Merge branch 'main' into main

Author: sha0coder

README.md

@@ -14,7 +14,7 @@
 
 It's a hardware emulator + OS process simulator implemented in pure rust.
 
-This approach is very convinient to malware analysis and other stuff (PE, shellcode etc)
+This approach is very convenient to malware analysis and other stuff (PE, shellcode etc)
 
 The OS is mainly windows, it emulates a windows process, some very basic support for linux.
 

crates/libmwemu/Cargo.toml

@@ -49,5 +49,6 @@ hex = "0.4.3"
 
 [features]
 default = []
+rax_x86_tests = []
 log_mem_read = []
 log_mem_write = []

crates/libmwemu/src/elf/elf32.rs

@@ -116,7 +116,10 @@ impl Elf32 {
         let path = base.join(filename);
         let mut fd = File::open(filename).expect("file not found");
         let mut raw = vec![0u8; 5];
-        fd.read_exact(&mut raw).expect("couldnt read the file");
+        let r = fd.read_exact(&mut raw);
+        if r.is_err() {
+            return false;
+        }
 
         if raw[0] == 0x7f
             && raw[1] == b'E'

crates/libmwemu/src/elf/elf64.rs

@@ -482,7 +482,10 @@ impl Elf64 {
         //log::info!("checking if elf64: {}", filename);
         let mut fd = File::open(filename).expect("file not found");
         let mut raw = vec![0u8; 5];
-        fd.read_exact(&mut raw).expect("couldnt read the file");
+        let r = fd.read_exact(&mut raw);
+        if r.is_err() {
+            return false;
+        }
 
         if raw[0] == 0x7f
             && raw[1] == b'E'

crates/libmwemu/src/engine/instructions/hlt.rs

@@ -0,0 +1,8 @@
+use crate::color;
+use crate::emu::Emu;
+use iced_x86::Instruction;
+
+pub fn execute(emu: &mut Emu, ins: &Instruction, instruction_sz: usize, _rep_step: bool) -> bool {
+    emu.show_instruction(color!("Green"), ins);
+    false
+}

crates/libmwemu/src/engine/instructions/mod.rs

@@ -344,3 +344,4 @@ pub mod xgetbv;
 pub mod xor;
 pub mod xorpd;
 pub mod xorps;
+pub mod hlt;

crates/libmwemu/src/engine/mod.rs

@@ -366,6 +366,7 @@ pub fn emulate_instruction(
         Mnemonic::Enqcmds => instructions::enqcmds::execute(emu, ins, instruction_sz, rep_step),
         Mnemonic::Enter => instructions::enter::execute(emu, ins, instruction_sz, rep_step),
         Mnemonic::Rdmsr => instructions::rdmsr::execute(emu, ins, instruction_sz, rep_step),
+        Mnemonic::Hlt => instructions::hlt::execute(emu, ins, instruction_sz, rep_step),
         _ => {
             log::info!(
                 "{} Unimplemented instruction: {:?}",

crates/libmwemu/src/flags.rs

@@ -50,6 +50,25 @@ macro_rules! set_bit {
     };
 }
 
+pub const F_CF: u32 = 0;
+pub const F_PF: u32 = 2;
+pub const F_AF: u32 = 4;
+pub const F_ZF: u32 = 6;
+pub const F_SF: u32 = 7;
+pub const F_TF: u32 = 8;
+pub const F_IF: u32 = 9;
+pub const F_DF: u32 = 10;
+pub const F_OF: u32 = 11;
+pub const F_IOPL1: u32 = 12;
+pub const F_IOPL2: u32 = 13;
+pub const F_NT: u32 = 14;
+pub const F_RF: u32 = 16;
+pub const F_VM: u32 = 17;
+pub const F_AC: u32 = 18;
+pub const F_VIF: u32 = 19;
+pub const F_VIP: u32 = 20;
+pub const F_ID: u32 = 21;
+
 #[derive(Clone, Copy, Debug, Serialize, Deserialize)]
 pub struct Flags {
     pub f_cf: bool,
@@ -123,6 +142,27 @@ impl Flags {
         self.f_id = false;
     }
 
+    pub fn set(&mut self) {
+        self.f_cf = true;
+        self.f_pf = true;
+        self.f_af = true;
+        self.f_zf = true;
+        self.f_sf = true;
+        self.f_tf = true;
+        self.f_if = true;
+        self.f_df = true;
+        self.f_of = true;
+        self.f_iopl1 = true;
+        self.f_iopl2 = true;
+        self.f_nt = true;
+        self.f_rf = true;
+        self.f_vm = true;
+        self.f_ac = true;
+        self.f_vif = true;
+        self.f_vip = true;
+        self.f_id = true;
+    }
+
     pub fn print_trace(&self, pos: u64) {
         let mut fs = String::new();
         fs.push_str("[ ");

crates/libmwemu/src/tests/mod.rs

@@ -65,3 +65,4 @@ mod tls_fls_tests;
 mod utility_functions_tests;
 mod winapi32_tests;
 mod winapi64_tests;
+mod rax_x86_tests;

crates/libmwemu/src/tests/rax_x86_tests/README.md

@@ -0,0 +1,12 @@
+This x86 specific test-set are created by Kenan Sulayman https://github.com/19h/ 
+and is part of his RAX project:
+
+`https://github.com/19h/rax/tree/master/tests/x86_64`
+
+The tests have been converted to use libmwemu's api using some regex I prepared on regex.vim
+
+
+To trigger this tests use:
+```
+cargo test --features rax_x86_tests rax_x86_tests
+```