_IMPLEMENTED
3455
3491
3456
3492
@syscall
3457
3493
def ZwSetEventBoostPriority (dp : Dumpulator ,
@@ -4145,9 +4181,11 @@ def ZwWriteFile(dp: Dumpulator,
4145
4181
ByteOffset : P (LARGE_INTEGER ),
4146
4182
Key : P (ULONG )
4147
4183
):
4148
- data = Buffer .read_str (Length )
4149
- print (data )
4150
- return STATUS_SUCCESS
4184
+ if FileHandle in [dp .stdout_handle , dp .stdin_handle ]:
4185
+ data = Buffer .read_str (Length )
4186
+ print (data )
4187
+ return STATUS_SUCCESS
4188
+ raise NotImplementedError ()
4151
4189
4152
4190
@syscall
4153
4191
def ZwWriteFileGather (dp : Dumpulator ,
0 commit comments