| 779 | 'dwNumberOfBytesToMap' : SIZE_T |
| 780 | }) |
| 781 | def hook_MapViewOfFile(ql: Qiling, address: int, params): |
| 782 | hFileMappingObject = params['hFileMappingObject'] |
| 783 | dwFileOffsetHigh = params['dwFileOffsetHigh'] |
| 784 | dwFileOffsetLow = params['dwFileOffsetLow'] |
| 785 | dwNumberOfBytesToMap = params['dwNumberOfBytesToMap'] |
| 786 | |
| 787 | handles: HandleManager = ql.os.handle_manager |
| 788 | fm_handle = handles.get(hFileMappingObject) |
| 789 | |
| 790 | if fm_handle is None: |
| 791 | return 0 |
| 792 | |
| 793 | fmobj = fm_handle.obj |
| 794 | |
| 795 | # the respective file mapping hFile was set to INVALID_HANDLE_VALUE (that is, mapping is backed by page file) |
| 796 | if isinstance(fmobj, FileMappingMem): |
| 797 | mapview = ql.os.heap.alloc(dwNumberOfBytesToMap) |
| 798 | |
| 799 | if not mapview: |
| 800 | return 0 |
| 801 | |
| 802 | else: |
| 803 | offset = (dwFileOffsetHigh << 32) | dwFileOffsetLow |
| 804 | mapview_size = dwNumberOfBytesToMap or (fmobj.get_file_size() - offset) |
| 805 | |
| 806 | if mapview_size < 1: |
| 807 | return 0 |
| 808 | |
| 809 | mapview = ql.os.heap.alloc(mapview_size) |
| 810 | |
| 811 | if not mapview: |
| 812 | return 0 |
| 813 | |
| 814 | # read content from file but retain original position. |
| 815 | # not sure this is actually required since all accesses to this memory area are monitored |
| 816 | # and relect file content rather than what is currently in memory |
| 817 | data = fmobj.read(offset, mapview_size) |
| 818 | ql.mem.write(mapview, data) |
| 819 | |
| 820 | fmobj.map_view(ql, offset, mapview, mapview + mapview_size - 1) |
| 821 | |
| 822 | # although file views are not strictly handles, it would be easier to manage them as such |
| 823 | handles.append(Handle(id=mapview, obj=fmobj)) |
| 824 | |
| 825 | return mapview |
| 826 | |
| 827 | # BOOL UnmapViewOfFile( |
| 828 | # LPCVOID lpBaseAddress |