This commit is contained in:
Aaron Robinson 2003-01-31 22:15:41 +00:00
parent 6f08cd4ed2
commit 94c94e4181
4 changed files with 113 additions and 41 deletions

View File

@ -243,6 +243,26 @@ static uint32 PE_SEGM_ALIGN (0x0020);
#define IMAGE_SUBSYSTEM_NATIVE_WINDOWS 8 #define IMAGE_SUBSYSTEM_NATIVE_WINDOWS 8
#define IMAGE_SUBSYSTEM_WINDOWS_CE_GUI 9 #define IMAGE_SUBSYSTEM_WINDOWS_CE_GUI 9
// ******************************************************************
// * Directory Entries
// ******************************************************************
#define IMAGE_DIRECTORY_ENTRY_EXPORT 0 // Export Directory
#define IMAGE_DIRECTORY_ENTRY_IMPORT 1 // Import Directory
#define IMAGE_DIRECTORY_ENTRY_RESOURCE 2 // Resource Directory
#define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3 // Exception Directory
#define IMAGE_DIRECTORY_ENTRY_SECURITY 4 // Security Directory
#define IMAGE_DIRECTORY_ENTRY_BASERELOC 5 // Base Relocation Table
#define IMAGE_DIRECTORY_ENTRY_DEBUG 6 // Debug Directory
// IMAGE_DIRECTORY_ENTRY_COPYRIGHT 7 // (X86 usage)
#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 7 // Architecture Specific Data
#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8 // RVA of GP
#define IMAGE_DIRECTORY_ENTRY_TLS 9 // TLS Directory
#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10 // Load Configuration Directory
#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11 // Bound Import Directory in headers
#define IMAGE_DIRECTORY_ENTRY_IAT 12 // Import Address Table
#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13 // Delay Load Import Descriptors
#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14 // COM Runtime descriptor
// ****************************************************************** // ******************************************************************
// * DOS stub // * DOS stub
// ****************************************************************** // ******************************************************************

View File

@ -284,14 +284,23 @@ EmuExe::EmuExe(Xbe *x_Xbe, uint32 x_debug_console, char *x_debug_filename) : Exe
// ****************************************************************** // ******************************************************************
// * update import table directory entry // * update import table directory entry
// ****************************************************************** // ******************************************************************
m_OptionalHeader.m_image_data_directory[1].m_virtual_addr = m_SectionHeader[i].m_virtual_addr + 0x08; m_OptionalHeader.m_image_data_directory[IMAGE_DIRECTORY_ENTRY_IMPORT].m_virtual_addr = m_SectionHeader[i].m_virtual_addr + 0x08;
m_OptionalHeader.m_image_data_directory[1].m_size = 0x28; m_OptionalHeader.m_image_data_directory[IMAGE_DIRECTORY_ENTRY_IMPORT].m_size = 0x28;
// ****************************************************************** // ******************************************************************
// * update import address table directory entry // * update import address table directory entry
// ****************************************************************** // ******************************************************************
m_OptionalHeader.m_image_data_directory[12].m_virtual_addr = m_SectionHeader[i].m_virtual_addr; m_OptionalHeader.m_image_data_directory[IMAGE_DIRECTORY_ENTRY_IAT].m_virtual_addr = m_SectionHeader[i].m_virtual_addr;
m_OptionalHeader.m_image_data_directory[12].m_size = 0x08; m_OptionalHeader.m_image_data_directory[IMAGE_DIRECTORY_ENTRY_IAT].m_size = 0x08;
// ******************************************************************
// * update TLS entry
// ******************************************************************
if(x_Xbe->m_Header.dwTLSAddr != 0)
{
m_OptionalHeader.m_image_data_directory[IMAGE_DIRECTORY_ENTRY_TLS].m_virtual_addr = x_Xbe->m_Header.dwTLSAddr - m_OptionalHeader.m_image_base;
m_OptionalHeader.m_image_data_directory[IMAGE_DIRECTORY_ENTRY_TLS].m_size = 0x28;
}
} }
// ****************************************************************** // ******************************************************************

View File

@ -101,32 +101,25 @@ void EmuXGenerateFS()
// ****************************************************************** // ******************************************************************
__asm __asm
{ {
// Obtain "OrgFS"
mov ax, fs mov ax, fs
mov OrgFS, ax mov OrgFS, ax
}
// ****************************************************************** // Obtain "OrgNtTib"
// * Obtain "OrgNtTib"
// ******************************************************************
__asm
{
mov eax, fs:[0x18] mov eax, fs:[0x18]
mov OrgNtTib, eax mov OrgNtTib, eax
}
// ****************************************************************** // Save "NewFS" inside OrgFS.ArbitraryUserPointer
// * Save "NewFS" inside OrgFS.ArbitraryUserPointer
// ******************************************************************
__asm
{
mov ax, NewFS mov ax, NewFS
mov fs:[0x14], ax // OrgFS.ArbitraryUserPointer mov fs:[0x14], ax
} }
// ****************************************************************** // ******************************************************************
// * Generate TIB // * Generate TIB
// ****************************************************************** // ******************************************************************
{ {
void *TLSPtr = 0;
xboxkrnl::KTHREAD *KThread = new xboxkrnl::KTHREAD(); xboxkrnl::KTHREAD *KThread = new xboxkrnl::KTHREAD();
memcpy(&NewPcr->NtTib, OrgNtTib, sizeof(NT_TIB)); memcpy(&NewPcr->NtTib, OrgNtTib, sizeof(NT_TIB));
@ -134,7 +127,14 @@ void EmuXGenerateFS()
NewPcr->NtTib.Self = &NewPcr->NtTib; NewPcr->NtTib.Self = &NewPcr->NtTib;
NewPcr->PrcbData.CurrentThread = KThread; NewPcr->PrcbData.CurrentThread = KThread;
KThread->TlsData = (void*)0xCDCDCDCD; // Retrieve Win2k/XP TEB.ThreadLocalStoragePointer
__asm
{
mov eax, fs:[0x2C]
mov TLSPtr, eax
}
KThread->TlsData = (void*)TLSPtr;
} }
// ****************************************************************** // ******************************************************************
@ -232,15 +232,13 @@ CXBXKRNL_API void NTAPI EmuXInit(DebugMode DebugConsole, char *DebugFilename, ui
printf("CxbxKrnl [0x%.08X]: Initial thread starting.\n", GetCurrentThreadId()); printf("CxbxKrnl [0x%.08X]: Initial thread starting.\n", GetCurrentThreadId());
EmuXSwapFS(); // XBox FS EmuXSwapFS(); // XBox FS
Entry(); Entry();
EmuXSwapFS(); // Win2k/XP FS EmuXSwapFS(); // Win2k/XP FS
printf("CxbxKrnl [0x%.08X]: Initial thread ended.\n", GetCurrentThreadId()); printf("CxbxKrnl [0x%.08X]: Initial thread ended.\n", GetCurrentThreadId());
// just spin forever (for now...)
while(true)
Sleep(1000);
return; return;
} }
@ -311,7 +309,6 @@ DWORD WINAPI PsCreateSystemThreadExProxy
push StartContext2 push StartContext2
push StartContext1 push StartContext1
lea ebp, [esp-4] lea ebp, [esp-4]
int 3
jmp near esi jmp near esi
} }
@ -321,6 +318,31 @@ DWORD WINAPI PsCreateSystemThreadExProxy
using namespace xboxkrnl; using namespace xboxkrnl;
// ******************************************************************
// * 0x0031 - HalReturnToFirmware
// ******************************************************************
XBSYSAPI EXPORTNUM(49) VOID DECLSPEC_NORETURN xboxkrnl::HalReturnToFirmware
(
RETURN_FIRMWARE Routine
)
{
EmuXSwapFS(); // Win2k/XP FS
MessageBox(NULL, "HalReturnToFirmware()", "CxbxKrnl", MB_OK);
/*
ReturnFirmwareHalt = 0x0,
ReturnFirmwareReboot = 0x1,
ReturnFirmwareQuickReboot = 0x2,
ReturnFirmwareHard = 0x3,
ReturnFirmwareFatal = 0x4,
ReturnFirmwareAll = 0x5
*/
EmuXSwapFS(); // XBox FS
exit(1);
}
// ****************************************************************** // ******************************************************************
// * 0x00BB - NtClose // * 0x00BB - NtClose
// ****************************************************************** // ******************************************************************
@ -414,26 +436,47 @@ XBSYSAPI EXPORTNUM(255) NTSTATUS NTAPI xboxkrnl::PsCreateSystemThreadEx
} }
// ****************************************************************** // ******************************************************************
// * 0x0031 - HalReturnToFirmware // * 0x0115 RtlEnterCriticalSection
// ****************************************************************** // ******************************************************************
XBSYSAPI EXPORTNUM(49) VOID DECLSPEC_NORETURN xboxkrnl::HalReturnToFirmware XBSYSAPI EXPORTNUM(277) VOID xboxkrnl::RtlEnterCriticalSection(DWORD Unknown)
(
RETURN_FIRMWARE Routine
)
{ {
EmuXSwapFS(); // Win2k/XP FS EmuXSwapFS(); // Win2k/XP FS
MessageBox(NULL, "HalReturnToFirmware()", "CxbxKrnl", MB_OK); // ******************************************************************
/* // * debug trace
ReturnFirmwareHalt = 0x0, // ******************************************************************
ReturnFirmwareReboot = 0x1, #ifdef _DEBUG
ReturnFirmwareQuickReboot = 0x2, {
ReturnFirmwareHard = 0x3, printf("CxbxKrnl [0x%.08X]: RtlEnterCriticalSection\n"
ReturnFirmwareFatal = 0x4, " (\n"
ReturnFirmwareAll = 0x5 " Unknown : 0x%.08X\n"
*/ " );\n",
GetCurrentThreadId(), Unknown);
}
#endif
EmuXSwapFS(); // XBox FS
}
// ******************************************************************
// * 0x0126 RtlEnterCriticalSection
// ******************************************************************
XBSYSAPI EXPORTNUM(294) VOID xboxkrnl::RtlLeaveCriticalSection(DWORD Unknown)
{
EmuXSwapFS(); // Win2k/XP FS
// ******************************************************************
// * debug trace
// ******************************************************************
#ifdef _DEBUG
{
printf("CxbxKrnl [0x%.08X]: RtlLeaveCriticalSection\n"
" (\n"
" Unknown : 0x%.08X\n"
" );\n",
GetCurrentThreadId(), Unknown);
}
#endif
EmuXSwapFS(); // XBox FS EmuXSwapFS(); // XBox FS
exit(1);
} }

View File

@ -99,7 +99,7 @@ CXBXKRNL_API uint32 KernelThunkTable[367] =
(uint32)PANIC(0x002E), // 0x002E (46) (uint32)PANIC(0x002E), // 0x002E (46)
(uint32)PANIC(0x002F), // 0x002F (47) (uint32)PANIC(0x002F), // 0x002F (47)
(uint32)PANIC(0x0030), // 0x0030 (48) (uint32)PANIC(0x0030), // 0x0030 (48)
(uint32)&xboxkrnl::HalReturnToFirmware, // 0x0031 (49) (uint32)&xboxkrnl::HalReturnToFirmware, // 0x0031 (49)
(uint32)PANIC(0x0032), // 0x0032 (50) (uint32)PANIC(0x0032), // 0x0032 (50)
(uint32)PANIC(0x0033), // 0x0033 (51) (uint32)PANIC(0x0033), // 0x0033 (51)
(uint32)PANIC(0x0034), // 0x0034 (52) (uint32)PANIC(0x0034), // 0x0034 (52)
@ -327,7 +327,7 @@ CXBXKRNL_API uint32 KernelThunkTable[367] =
(uint32)PANIC(0x0112), // 0x0112 (274) (uint32)PANIC(0x0112), // 0x0112 (274)
(uint32)PANIC(0x0113), // 0x0113 (275) (uint32)PANIC(0x0113), // 0x0113 (275)
(uint32)PANIC(0x0114), // 0x0114 (276) (uint32)PANIC(0x0114), // 0x0114 (276)
(uint32)PANIC(0x0115), // 0x0115 (277) (uint32)xboxkrnl::RtlEnterCriticalSection, // 0x0115 (277)
(uint32)PANIC(0x0116), // 0x0116 (278) (uint32)PANIC(0x0116), // 0x0116 (278)
(uint32)PANIC(0x0117), // 0x0117 (279) (uint32)PANIC(0x0117), // 0x0117 (279)
(uint32)PANIC(0x0118), // 0x0118 (280) (uint32)PANIC(0x0118), // 0x0118 (280)
@ -344,7 +344,7 @@ CXBXKRNL_API uint32 KernelThunkTable[367] =
(uint32)PANIC(0x0123), // 0x0123 (291) (uint32)PANIC(0x0123), // 0x0123 (291)
(uint32)PANIC(0x0124), // 0x0124 (292) (uint32)PANIC(0x0124), // 0x0124 (292)
(uint32)PANIC(0x0125), // 0x0125 (293) (uint32)PANIC(0x0125), // 0x0125 (293)
(uint32)PANIC(0x0126), // 0x0126 (294) (uint32)xboxkrnl::RtlLeaveCriticalSection, // 0x0126 (294)
(uint32)PANIC(0x0127), // 0x0127 (295) (uint32)PANIC(0x0127), // 0x0127 (295)
(uint32)PANIC(0x0128), // 0x0128 (296) (uint32)PANIC(0x0128), // 0x0128 (296)
(uint32)PANIC(0x0129), // 0x0129 (297) (uint32)PANIC(0x0129), // 0x0129 (297)