Support section related Windows syscalls

litebox_common_windows/src/loader.rs

@@ -489,6 +489,21 @@ impl PeParsedFile {
  self.image.image_base
  }
 
+ #[must_use]
+ pub fn machine(&self) -> u16 {
+ self.image.machine
+ }
+
+ #[must_use]
+ pub fn characteristics(&self) -> u16 {
+ self.image.characteristics
+ }
+
+ #[must_use]
+ pub fn dll_characteristics(&self) -> u16 {
+ self.image.dll_characteristics
+ }
+
  /// Returns whether the image opts into dynamic-base loading.
  #[must_use]
  pub fn has_dynamic_base(&self) -> bool {

litebox_common_windows/src/nt_status.rs

@@ -159,6 +159,8 @@ impl NtStatus {
  0xC0000046 => "STATUS_MUTANT_NOT_OWNED: Mutant not owned",
  0xC0000047 => "STATUS_SEMAPHORE_LIMIT_EXCEEDED: Semaphore limit exceeded",
  0xC0000048 => "STATUS_PORT_ALREADY_SET: Port already set",
+ 0xC0000049 => "STATUS_SECTION_NOT_IMAGE: Section not image",
+ 0xC000004E => "STATUS_SECTION_PROTECTION: Section protection",
  0xC000004F => "STATUS_EAS_NOT_SUPPORTED: EAS not supported",
  0xC0000050 => "STATUS_EA_TOO_LARGE: EA too large",
  0xC0000056 => "STATUS_DELETE_PENDING: Delete pending",
@@ -420,6 +422,9 @@ impl NtStatus {
  /// STATUS_SECTION_TOO_BIG
  pub const SECTION_TOO_BIG: Self = Self::from_raw(0xC0000040);
 
+ /// STATUS_SECTION_NOT_IMAGE
+ pub const SECTION_NOT_IMAGE: Self = Self::from_raw(0xC0000049);
+
  /// STATUS_PORT_CONNECTION_REFUSED
  pub const PORT_CONNECTION_REFUSED: Self = Self::from_raw(0xC0000041);
 
@@ -435,6 +440,9 @@ impl NtStatus {
  /// STATUS_INVALID_PAGE_PROTECTION
  pub const INVALID_PAGE_PROTECTION: Self = Self::from_raw(0xC0000045);
 
+ /// STATUS_SECTION_PROTECTION
+ pub const SECTION_PROTECTION: Self = Self::from_raw(0xC000004E);
+
  /// STATUS_MUTANT_NOT_OWNED
  pub const MUTANT_NOT_OWNED: Self = Self::from_raw(0xC0000046);
 

litebox_shim_windows/src/lib.rs

@@ -38,6 +38,9 @@ use crate::syscalls::event::{EventHandleObject, EventObject, EventSubsystem};
 use crate::syscalls::file::{FileObject, FileObjectSubsystem};
 use crate::syscalls::iocp::{IoCompletionHandleObject, IoCompletionSubsystem};
 use crate::syscalls::registry::{RegistryKeyObject, RegistryKeySubsystem};
+use crate::syscalls::section::{
+ MapViewOfSectionParameters, SectionHandleObject, SectionObject, SectionSubsystem,
+};
 use crate::syscalls::symlink::{SymbolicLinkHandleObject, SymbolicLinkSubsystem};
 use crate::syscalls::timer::{TimerCreateParameters, TimerHandleObject, TimerSubsystem};
 use crate::syscalls::wait_completion_packet::{
@@ -90,6 +93,10 @@ pub(crate) type WindowsNlsSectionMappings<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<(u32, u32), (usize, usize)>>;
 pub(crate) type WindowsVirtualAllocations<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<usize, WindowsVirtualAllocation>>;
+pub(crate) type WindowsSectionNamespace<Platform> =
+ litebox::sync::RwLock<Platform, BTreeMap<String, Weak<SectionObject<Platform>>>>;
+pub(crate) type WindowsSectionViews<Platform> =
+ litebox::sync::RwLock<Platform, BTreeMap<usize, WindowsSectionView<Platform>>>;
 pub(crate) type WindowsEventNamespace<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<String, Weak<EventObject<Platform>>>>;
 pub(crate) type WindowsDirectoryNamespace<Platform> = DirectoryNamespace<Platform>;
@@ -103,6 +110,22 @@ pub(crate) struct WindowsVirtualAllocation {
  pub(crate) pages: rangemap::RangeMap<usize, syscalls::mm::PageProtection>,
 }
 
+pub(crate) struct WindowsSectionView<Platform: ShimPlatform> {
+ pub(crate) size: usize,
+ pub(crate) section_offset: usize,
+ pub(crate) section: Option<Arc<SectionObject<Platform>>>,
+}
+
+impl<Platform: ShimPlatform> Clone for WindowsSectionView<Platform> {
+ fn clone(&self) -> Self {
+ Self {
+ size: self.size,
+ section_offset: self.section_offset,
+ section: self.section.clone(),
+ }
+ }
+}
+
 pub type DefaultFS<Platform> = WindowsFS<Platform>;
 
 pub type WindowsFS<Platform> = litebox::fs::layered::FileSystem<
@@ -343,6 +366,8 @@ impl<Platform: ShimPlatform, FS: ShimFS> WindowsShim<Platform, FS> {
  handles: WindowsHandleStore::<Platform>::new(litebox::fd::RawDescriptorStorage::new()),
  directory_namespace,
  event_namespace: WindowsEventNamespace::<Platform>::new(BTreeMap::new()),
+ section_namespace: WindowsSectionNamespace::<Platform>::new(BTreeMap::new()),
+ section_views: WindowsSectionViews::<Platform>::new(BTreeMap::new()),
  nls_section_mappings: WindowsNlsSectionMappings::<Platform>::new(BTreeMap::new()),
  virtual_allocations: load_info.virtual_allocations,
  system_lcid: AtomicU32::new(syscalls::nls::DEFAULT_LOCALE_ID),
@@ -387,6 +412,8 @@ pub struct Process<Platform: ShimPlatform> {
  handles: WindowsHandleStore<Platform>,
  directory_namespace: WindowsDirectoryNamespace<Platform>,
  event_namespace: WindowsEventNamespace<Platform>,
+ section_namespace: WindowsSectionNamespace<Platform>,
+ section_views: WindowsSectionViews<Platform>,
  nls_section_mappings: WindowsNlsSectionMappings<Platform>,
  virtual_allocations: WindowsVirtualAllocations<Platform>,
  system_lcid: AtomicU32,
@@ -588,6 +615,15 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtOpenSection {
+ section_handle,
+ desired_access,
+ object_attributes,
+ } => {
+ let status =
+ self.sys_nt_open_section(section_handle, desired_access, object_attributes);
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtQueryDirectoryObject {
  directory_handle,
  buffer,
@@ -662,6 +698,50 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtCreateSection {
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ } => {
+ let status = self.sys_nt_create_section(
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ );
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtCreateSectionEx {
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ extended_parameters,
+ extended_parameter_count,
+ } => {
+ let status = self.sys_nt_create_section_ex(
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ extended_parameters,
+ extended_parameter_count,
+ );
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtCreateWaitCompletionPacket {
  wait_completion_packet_handle,
  desired_access,
@@ -1023,6 +1103,22 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtQuerySection {
+ section_handle,
+ section_information_class,
+ section_information,
+ section_information_length,
+ return_length,
+ } => {
+ let status = self.sys_nt_query_section(
+ section_handle,
+ section_information_class,
+ section_information,
+ section_information_length,
+ return_length,
+ );
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtQueryInformationProcess {
  process_handle,
  process_information_class,
@@ -1199,6 +1295,80 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtMapViewOfSection {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ } => {
+ let status = self.sys_nt_map_view_of_section(MapViewOfSectionParameters {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ });
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtMapViewOfSectionEx {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ extended_parameters,
+ extended_parameter_count,
+ } => {
+ let status = self.sys_nt_map_view_of_section_ex(
+ MapViewOfSectionParameters {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ },
+ extended_parameters,
+ extended_parameter_count,
+ );
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtUnmapViewOfSection {
+ process_handle,
+ base_address,
+ } => {
+ let status = self.sys_nt_unmap_view_of_section(process_handle, base_address);
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtUnmapViewOfSectionEx {
+ process_handle,
+ base_address,
+ flags,
+ } => {
+ let status =
+ self.sys_nt_unmap_view_of_section_ex(process_handle, base_address, flags);
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtTerminateProcess {
  process_handle,
  exit_status,
@@ -1306,6 +1476,14 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  ) {
  return NtStatus::SUCCESS;
  }
+ if remove_raw_handle_by_raw_fd::<Platform, SectionSubsystem<Platform>>(
+ &self.global.litebox,
+ &self.process.handles,
+ raw_fd,
+ |section| visitor.section(section),
+ ) {
+ return NtStatus::SUCCESS;
+ }
  NtStatus::INVALID_HANDLE
  }
 
@@ -1342,6 +1520,8 @@ trait RawHandleVisitor<Platform: ShimPlatform, FS: ShimFS> {
  );
 
  fn worker_factory(&self, worker_factory: WorkerFactoryHandleObject<Platform>);
+
+ fn section(&self, section: SectionHandleObject<Platform>);
 }
 
 struct CloseRawHandleVisitor<'task, Platform: ShimPlatform, FS: ShimFS> {
@@ -1389,6 +1569,10 @@ impl<Platform: ShimPlatform, FS: ShimFS> RawHandleVisitor<Platform, FS>
  fn worker_factory(&self, worker_factory: WorkerFactoryHandleObject<Platform>) {
  Task::<Platform, FS>::close_worker_factory(worker_factory);
  }
+
+ fn section(&self, section: SectionHandleObject<Platform>) {
+ Task::<Platform, FS>::close_section(section);
+ }
 }
 
 /// The shim entrypoint object passed to the platform.

litebox_shim_windows/src/loader/mod.rs

@@ -4,3 +4,4 @@
 mod pe;
 
 pub(super) use pe::{PeLoader, WindowsLoadError};
+pub(crate) use pe::{image_section_metadata, load_image_section};

litebox_shim_windows/src/loader/pe.rs

@@ -1224,6 +1224,58 @@ fn load_image<Platform: crate::ShimPlatform, FS: ShimFS>(
  load_image_with_writable_sections(fs, path, platform, page_manager, &[])
 }
 
+pub(crate) fn load_image_section<Platform: crate::ShimPlatform, FS: ShimFS>(
+ platform: &'static Platform,
+ fs: Arc<FS>,
+ path: &str,
+ page_manager: &crate::WindowsPageManager<Platform>,
+ virtual_allocations: &crate::WindowsVirtualAllocations<Platform>,
+) -> Result<MappingInfo, WindowsLoadError> {
+ let image = load_image(platform, fs, path, page_manager)?;
+ let mapping = image.mapping;
+ register_image_virtual_allocation(virtual_allocations, mapping, image.pages);
+ Ok(mapping)
+}
+
+pub(crate) struct ImageSectionMetadata {
+ pub(crate) transfer_address: usize,
+ pub(crate) file_size: u32,
+ pub(crate) subsystem: u32,
+ pub(crate) subsystem_major_version: u16,
+ pub(crate) subsystem_minor_version: u16,
+ pub(crate) image_characteristics: u16,
+ pub(crate) dll_characteristics: u16,
+ pub(crate) machine: u16,
+}
+
+pub(crate) fn image_section_metadata<FS: ShimFS>(
+ fs: Arc<FS>,
+ path: &str,
+) -> Result<ImageSectionMetadata, WindowsLoadError> {
+ let file = PeImageFile::open(fs, path)?;
+ let parsed = PeParsedFile::parse(&mut &file).map_err(WindowsLoadError::Parse)?;
+ let file_size = file
+ .fs
+ .fd_file_status(&file.fd)
+ .map_err(PeImageAccessError::FileStatus)?
+ .size
+ .try_into()
+ .map_err(|_| PeImageAccessError::AddressOverflow)?;
+ Ok(ImageSectionMetadata {
+ transfer_address: parsed
+ .image_base()
+ .checked_add(parsed.entry_point_rva())
+ .ok_or(PeImageAccessError::AddressOverflow)?,
+ file_size,
+ subsystem: u32::from(parsed.subsystem()),
+ subsystem_major_version: parsed.major_subsystem_version(),
+ subsystem_minor_version: parsed.minor_subsystem_version(),
+ image_characteristics: parsed.characteristics(),
+ dll_characteristics: parsed.dll_characteristics(),
+ machine: parsed.machine(),
+ })
+}
+
 fn load_image_with_writable_sections<Platform: crate::ShimPlatform, FS: ShimFS>(
  fs: Arc<FS>,
  path: &str,

litebox_common_windows/src/loader.rs

@@ -489,6 +489,21 @@ impl PeParsedFile {
  self.image.image_base
  }
 
+ #[must_use]
+ pub fn machine(&self) -> u16 {
+ self.image.machine
+ }
+
+ #[must_use]
+ pub fn characteristics(&self) -> u16 {
+ self.image.characteristics
+ }
+
+ #[must_use]
+ pub fn dll_characteristics(&self) -> u16 {
+ self.image.dll_characteristics
+ }
+
  /// Returns whether the image opts into dynamic-base loading.
  #[must_use]
  pub fn has_dynamic_base(&self) -> bool {

litebox_common_windows/src/nt_status.rs

@@ -159,6 +159,8 @@ impl NtStatus {
  0xC0000046 => "STATUS_MUTANT_NOT_OWNED: Mutant not owned",
  0xC0000047 => "STATUS_SEMAPHORE_LIMIT_EXCEEDED: Semaphore limit exceeded",
  0xC0000048 => "STATUS_PORT_ALREADY_SET: Port already set",
+ 0xC0000049 => "STATUS_SECTION_NOT_IMAGE: Section not image",
+ 0xC000004E => "STATUS_SECTION_PROTECTION: Section protection",
  0xC000004F => "STATUS_EAS_NOT_SUPPORTED: EAS not supported",
  0xC0000050 => "STATUS_EA_TOO_LARGE: EA too large",
  0xC0000056 => "STATUS_DELETE_PENDING: Delete pending",
@@ -420,6 +422,9 @@ impl NtStatus {
  /// STATUS_SECTION_TOO_BIG
  pub const SECTION_TOO_BIG: Self = Self::from_raw(0xC0000040);
 
+ /// STATUS_SECTION_NOT_IMAGE
+ pub const SECTION_NOT_IMAGE: Self = Self::from_raw(0xC0000049);
+
  /// STATUS_PORT_CONNECTION_REFUSED
  pub const PORT_CONNECTION_REFUSED: Self = Self::from_raw(0xC0000041);
 
@@ -435,6 +440,9 @@ impl NtStatus {
  /// STATUS_INVALID_PAGE_PROTECTION
  pub const INVALID_PAGE_PROTECTION: Self = Self::from_raw(0xC0000045);
 
+ /// STATUS_SECTION_PROTECTION
+ pub const SECTION_PROTECTION: Self = Self::from_raw(0xC000004E);
+
  /// STATUS_MUTANT_NOT_OWNED
  pub const MUTANT_NOT_OWNED: Self = Self::from_raw(0xC0000046);
 

litebox_shim_windows/src/lib.rs

@@ -38,6 +38,9 @@ use crate::syscalls::event::{EventHandleObject, EventObject, EventSubsystem};
 use crate::syscalls::file::{FileObject, FileObjectSubsystem};
 use crate::syscalls::iocp::{IoCompletionHandleObject, IoCompletionSubsystem};
 use crate::syscalls::registry::{RegistryKeyObject, RegistryKeySubsystem};
+use crate::syscalls::section::{
+ MapViewOfSectionParameters, SectionHandleObject, SectionObject, SectionSubsystem,
+};
 use crate::syscalls::symlink::{SymbolicLinkHandleObject, SymbolicLinkSubsystem};
 use crate::syscalls::timer::{TimerCreateParameters, TimerHandleObject, TimerSubsystem};
 use crate::syscalls::wait_completion_packet::{
@@ -90,6 +93,10 @@ pub(crate) type WindowsNlsSectionMappings<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<(u32, u32), (usize, usize)>>;
 pub(crate) type WindowsVirtualAllocations<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<usize, WindowsVirtualAllocation>>;
+pub(crate) type WindowsSectionNamespace<Platform> =
+ litebox::sync::RwLock<Platform, BTreeMap<String, Weak<SectionObject<Platform>>>>;
+pub(crate) type WindowsSectionViews<Platform> =
+ litebox::sync::RwLock<Platform, BTreeMap<usize, WindowsSectionView<Platform>>>;
 pub(crate) type WindowsEventNamespace<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<String, Weak<EventObject<Platform>>>>;
 pub(crate) type WindowsDirectoryNamespace<Platform> = DirectoryNamespace<Platform>;
@@ -103,6 +110,22 @@ pub(crate) struct WindowsVirtualAllocation {
  pub(crate) pages: rangemap::RangeMap<usize, syscalls::mm::PageProtection>,
 }
 
+pub(crate) struct WindowsSectionView<Platform: ShimPlatform> {
+ pub(crate) size: usize,
+ pub(crate) section_offset: usize,
+ pub(crate) section: Option<Arc<SectionObject<Platform>>>,
+}
+
+impl<Platform: ShimPlatform> Clone for WindowsSectionView<Platform> {
+ fn clone(&self) -> Self {
+ Self {
+ size: self.size,
+ section_offset: self.section_offset,
+ section: self.section.clone(),
+ }
+ }
+}
+
 pub type DefaultFS<Platform> = WindowsFS<Platform>;
 
 pub type WindowsFS<Platform> = litebox::fs::layered::FileSystem<
@@ -343,6 +366,8 @@ impl<Platform: ShimPlatform, FS: ShimFS> WindowsShim<Platform, FS> {
  handles: WindowsHandleStore::<Platform>::new(litebox::fd::RawDescriptorStorage::new()),
  directory_namespace,
  event_namespace: WindowsEventNamespace::<Platform>::new(BTreeMap::new()),
+ section_namespace: WindowsSectionNamespace::<Platform>::new(BTreeMap::new()),
+ section_views: WindowsSectionViews::<Platform>::new(BTreeMap::new()),
  nls_section_mappings: WindowsNlsSectionMappings::<Platform>::new(BTreeMap::new()),
  virtual_allocations: load_info.virtual_allocations,
  system_lcid: AtomicU32::new(syscalls::nls::DEFAULT_LOCALE_ID),
@@ -387,6 +412,8 @@ pub struct Process<Platform: ShimPlatform> {
  handles: WindowsHandleStore<Platform>,
  directory_namespace: WindowsDirectoryNamespace<Platform>,
  event_namespace: WindowsEventNamespace<Platform>,
+ section_namespace: WindowsSectionNamespace<Platform>,
+ section_views: WindowsSectionViews<Platform>,
  nls_section_mappings: WindowsNlsSectionMappings<Platform>,
  virtual_allocations: WindowsVirtualAllocations<Platform>,
  system_lcid: AtomicU32,
@@ -588,6 +615,15 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtOpenSection {
+ section_handle,
+ desired_access,
+ object_attributes,
+ } => {
+ let status =
+ self.sys_nt_open_section(section_handle, desired_access, object_attributes);
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtQueryDirectoryObject {
  directory_handle,
  buffer,
@@ -662,6 +698,50 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtCreateSection {
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ } => {
+ let status = self.sys_nt_create_section(
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ );
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtCreateSectionEx {
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ extended_parameters,
+ extended_parameter_count,
+ } => {
+ let status = self.sys_nt_create_section_ex(
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ extended_parameters,
+ extended_parameter_count,
+ );
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtCreateWaitCompletionPacket {
  wait_completion_packet_handle,
  desired_access,
@@ -1023,6 +1103,22 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtQuerySection {
+ section_handle,
+ section_information_class,
+ section_information,
+ section_information_length,
+ return_length,
+ } => {
+ let status = self.sys_nt_query_section(
+ section_handle,
+ section_information_class,
+ section_information,
+ section_information_length,
+ return_length,
+ );
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtQueryInformationProcess {
  process_handle,
  process_information_class,
@@ -1199,6 +1295,80 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtMapViewOfSection {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ } => {
+ let status = self.sys_nt_map_view_of_section(MapViewOfSectionParameters {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ });
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtMapViewOfSectionEx {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ extended_parameters,
+ extended_parameter_count,
+ } => {
+ let status = self.sys_nt_map_view_of_section_ex(
+ MapViewOfSectionParameters {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ },
+ extended_parameters,
+ extended_parameter_count,
+ );
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtUnmapViewOfSection {
+ process_handle,
+ base_address,
+ } => {
+ let status = self.sys_nt_unmap_view_of_section(process_handle, base_address);
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtUnmapViewOfSectionEx {
+ process_handle,
+ base_address,
+ flags,
+ } => {
+ let status =
+ self.sys_nt_unmap_view_of_section_ex(process_handle, base_address, flags);
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtTerminateProcess {
  process_handle,
  exit_status,
@@ -1306,6 +1476,14 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  ) {
  return NtStatus::SUCCESS;
  }
+ if remove_raw_handle_by_raw_fd::<Platform, SectionSubsystem<Platform>>(
+ &self.global.litebox,
+ &self.process.handles,
+ raw_fd,
+ |section| visitor.section(section),
+ ) {
+ return NtStatus::SUCCESS;
+ }
  NtStatus::INVALID_HANDLE
  }
 
@@ -1342,6 +1520,8 @@ trait RawHandleVisitor<Platform: ShimPlatform, FS: ShimFS> {
  );
 
  fn worker_factory(&self, worker_factory: WorkerFactoryHandleObject<Platform>);
+
+ fn section(&self, section: SectionHandleObject<Platform>);
 }
 
 struct CloseRawHandleVisitor<'task, Platform: ShimPlatform, FS: ShimFS> {
@@ -1389,6 +1569,10 @@ impl<Platform: ShimPlatform, FS: ShimFS> RawHandleVisitor<Platform, FS>
  fn worker_factory(&self, worker_factory: WorkerFactoryHandleObject<Platform>) {
  Task::<Platform, FS>::close_worker_factory(worker_factory);
  }
+
+ fn section(&self, section: SectionHandleObject<Platform>) {
+ Task::<Platform, FS>::close_section(section);
+ }
 }
 
 /// The shim entrypoint object passed to the platform.

litebox_shim_windows/src/loader/mod.rs

@@ -4,3 +4,4 @@
 mod pe;
 
 pub(super) use pe::{PeLoader, WindowsLoadError};
+pub(crate) use pe::{image_section_metadata, load_image_section};

litebox_shim_windows/src/loader/pe.rs

@@ -1224,6 +1224,58 @@ fn load_image<Platform: crate::ShimPlatform, FS: ShimFS>(
  load_image_with_writable_sections(fs, path, platform, page_manager, &[])
 }
 
+pub(crate) fn load_image_section<Platform: crate::ShimPlatform, FS: ShimFS>(
+ platform: &'static Platform,
+ fs: Arc<FS>,
+ path: &str,
+ page_manager: &crate::WindowsPageManager<Platform>,
+ virtual_allocations: &crate::WindowsVirtualAllocations<Platform>,
+) -> Result<MappingInfo, WindowsLoadError> {
+ let image = load_image(platform, fs, path, page_manager)?;
+ let mapping = image.mapping;
+ register_image_virtual_allocation(virtual_allocations, mapping, image.pages);
+ Ok(mapping)
+}
+
+pub(crate) struct ImageSectionMetadata {
+ pub(crate) transfer_address: usize,
+ pub(crate) file_size: u32,
+ pub(crate) subsystem: u32,
+ pub(crate) subsystem_major_version: u16,
+ pub(crate) subsystem_minor_version: u16,
+ pub(crate) image_characteristics: u16,
+ pub(crate) dll_characteristics: u16,
+ pub(crate) machine: u16,
+}
+
+pub(crate) fn image_section_metadata<FS: ShimFS>(
+ fs: Arc<FS>,
+ path: &str,
+) -> Result<ImageSectionMetadata, WindowsLoadError> {
+ let file = PeImageFile::open(fs, path)?;
+ let parsed = PeParsedFile::parse(&mut &file).map_err(WindowsLoadError::Parse)?;
+ let file_size = file
+ .fs
+ .fd_file_status(&file.fd)
+ .map_err(PeImageAccessError::FileStatus)?
+ .size
+ .try_into()
+ .map_err(|_| PeImageAccessError::AddressOverflow)?;
+ Ok(ImageSectionMetadata {
+ transfer_address: parsed
+ .image_base()
+ .checked_add(parsed.entry_point_rva())
+ .ok_or(PeImageAccessError::AddressOverflow)?,
+ file_size,
+ subsystem: u32::from(parsed.subsystem()),
+ subsystem_major_version: parsed.major_subsystem_version(),
+ subsystem_minor_version: parsed.minor_subsystem_version(),
+ image_characteristics: parsed.characteristics(),
+ dll_characteristics: parsed.dll_characteristics(),
+ machine: parsed.machine(),
+ })
+}
+
 fn load_image_with_writable_sections<Platform: crate::ShimPlatform, FS: ShimFS>(
  fs: Arc<FS>,
  path: &str,

litebox_common_windows/src/loader.rs

@@ -489,6 +489,21 @@ impl PeParsedFile {
  self.image.image_base
  }
 
+ #[must_use]
+ pub fn machine(&self) -> u16 {
+ self.image.machine
+ }
+
+ #[must_use]
+ pub fn characteristics(&self) -> u16 {
+ self.image.characteristics
+ }
+
+ #[must_use]
+ pub fn dll_characteristics(&self) -> u16 {
+ self.image.dll_characteristics
+ }
+
  /// Returns whether the image opts into dynamic-base loading.
  #[must_use]
  pub fn has_dynamic_base(&self) -> bool {

litebox_common_windows/src/nt_status.rs

@@ -159,6 +159,8 @@ impl NtStatus {
  0xC0000046 => "STATUS_MUTANT_NOT_OWNED: Mutant not owned",
  0xC0000047 => "STATUS_SEMAPHORE_LIMIT_EXCEEDED: Semaphore limit exceeded",
  0xC0000048 => "STATUS_PORT_ALREADY_SET: Port already set",
+ 0xC0000049 => "STATUS_SECTION_NOT_IMAGE: Section not image",
+ 0xC000004E => "STATUS_SECTION_PROTECTION: Section protection",
  0xC000004F => "STATUS_EAS_NOT_SUPPORTED: EAS not supported",
  0xC0000050 => "STATUS_EA_TOO_LARGE: EA too large",
  0xC0000056 => "STATUS_DELETE_PENDING: Delete pending",
@@ -420,6 +422,9 @@ impl NtStatus {
  /// STATUS_SECTION_TOO_BIG
  pub const SECTION_TOO_BIG: Self = Self::from_raw(0xC0000040);
 
+ /// STATUS_SECTION_NOT_IMAGE
+ pub const SECTION_NOT_IMAGE: Self = Self::from_raw(0xC0000049);
+
  /// STATUS_PORT_CONNECTION_REFUSED
  pub const PORT_CONNECTION_REFUSED: Self = Self::from_raw(0xC0000041);
 
@@ -435,6 +440,9 @@ impl NtStatus {
  /// STATUS_INVALID_PAGE_PROTECTION
  pub const INVALID_PAGE_PROTECTION: Self = Self::from_raw(0xC0000045);
 
+ /// STATUS_SECTION_PROTECTION
+ pub const SECTION_PROTECTION: Self = Self::from_raw(0xC000004E);
+
  /// STATUS_MUTANT_NOT_OWNED
  pub const MUTANT_NOT_OWNED: Self = Self::from_raw(0xC0000046);
 

litebox_shim_windows/src/lib.rs

@@ -38,6 +38,9 @@ use crate::syscalls::event::{EventHandleObject, EventObject, EventSubsystem};
 use crate::syscalls::file::{FileObject, FileObjectSubsystem};
 use crate::syscalls::iocp::{IoCompletionHandleObject, IoCompletionSubsystem};
 use crate::syscalls::registry::{RegistryKeyObject, RegistryKeySubsystem};
+use crate::syscalls::section::{
+ MapViewOfSectionParameters, SectionHandleObject, SectionObject, SectionSubsystem,
+};
 use crate::syscalls::symlink::{SymbolicLinkHandleObject, SymbolicLinkSubsystem};
 use crate::syscalls::timer::{TimerCreateParameters, TimerHandleObject, TimerSubsystem};
 use crate::syscalls::wait_completion_packet::{
@@ -90,6 +93,10 @@ pub(crate) type WindowsNlsSectionMappings<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<(u32, u32), (usize, usize)>>;
 pub(crate) type WindowsVirtualAllocations<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<usize, WindowsVirtualAllocation>>;
+pub(crate) type WindowsSectionNamespace<Platform> =
+ litebox::sync::RwLock<Platform, BTreeMap<String, Weak<SectionObject<Platform>>>>;
+pub(crate) type WindowsSectionViews<Platform> =
+ litebox::sync::RwLock<Platform, BTreeMap<usize, WindowsSectionView<Platform>>>;
 pub(crate) type WindowsEventNamespace<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<String, Weak<EventObject<Platform>>>>;
 pub(crate) type WindowsDirectoryNamespace<Platform> = DirectoryNamespace<Platform>;
@@ -103,6 +110,22 @@ pub(crate) struct WindowsVirtualAllocation {
  pub(crate) pages: rangemap::RangeMap<usize, syscalls::mm::PageProtection>,
 }
 
+pub(crate) struct WindowsSectionView<Platform: ShimPlatform> {
+ pub(crate) size: usize,
+ pub(crate) section_offset: usize,
+ pub(crate) section: Option<Arc<SectionObject<Platform>>>,
+}
+
+impl<Platform: ShimPlatform> Clone for WindowsSectionView<Platform> {
+ fn clone(&self) -> Self {
+ Self {
+ size: self.size,
+ section_offset: self.section_offset,
+ section: self.section.clone(),
+ }
+ }
+}
+
 pub type DefaultFS<Platform> = WindowsFS<Platform>;
 
 pub type WindowsFS<Platform> = litebox::fs::layered::FileSystem<
@@ -343,6 +366,8 @@ impl<Platform: ShimPlatform, FS: ShimFS> WindowsShim<Platform, FS> {
  handles: WindowsHandleStore::<Platform>::new(litebox::fd::RawDescriptorStorage::new()),
  directory_namespace,
  event_namespace: WindowsEventNamespace::<Platform>::new(BTreeMap::new()),
+ section_namespace: WindowsSectionNamespace::<Platform>::new(BTreeMap::new()),
+ section_views: WindowsSectionViews::<Platform>::new(BTreeMap::new()),
  nls_section_mappings: WindowsNlsSectionMappings::<Platform>::new(BTreeMap::new()),
  virtual_allocations: load_info.virtual_allocations,
  system_lcid: AtomicU32::new(syscalls::nls::DEFAULT_LOCALE_ID),
@@ -387,6 +412,8 @@ pub struct Process<Platform: ShimPlatform> {
  handles: WindowsHandleStore<Platform>,
  directory_namespace: WindowsDirectoryNamespace<Platform>,
  event_namespace: WindowsEventNamespace<Platform>,
+ section_namespace: WindowsSectionNamespace<Platform>,
+ section_views: WindowsSectionViews<Platform>,
  nls_section_mappings: WindowsNlsSectionMappings<Platform>,
  virtual_allocations: WindowsVirtualAllocations<Platform>,
  system_lcid: AtomicU32,
@@ -588,6 +615,15 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtOpenSection {
+ section_handle,
+ desired_access,
+ object_attributes,
+ } => {
+ let status =
+ self.sys_nt_open_section(section_handle, desired_access, object_attributes);
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtQueryDirectoryObject {
  directory_handle,
  buffer,
@@ -662,6 +698,50 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtCreateSection {
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ } => {
+ let status = self.sys_nt_create_section(
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ );
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtCreateSectionEx {
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ extended_parameters,
+ extended_parameter_count,
+ } => {
+ let status = self.sys_nt_create_section_ex(
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ extended_parameters,
+ extended_parameter_count,
+ );
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtCreateWaitCompletionPacket {
  wait_completion_packet_handle,
  desired_access,
@@ -1023,6 +1103,22 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtQuerySection {
+ section_handle,
+ section_information_class,
+ section_information,
+ section_information_length,
+ return_length,
+ } => {
+ let status = self.sys_nt_query_section(
+ section_handle,
+ section_information_class,
+ section_information,
+ section_information_length,
+ return_length,
+ );
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtQueryInformationProcess {
  process_handle,
  process_information_class,
@@ -1199,6 +1295,80 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtMapViewOfSection {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ } => {
+ let status = self.sys_nt_map_view_of_section(MapViewOfSectionParameters {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ });
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtMapViewOfSectionEx {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ extended_parameters,
+ extended_parameter_count,
+ } => {
+ let status = self.sys_nt_map_view_of_section_ex(
+ MapViewOfSectionParameters {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ },
+ extended_parameters,
+ extended_parameter_count,
+ );
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtUnmapViewOfSection {
+ process_handle,
+ base_address,
+ } => {
+ let status = self.sys_nt_unmap_view_of_section(process_handle, base_address);
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtUnmapViewOfSectionEx {
+ process_handle,
+ base_address,
+ flags,
+ } => {
+ let status =
+ self.sys_nt_unmap_view_of_section_ex(process_handle, base_address, flags);
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtTerminateProcess {
  process_handle,
  exit_status,
@@ -1306,6 +1476,14 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  ) {
  return NtStatus::SUCCESS;
  }
+ if remove_raw_handle_by_raw_fd::<Platform, SectionSubsystem<Platform>>(
+ &self.global.litebox,
+ &self.process.handles,
+ raw_fd,
+ |section| visitor.section(section),
+ ) {
+ return NtStatus::SUCCESS;
+ }
  NtStatus::INVALID_HANDLE
  }
 
@@ -1342,6 +1520,8 @@ trait RawHandleVisitor<Platform: ShimPlatform, FS: ShimFS> {
  );
 
  fn worker_factory(&self, worker_factory: WorkerFactoryHandleObject<Platform>);
+
+ fn section(&self, section: SectionHandleObject<Platform>);
 }
 
 struct CloseRawHandleVisitor<'task, Platform: ShimPlatform, FS: ShimFS> {
@@ -1389,6 +1569,10 @@ impl<Platform: ShimPlatform, FS: ShimFS> RawHandleVisitor<Platform, FS>
  fn worker_factory(&self, worker_factory: WorkerFactoryHandleObject<Platform>) {
  Task::<Platform, FS>::close_worker_factory(worker_factory);
  }
+
+ fn section(&self, section: SectionHandleObject<Platform>) {
+ Task::<Platform, FS>::close_section(section);
+ }
 }
 
 /// The shim entrypoint object passed to the platform.

litebox_shim_windows/src/loader/mod.rs

@@ -4,3 +4,4 @@
 mod pe;
 
 pub(super) use pe::{PeLoader, WindowsLoadError};
+pub(crate) use pe::{image_section_metadata, load_image_section};

litebox_shim_windows/src/loader/pe.rs

@@ -1224,6 +1224,58 @@ fn load_image<Platform: crate::ShimPlatform, FS: ShimFS>(
  load_image_with_writable_sections(fs, path, platform, page_manager, &[])
 }
 
+pub(crate) fn load_image_section<Platform: crate::ShimPlatform, FS: ShimFS>(
+ platform: &'static Platform,
+ fs: Arc<FS>,
+ path: &str,
+ page_manager: &crate::WindowsPageManager<Platform>,
+ virtual_allocations: &crate::WindowsVirtualAllocations<Platform>,
+) -> Result<MappingInfo, WindowsLoadError> {
+ let image = load_image(platform, fs, path, page_manager)?;
+ let mapping = image.mapping;
+ register_image_virtual_allocation(virtual_allocations, mapping, image.pages);
+ Ok(mapping)
+}
+
+pub(crate) struct ImageSectionMetadata {
+ pub(crate) transfer_address: usize,
+ pub(crate) file_size: u32,
+ pub(crate) subsystem: u32,
+ pub(crate) subsystem_major_version: u16,
+ pub(crate) subsystem_minor_version: u16,
+ pub(crate) image_characteristics: u16,
+ pub(crate) dll_characteristics: u16,
+ pub(crate) machine: u16,
+}
+
+pub(crate) fn image_section_metadata<FS: ShimFS>(
+ fs: Arc<FS>,
+ path: &str,
+) -> Result<ImageSectionMetadata, WindowsLoadError> {
+ let file = PeImageFile::open(fs, path)?;
+ let parsed = PeParsedFile::parse(&mut &file).map_err(WindowsLoadError::Parse)?;
+ let file_size = file
+ .fs
+ .fd_file_status(&file.fd)
+ .map_err(PeImageAccessError::FileStatus)?
+ .size
+ .try_into()
+ .map_err(|_| PeImageAccessError::AddressOverflow)?;
+ Ok(ImageSectionMetadata {
+ transfer_address: parsed
+ .image_base()
+ .checked_add(parsed.entry_point_rva())
+ .ok_or(PeImageAccessError::AddressOverflow)?,
+ file_size,
+ subsystem: u32::from(parsed.subsystem()),
+ subsystem_major_version: parsed.major_subsystem_version(),
+ subsystem_minor_version: parsed.minor_subsystem_version(),
+ image_characteristics: parsed.characteristics(),
+ dll_characteristics: parsed.dll_characteristics(),
+ machine: parsed.machine(),
+ })
+}
+
 fn load_image_with_writable_sections<Platform: crate::ShimPlatform, FS: ShimFS>(
  fs: Arc<FS>,
  path: &str,

litebox_common_windows/src/loader.rs

@@ -489,6 +489,21 @@ impl PeParsedFile {
  self.image.image_base
  }
 
+ #[must_use]
+ pub fn machine(&self) -> u16 {
+ self.image.machine
+ }
+
+ #[must_use]
+ pub fn characteristics(&self) -> u16 {
+ self.image.characteristics
+ }
+
+ #[must_use]
+ pub fn dll_characteristics(&self) -> u16 {
+ self.image.dll_characteristics
+ }
+
  /// Returns whether the image opts into dynamic-base loading.
  #[must_use]
  pub fn has_dynamic_base(&self) -> bool {

litebox_common_windows/src/nt_status.rs

@@ -159,6 +159,8 @@ impl NtStatus {
  0xC0000046 => "STATUS_MUTANT_NOT_OWNED: Mutant not owned",
  0xC0000047 => "STATUS_SEMAPHORE_LIMIT_EXCEEDED: Semaphore limit exceeded",
  0xC0000048 => "STATUS_PORT_ALREADY_SET: Port already set",
+ 0xC0000049 => "STATUS_SECTION_NOT_IMAGE: Section not image",
+ 0xC000004E => "STATUS_SECTION_PROTECTION: Section protection",
  0xC000004F => "STATUS_EAS_NOT_SUPPORTED: EAS not supported",
  0xC0000050 => "STATUS_EA_TOO_LARGE: EA too large",
  0xC0000056 => "STATUS_DELETE_PENDING: Delete pending",
@@ -420,6 +422,9 @@ impl NtStatus {
  /// STATUS_SECTION_TOO_BIG
  pub const SECTION_TOO_BIG: Self = Self::from_raw(0xC0000040);
 
+ /// STATUS_SECTION_NOT_IMAGE
+ pub const SECTION_NOT_IMAGE: Self = Self::from_raw(0xC0000049);
+
  /// STATUS_PORT_CONNECTION_REFUSED
  pub const PORT_CONNECTION_REFUSED: Self = Self::from_raw(0xC0000041);
 
@@ -435,6 +440,9 @@ impl NtStatus {
  /// STATUS_INVALID_PAGE_PROTECTION
  pub const INVALID_PAGE_PROTECTION: Self = Self::from_raw(0xC0000045);
 
+ /// STATUS_SECTION_PROTECTION
+ pub const SECTION_PROTECTION: Self = Self::from_raw(0xC000004E);
+
  /// STATUS_MUTANT_NOT_OWNED
  pub const MUTANT_NOT_OWNED: Self = Self::from_raw(0xC0000046);
 

litebox_shim_windows/src/lib.rs

@@ -38,6 +38,9 @@ use crate::syscalls::event::{EventHandleObject, EventObject, EventSubsystem};
 use crate::syscalls::file::{FileObject, FileObjectSubsystem};
 use crate::syscalls::iocp::{IoCompletionHandleObject, IoCompletionSubsystem};
 use crate::syscalls::registry::{RegistryKeyObject, RegistryKeySubsystem};
+use crate::syscalls::section::{
+ MapViewOfSectionParameters, SectionHandleObject, SectionObject, SectionSubsystem,
+};
 use crate::syscalls::symlink::{SymbolicLinkHandleObject, SymbolicLinkSubsystem};
 use crate::syscalls::timer::{TimerCreateParameters, TimerHandleObject, TimerSubsystem};
 use crate::syscalls::wait_completion_packet::{
@@ -90,6 +93,10 @@ pub(crate) type WindowsNlsSectionMappings<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<(u32, u32), (usize, usize)>>;
 pub(crate) type WindowsVirtualAllocations<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<usize, WindowsVirtualAllocation>>;
+pub(crate) type WindowsSectionNamespace<Platform> =
+ litebox::sync::RwLock<Platform, BTreeMap<String, Weak<SectionObject<Platform>>>>;
+pub(crate) type WindowsSectionViews<Platform> =
+ litebox::sync::RwLock<Platform, BTreeMap<usize, WindowsSectionView<Platform>>>;
 pub(crate) type WindowsEventNamespace<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<String, Weak<EventObject<Platform>>>>;
 pub(crate) type WindowsDirectoryNamespace<Platform> = DirectoryNamespace<Platform>;
@@ -103,6 +110,22 @@ pub(crate) struct WindowsVirtualAllocation {
  pub(crate) pages: rangemap::RangeMap<usize, syscalls::mm::PageProtection>,
 }
 
+pub(crate) struct WindowsSectionView<Platform: ShimPlatform> {
+ pub(crate) size: usize,
+ pub(crate) section_offset: usize,
+ pub(crate) section: Option<Arc<SectionObject<Platform>>>,
+}
+
+impl<Platform: ShimPlatform> Clone for WindowsSectionView<Platform> {
+ fn clone(&self) -> Self {
+ Self {
+ size: self.size,
+ section_offset: self.section_offset,
+ section: self.section.clone(),
+ }
+ }
+}
+
 pub type DefaultFS<Platform> = WindowsFS<Platform>;
 
 pub type WindowsFS<Platform> = litebox::fs::layered::FileSystem<
@@ -343,6 +366,8 @@ impl<Platform: ShimPlatform, FS: ShimFS> WindowsShim<Platform, FS> {
  handles: WindowsHandleStore::<Platform>::new(litebox::fd::RawDescriptorStorage::new()),
  directory_namespace,
  event_namespace: WindowsEventNamespace::<Platform>::new(BTreeMap::new()),
+ section_namespace: WindowsSectionNamespace::<Platform>::new(BTreeMap::new()),
+ section_views: WindowsSectionViews::<Platform>::new(BTreeMap::new()),
  nls_section_mappings: WindowsNlsSectionMappings::<Platform>::new(BTreeMap::new()),
  virtual_allocations: load_info.virtual_allocations,
  system_lcid: AtomicU32::new(syscalls::nls::DEFAULT_LOCALE_ID),
@@ -387,6 +412,8 @@ pub struct Process<Platform: ShimPlatform> {
  handles: WindowsHandleStore<Platform>,
  directory_namespace: WindowsDirectoryNamespace<Platform>,
  event_namespace: WindowsEventNamespace<Platform>,
+ section_namespace: WindowsSectionNamespace<Platform>,
+ section_views: WindowsSectionViews<Platform>,
  nls_section_mappings: WindowsNlsSectionMappings<Platform>,
  virtual_allocations: WindowsVirtualAllocations<Platform>,
  system_lcid: AtomicU32,
@@ -588,6 +615,15 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtOpenSection {
+ section_handle,
+ desired_access,
+ object_attributes,
+ } => {
+ let status =
+ self.sys_nt_open_section(section_handle, desired_access, object_attributes);
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtQueryDirectoryObject {
  directory_handle,
  buffer,
@@ -662,6 +698,50 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtCreateSection {
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ } => {
+ let status = self.sys_nt_create_section(
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ );
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtCreateSectionEx {
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ extended_parameters,
+ extended_parameter_count,
+ } => {
+ let status = self.sys_nt_create_section_ex(
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ extended_parameters,
+ extended_parameter_count,
+ );
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtCreateWaitCompletionPacket {
  wait_completion_packet_handle,
  desired_access,
@@ -1023,6 +1103,22 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtQuerySection {
+ section_handle,
+ section_information_class,
+ section_information,
+ section_information_length,
+ return_length,
+ } => {
+ let status = self.sys_nt_query_section(
+ section_handle,
+ section_information_class,
+ section_information,
+ section_information_length,
+ return_length,
+ );
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtQueryInformationProcess {
  process_handle,
  process_information_class,
@@ -1199,6 +1295,80 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtMapViewOfSection {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ } => {
+ let status = self.sys_nt_map_view_of_section(MapViewOfSectionParameters {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ });
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtMapViewOfSectionEx {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ extended_parameters,
+ extended_parameter_count,
+ } => {
+ let status = self.sys_nt_map_view_of_section_ex(
+ MapViewOfSectionParameters {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ },
+ extended_parameters,
+ extended_parameter_count,
+ );
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtUnmapViewOfSection {
+ process_handle,
+ base_address,
+ } => {
+ let status = self.sys_nt_unmap_view_of_section(process_handle, base_address);
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtUnmapViewOfSectionEx {
+ process_handle,
+ base_address,
+ flags,
+ } => {
+ let status =
+ self.sys_nt_unmap_view_of_section_ex(process_handle, base_address, flags);
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtTerminateProcess {
  process_handle,
  exit_status,
@@ -1306,6 +1476,14 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  ) {
  return NtStatus::SUCCESS;
  }
+ if remove_raw_handle_by_raw_fd::<Platform, SectionSubsystem<Platform>>(
+ &self.global.litebox,
+ &self.process.handles,
+ raw_fd,
+ |section| visitor.section(section),
+ ) {
+ return NtStatus::SUCCESS;
+ }
  NtStatus::INVALID_HANDLE
  }
 
@@ -1342,6 +1520,8 @@ trait RawHandleVisitor<Platform: ShimPlatform, FS: ShimFS> {
  );
 
  fn worker_factory(&self, worker_factory: WorkerFactoryHandleObject<Platform>);
+
+ fn section(&self, section: SectionHandleObject<Platform>);
 }
 
 struct CloseRawHandleVisitor<'task, Platform: ShimPlatform, FS: ShimFS> {
@@ -1389,6 +1569,10 @@ impl<Platform: ShimPlatform, FS: ShimFS> RawHandleVisitor<Platform, FS>
  fn worker_factory(&self, worker_factory: WorkerFactoryHandleObject<Platform>) {
  Task::<Platform, FS>::close_worker_factory(worker_factory);
  }
+
+ fn section(&self, section: SectionHandleObject<Platform>) {
+ Task::<Platform, FS>::close_section(section);
+ }
 }
 
 /// The shim entrypoint object passed to the platform.

litebox_shim_windows/src/loader/mod.rs

@@ -4,3 +4,4 @@
 mod pe;
 
 pub(super) use pe::{PeLoader, WindowsLoadError};
+pub(crate) use pe::{image_section_metadata, load_image_section};

litebox_shim_windows/src/loader/pe.rs

@@ -1224,6 +1224,58 @@ fn load_image<Platform: crate::ShimPlatform, FS: ShimFS>(
  load_image_with_writable_sections(fs, path, platform, page_manager, &[])
 }
 
+pub(crate) fn load_image_section<Platform: crate::ShimPlatform, FS: ShimFS>(
+ platform: &'static Platform,
+ fs: Arc<FS>,
+ path: &str,
+ page_manager: &crate::WindowsPageManager<Platform>,
+ virtual_allocations: &crate::WindowsVirtualAllocations<Platform>,
+) -> Result<MappingInfo, WindowsLoadError> {
+ let image = load_image(platform, fs, path, page_manager)?;
+ let mapping = image.mapping;
+ register_image_virtual_allocation(virtual_allocations, mapping, image.pages);
+ Ok(mapping)
+}
+
+pub(crate) struct ImageSectionMetadata {
+ pub(crate) transfer_address: usize,
+ pub(crate) file_size: u32,
+ pub(crate) subsystem: u32,
+ pub(crate) subsystem_major_version: u16,
+ pub(crate) subsystem_minor_version: u16,
+ pub(crate) image_characteristics: u16,
+ pub(crate) dll_characteristics: u16,
+ pub(crate) machine: u16,
+}
+
+pub(crate) fn image_section_metadata<FS: ShimFS>(
+ fs: Arc<FS>,
+ path: &str,
+) -> Result<ImageSectionMetadata, WindowsLoadError> {
+ let file = PeImageFile::open(fs, path)?;
+ let parsed = PeParsedFile::parse(&mut &file).map_err(WindowsLoadError::Parse)?;
+ let file_size = file
+ .fs
+ .fd_file_status(&file.fd)
+ .map_err(PeImageAccessError::FileStatus)?
+ .size
+ .try_into()
+ .map_err(|_| PeImageAccessError::AddressOverflow)?;
+ Ok(ImageSectionMetadata {
+ transfer_address: parsed
+ .image_base()
+ .checked_add(parsed.entry_point_rva())
+ .ok_or(PeImageAccessError::AddressOverflow)?,
+ file_size,
+ subsystem: u32::from(parsed.subsystem()),
+ subsystem_major_version: parsed.major_subsystem_version(),
+ subsystem_minor_version: parsed.minor_subsystem_version(),
+ image_characteristics: parsed.characteristics(),
+ dll_characteristics: parsed.dll_characteristics(),
+ machine: parsed.machine(),
+ })
+}
+
 fn load_image_with_writable_sections<Platform: crate::ShimPlatform, FS: ShimFS>(
  fs: Arc<FS>,
  path: &str,

litebox_common_windows/src/loader.rs

@@ -489,6 +489,21 @@ impl PeParsedFile {
  self.image.image_base
  }
 
+ #[must_use]
+ pub fn machine(&self) -> u16 {
+ self.image.machine
+ }
+
+ #[must_use]
+ pub fn characteristics(&self) -> u16 {
+ self.image.characteristics
+ }
+
+ #[must_use]
+ pub fn dll_characteristics(&self) -> u16 {
+ self.image.dll_characteristics
+ }
+
  /// Returns whether the image opts into dynamic-base loading.
  #[must_use]
  pub fn has_dynamic_base(&self) -> bool {

litebox_common_windows/src/nt_status.rs

@@ -159,6 +159,8 @@ impl NtStatus {
  0xC0000046 => "STATUS_MUTANT_NOT_OWNED: Mutant not owned",
  0xC0000047 => "STATUS_SEMAPHORE_LIMIT_EXCEEDED: Semaphore limit exceeded",
  0xC0000048 => "STATUS_PORT_ALREADY_SET: Port already set",
+ 0xC0000049 => "STATUS_SECTION_NOT_IMAGE: Section not image",
+ 0xC000004E => "STATUS_SECTION_PROTECTION: Section protection",
  0xC000004F => "STATUS_EAS_NOT_SUPPORTED: EAS not supported",
  0xC0000050 => "STATUS_EA_TOO_LARGE: EA too large",
  0xC0000056 => "STATUS_DELETE_PENDING: Delete pending",
@@ -420,6 +422,9 @@ impl NtStatus {
  /// STATUS_SECTION_TOO_BIG
  pub const SECTION_TOO_BIG: Self = Self::from_raw(0xC0000040);
 
+ /// STATUS_SECTION_NOT_IMAGE
+ pub const SECTION_NOT_IMAGE: Self = Self::from_raw(0xC0000049);
+
  /// STATUS_PORT_CONNECTION_REFUSED
  pub const PORT_CONNECTION_REFUSED: Self = Self::from_raw(0xC0000041);
 
@@ -435,6 +440,9 @@ impl NtStatus {
  /// STATUS_INVALID_PAGE_PROTECTION
  pub const INVALID_PAGE_PROTECTION: Self = Self::from_raw(0xC0000045);
 
+ /// STATUS_SECTION_PROTECTION
+ pub const SECTION_PROTECTION: Self = Self::from_raw(0xC000004E);
+
  /// STATUS_MUTANT_NOT_OWNED
  pub const MUTANT_NOT_OWNED: Self = Self::from_raw(0xC0000046);
 

litebox_shim_windows/src/lib.rs

@@ -38,6 +38,9 @@ use crate::syscalls::event::{EventHandleObject, EventObject, EventSubsystem};
 use crate::syscalls::file::{FileObject, FileObjectSubsystem};
 use crate::syscalls::iocp::{IoCompletionHandleObject, IoCompletionSubsystem};
 use crate::syscalls::registry::{RegistryKeyObject, RegistryKeySubsystem};
+use crate::syscalls::section::{
+ MapViewOfSectionParameters, SectionHandleObject, SectionObject, SectionSubsystem,
+};
 use crate::syscalls::symlink::{SymbolicLinkHandleObject, SymbolicLinkSubsystem};
 use crate::syscalls::timer::{TimerCreateParameters, TimerHandleObject, TimerSubsystem};
 use crate::syscalls::wait_completion_packet::{
@@ -90,6 +93,10 @@ pub(crate) type WindowsNlsSectionMappings<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<(u32, u32), (usize, usize)>>;
 pub(crate) type WindowsVirtualAllocations<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<usize, WindowsVirtualAllocation>>;
+pub(crate) type WindowsSectionNamespace<Platform> =
+ litebox::sync::RwLock<Platform, BTreeMap<String, Weak<SectionObject<Platform>>>>;
+pub(crate) type WindowsSectionViews<Platform> =
+ litebox::sync::RwLock<Platform, BTreeMap<usize, WindowsSectionView<Platform>>>;
 pub(crate) type WindowsEventNamespace<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<String, Weak<EventObject<Platform>>>>;
 pub(crate) type WindowsDirectoryNamespace<Platform> = DirectoryNamespace<Platform>;
@@ -103,6 +110,22 @@ pub(crate) struct WindowsVirtualAllocation {
  pub(crate) pages: rangemap::RangeMap<usize, syscalls::mm::PageProtection>,
 }
 
+pub(crate) struct WindowsSectionView<Platform: ShimPlatform> {
+ pub(crate) size: usize,
+ pub(crate) section_offset: usize,
+ pub(crate) section: Option<Arc<SectionObject<Platform>>>,
+}
+
+impl<Platform: ShimPlatform> Clone for WindowsSectionView<Platform> {
+ fn clone(&self) -> Self {
+ Self {
+ size: self.size,
+ section_offset: self.section_offset,
+ section: self.section.clone(),
+ }
+ }
+}
+
 pub type DefaultFS<Platform> = WindowsFS<Platform>;
 
 pub type WindowsFS<Platform> = litebox::fs::layered::FileSystem<
@@ -343,6 +366,8 @@ impl<Platform: ShimPlatform, FS: ShimFS> WindowsShim<Platform, FS> {
  handles: WindowsHandleStore::<Platform>::new(litebox::fd::RawDescriptorStorage::new()),
  directory_namespace,
  event_namespace: WindowsEventNamespace::<Platform>::new(BTreeMap::new()),
+ section_namespace: WindowsSectionNamespace::<Platform>::new(BTreeMap::new()),
+ section_views: WindowsSectionViews::<Platform>::new(BTreeMap::new()),
  nls_section_mappings: WindowsNlsSectionMappings::<Platform>::new(BTreeMap::new()),
  virtual_allocations: load_info.virtual_allocations,
  system_lcid: AtomicU32::new(syscalls::nls::DEFAULT_LOCALE_ID),
@@ -387,6 +412,8 @@ pub struct Process<Platform: ShimPlatform> {
  handles: WindowsHandleStore<Platform>,
  directory_namespace: WindowsDirectoryNamespace<Platform>,
  event_namespace: WindowsEventNamespace<Platform>,
+ section_namespace: WindowsSectionNamespace<Platform>,
+ section_views: WindowsSectionViews<Platform>,
  nls_section_mappings: WindowsNlsSectionMappings<Platform>,
  virtual_allocations: WindowsVirtualAllocations<Platform>,
  system_lcid: AtomicU32,
@@ -588,6 +615,15 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtOpenSection {
+ section_handle,
+ desired_access,
+ object_attributes,
+ } => {
+ let status =
+ self.sys_nt_open_section(section_handle, desired_access, object_attributes);
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtQueryDirectoryObject {
  directory_handle,
  buffer,
@@ -662,6 +698,50 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtCreateSection {
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ } => {
+ let status = self.sys_nt_create_section(
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ );
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtCreateSectionEx {
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ extended_parameters,
+ extended_parameter_count,
+ } => {
+ let status = self.sys_nt_create_section_ex(
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ extended_parameters,
+ extended_parameter_count,
+ );
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtCreateWaitCompletionPacket {
  wait_completion_packet_handle,
  desired_access,
@@ -1023,6 +1103,22 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtQuerySection {
+ section_handle,
+ section_information_class,
+ section_information,
+ section_information_length,
+ return_length,
+ } => {
+ let status = self.sys_nt_query_section(
+ section_handle,
+ section_information_class,
+ section_information,
+ section_information_length,
+ return_length,
+ );
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtQueryInformationProcess {
  process_handle,
  process_information_class,
@@ -1199,6 +1295,80 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtMapViewOfSection {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ } => {
+ let status = self.sys_nt_map_view_of_section(MapViewOfSectionParameters {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ });
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtMapViewOfSectionEx {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ extended_parameters,
+ extended_parameter_count,
+ } => {
+ let status = self.sys_nt_map_view_of_section_ex(
+ MapViewOfSectionParameters {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ },
+ extended_parameters,
+ extended_parameter_count,
+ );
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtUnmapViewOfSection {
+ process_handle,
+ base_address,
+ } => {
+ let status = self.sys_nt_unmap_view_of_section(process_handle, base_address);
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtUnmapViewOfSectionEx {
+ process_handle,
+ base_address,
+ flags,
+ } => {
+ let status =
+ self.sys_nt_unmap_view_of_section_ex(process_handle, base_address, flags);
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtTerminateProcess {
  process_handle,
  exit_status,
@@ -1306,6 +1476,14 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  ) {
  return NtStatus::SUCCESS;
  }
+ if remove_raw_handle_by_raw_fd::<Platform, SectionSubsystem<Platform>>(
+ &self.global.litebox,
+ &self.process.handles,
+ raw_fd,
+ |section| visitor.section(section),
+ ) {
+ return NtStatus::SUCCESS;
+ }
  NtStatus::INVALID_HANDLE
  }
 
@@ -1342,6 +1520,8 @@ trait RawHandleVisitor<Platform: ShimPlatform, FS: ShimFS> {
  );
 
  fn worker_factory(&self, worker_factory: WorkerFactoryHandleObject<Platform>);
+
+ fn section(&self, section: SectionHandleObject<Platform>);
 }
 
 struct CloseRawHandleVisitor<'task, Platform: ShimPlatform, FS: ShimFS> {
@@ -1389,6 +1569,10 @@ impl<Platform: ShimPlatform, FS: ShimFS> RawHandleVisitor<Platform, FS>
  fn worker_factory(&self, worker_factory: WorkerFactoryHandleObject<Platform>) {
  Task::<Platform, FS>::close_worker_factory(worker_factory);
  }
+
+ fn section(&self, section: SectionHandleObject<Platform>) {
+ Task::<Platform, FS>::close_section(section);
+ }
 }
 
 /// The shim entrypoint object passed to the platform.

litebox_shim_windows/src/loader/mod.rs

@@ -4,3 +4,4 @@
 mod pe;
 
 pub(super) use pe::{PeLoader, WindowsLoadError};
+pub(crate) use pe::{image_section_metadata, load_image_section};

litebox_shim_windows/src/loader/pe.rs

@@ -1224,6 +1224,58 @@ fn load_image<Platform: crate::ShimPlatform, FS: ShimFS>(
  load_image_with_writable_sections(fs, path, platform, page_manager, &[])
 }
 
+pub(crate) fn load_image_section<Platform: crate::ShimPlatform, FS: ShimFS>(
+ platform: &'static Platform,
+ fs: Arc<FS>,
+ path: &str,
+ page_manager: &crate::WindowsPageManager<Platform>,
+ virtual_allocations: &crate::WindowsVirtualAllocations<Platform>,
+) -> Result<MappingInfo, WindowsLoadError> {
+ let image = load_image(platform, fs, path, page_manager)?;
+ let mapping = image.mapping;
+ register_image_virtual_allocation(virtual_allocations, mapping, image.pages);
+ Ok(mapping)
+}
+
+pub(crate) struct ImageSectionMetadata {
+ pub(crate) transfer_address: usize,
+ pub(crate) file_size: u32,
+ pub(crate) subsystem: u32,
+ pub(crate) subsystem_major_version: u16,
+ pub(crate) subsystem_minor_version: u16,
+ pub(crate) image_characteristics: u16,
+ pub(crate) dll_characteristics: u16,
+ pub(crate) machine: u16,
+}
+
+pub(crate) fn image_section_metadata<FS: ShimFS>(
+ fs: Arc<FS>,
+ path: &str,
+) -> Result<ImageSectionMetadata, WindowsLoadError> {
+ let file = PeImageFile::open(fs, path)?;
+ let parsed = PeParsedFile::parse(&mut &file).map_err(WindowsLoadError::Parse)?;
+ let file_size = file
+ .fs
+ .fd_file_status(&file.fd)
+ .map_err(PeImageAccessError::FileStatus)?
+ .size
+ .try_into()
+ .map_err(|_| PeImageAccessError::AddressOverflow)?;
+ Ok(ImageSectionMetadata {
+ transfer_address: parsed
+ .image_base()
+ .checked_add(parsed.entry_point_rva())
+ .ok_or(PeImageAccessError::AddressOverflow)?,
+ file_size,
+ subsystem: u32::from(parsed.subsystem()),
+ subsystem_major_version: parsed.major_subsystem_version(),
+ subsystem_minor_version: parsed.minor_subsystem_version(),
+ image_characteristics: parsed.characteristics(),
+ dll_characteristics: parsed.dll_characteristics(),
+ machine: parsed.machine(),
+ })
+}
+
 fn load_image_with_writable_sections<Platform: crate::ShimPlatform, FS: ShimFS>(
  fs: Arc<FS>,
  path: &str,

litebox_common_windows/src/loader.rs

@@ -489,6 +489,21 @@ impl PeParsedFile {
  self.image.image_base
  }
 
+ #[must_use]
+ pub fn machine(&self) -> u16 {
+ self.image.machine
+ }
+
+ #[must_use]
+ pub fn characteristics(&self) -> u16 {
+ self.image.characteristics
+ }
+
+ #[must_use]
+ pub fn dll_characteristics(&self) -> u16 {
+ self.image.dll_characteristics
+ }
+
  /// Returns whether the image opts into dynamic-base loading.
  #[must_use]
  pub fn has_dynamic_base(&self) -> bool {

litebox_common_windows/src/nt_status.rs

@@ -159,6 +159,8 @@ impl NtStatus {
  0xC0000046 => "STATUS_MUTANT_NOT_OWNED: Mutant not owned",
  0xC0000047 => "STATUS_SEMAPHORE_LIMIT_EXCEEDED: Semaphore limit exceeded",
  0xC0000048 => "STATUS_PORT_ALREADY_SET: Port already set",
+ 0xC0000049 => "STATUS_SECTION_NOT_IMAGE: Section not image",
+ 0xC000004E => "STATUS_SECTION_PROTECTION: Section protection",
  0xC000004F => "STATUS_EAS_NOT_SUPPORTED: EAS not supported",
  0xC0000050 => "STATUS_EA_TOO_LARGE: EA too large",
  0xC0000056 => "STATUS_DELETE_PENDING: Delete pending",
@@ -420,6 +422,9 @@ impl NtStatus {
  /// STATUS_SECTION_TOO_BIG
  pub const SECTION_TOO_BIG: Self = Self::from_raw(0xC0000040);
 
+ /// STATUS_SECTION_NOT_IMAGE
+ pub const SECTION_NOT_IMAGE: Self = Self::from_raw(0xC0000049);
+
  /// STATUS_PORT_CONNECTION_REFUSED
  pub const PORT_CONNECTION_REFUSED: Self = Self::from_raw(0xC0000041);
 
@@ -435,6 +440,9 @@ impl NtStatus {
  /// STATUS_INVALID_PAGE_PROTECTION
  pub const INVALID_PAGE_PROTECTION: Self = Self::from_raw(0xC0000045);
 
+ /// STATUS_SECTION_PROTECTION
+ pub const SECTION_PROTECTION: Self = Self::from_raw(0xC000004E);
+
  /// STATUS_MUTANT_NOT_OWNED
  pub const MUTANT_NOT_OWNED: Self = Self::from_raw(0xC0000046);
 

litebox_shim_windows/src/lib.rs

@@ -38,6 +38,9 @@ use crate::syscalls::event::{EventHandleObject, EventObject, EventSubsystem};
 use crate::syscalls::file::{FileObject, FileObjectSubsystem};
 use crate::syscalls::iocp::{IoCompletionHandleObject, IoCompletionSubsystem};
 use crate::syscalls::registry::{RegistryKeyObject, RegistryKeySubsystem};
+use crate::syscalls::section::{
+ MapViewOfSectionParameters, SectionHandleObject, SectionObject, SectionSubsystem,
+};
 use crate::syscalls::symlink::{SymbolicLinkHandleObject, SymbolicLinkSubsystem};
 use crate::syscalls::timer::{TimerCreateParameters, TimerHandleObject, TimerSubsystem};
 use crate::syscalls::wait_completion_packet::{
@@ -90,6 +93,10 @@ pub(crate) type WindowsNlsSectionMappings<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<(u32, u32), (usize, usize)>>;
 pub(crate) type WindowsVirtualAllocations<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<usize, WindowsVirtualAllocation>>;
+pub(crate) type WindowsSectionNamespace<Platform> =
+ litebox::sync::RwLock<Platform, BTreeMap<String, Weak<SectionObject<Platform>>>>;
+pub(crate) type WindowsSectionViews<Platform> =
+ litebox::sync::RwLock<Platform, BTreeMap<usize, WindowsSectionView<Platform>>>;
 pub(crate) type WindowsEventNamespace<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<String, Weak<EventObject<Platform>>>>;
 pub(crate) type WindowsDirectoryNamespace<Platform> = DirectoryNamespace<Platform>;
@@ -103,6 +110,22 @@ pub(crate) struct WindowsVirtualAllocation {
  pub(crate) pages: rangemap::RangeMap<usize, syscalls::mm::PageProtection>,
 }
 
+pub(crate) struct WindowsSectionView<Platform: ShimPlatform> {
+ pub(crate) size: usize,
+ pub(crate) section_offset: usize,
+ pub(crate) section: Option<Arc<SectionObject<Platform>>>,
+}
+
+impl<Platform: ShimPlatform> Clone for WindowsSectionView<Platform> {
+ fn clone(&self) -> Self {
+ Self {
+ size: self.size,
+ section_offset: self.section_offset,
+ section: self.section.clone(),
+ }
+ }
+}
+
 pub type DefaultFS<Platform> = WindowsFS<Platform>;
 
 pub type WindowsFS<Platform> = litebox::fs::layered::FileSystem<
@@ -343,6 +366,8 @@ impl<Platform: ShimPlatform, FS: ShimFS> WindowsShim<Platform, FS> {
  handles: WindowsHandleStore::<Platform>::new(litebox::fd::RawDescriptorStorage::new()),
  directory_namespace,
  event_namespace: WindowsEventNamespace::<Platform>::new(BTreeMap::new()),
+ section_namespace: WindowsSectionNamespace::<Platform>::new(BTreeMap::new()),
+ section_views: WindowsSectionViews::<Platform>::new(BTreeMap::new()),
  nls_section_mappings: WindowsNlsSectionMappings::<Platform>::new(BTreeMap::new()),
  virtual_allocations: load_info.virtual_allocations,
  system_lcid: AtomicU32::new(syscalls::nls::DEFAULT_LOCALE_ID),
@@ -387,6 +412,8 @@ pub struct Process<Platform: ShimPlatform> {
  handles: WindowsHandleStore<Platform>,
  directory_namespace: WindowsDirectoryNamespace<Platform>,
  event_namespace: WindowsEventNamespace<Platform>,
+ section_namespace: WindowsSectionNamespace<Platform>,
+ section_views: WindowsSectionViews<Platform>,
  nls_section_mappings: WindowsNlsSectionMappings<Platform>,
  virtual_allocations: WindowsVirtualAllocations<Platform>,
  system_lcid: AtomicU32,
@@ -588,6 +615,15 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtOpenSection {
+ section_handle,
+ desired_access,
+ object_attributes,
+ } => {
+ let status =
+ self.sys_nt_open_section(section_handle, desired_access, object_attributes);
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtQueryDirectoryObject {
  directory_handle,
  buffer,
@@ -662,6 +698,50 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtCreateSection {
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ } => {
+ let status = self.sys_nt_create_section(
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ );
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtCreateSectionEx {
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ extended_parameters,
+ extended_parameter_count,
+ } => {
+ let status = self.sys_nt_create_section_ex(
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ extended_parameters,
+ extended_parameter_count,
+ );
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtCreateWaitCompletionPacket {
  wait_completion_packet_handle,
  desired_access,
@@ -1023,6 +1103,22 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtQuerySection {
+ section_handle,
+ section_information_class,
+ section_information,
+ section_information_length,
+ return_length,
+ } => {
+ let status = self.sys_nt_query_section(
+ section_handle,
+ section_information_class,
+ section_information,
+ section_information_length,
+ return_length,
+ );
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtQueryInformationProcess {
  process_handle,
  process_information_class,
@@ -1199,6 +1295,80 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtMapViewOfSection {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ } => {
+ let status = self.sys_nt_map_view_of_section(MapViewOfSectionParameters {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ });
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtMapViewOfSectionEx {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ extended_parameters,
+ extended_parameter_count,
+ } => {
+ let status = self.sys_nt_map_view_of_section_ex(
+ MapViewOfSectionParameters {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ },
+ extended_parameters,
+ extended_parameter_count,
+ );
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtUnmapViewOfSection {
+ process_handle,
+ base_address,
+ } => {
+ let status = self.sys_nt_unmap_view_of_section(process_handle, base_address);
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtUnmapViewOfSectionEx {
+ process_handle,
+ base_address,
+ flags,
+ } => {
+ let status =
+ self.sys_nt_unmap_view_of_section_ex(process_handle, base_address, flags);
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtTerminateProcess {
  process_handle,
  exit_status,
@@ -1306,6 +1476,14 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  ) {
  return NtStatus::SUCCESS;
  }
+ if remove_raw_handle_by_raw_fd::<Platform, SectionSubsystem<Platform>>(
+ &self.global.litebox,
+ &self.process.handles,
+ raw_fd,
+ |section| visitor.section(section),
+ ) {
+ return NtStatus::SUCCESS;
+ }
  NtStatus::INVALID_HANDLE
  }
 
@@ -1342,6 +1520,8 @@ trait RawHandleVisitor<Platform: ShimPlatform, FS: ShimFS> {
  );
 
  fn worker_factory(&self, worker_factory: WorkerFactoryHandleObject<Platform>);
+
+ fn section(&self, section: SectionHandleObject<Platform>);
 }
 
 struct CloseRawHandleVisitor<'task, Platform: ShimPlatform, FS: ShimFS> {
@@ -1389,6 +1569,10 @@ impl<Platform: ShimPlatform, FS: ShimFS> RawHandleVisitor<Platform, FS>
  fn worker_factory(&self, worker_factory: WorkerFactoryHandleObject<Platform>) {
  Task::<Platform, FS>::close_worker_factory(worker_factory);
  }
+
+ fn section(&self, section: SectionHandleObject<Platform>) {
+ Task::<Platform, FS>::close_section(section);
+ }
 }
 
 /// The shim entrypoint object passed to the platform.

litebox_shim_windows/src/loader/mod.rs

@@ -4,3 +4,4 @@
 mod pe;
 
 pub(super) use pe::{PeLoader, WindowsLoadError};
+pub(crate) use pe::{image_section_metadata, load_image_section};

litebox_shim_windows/src/loader/pe.rs

@@ -1224,6 +1224,58 @@ fn load_image<Platform: crate::ShimPlatform, FS: ShimFS>(
  load_image_with_writable_sections(fs, path, platform, page_manager, &[])
 }
 
+pub(crate) fn load_image_section<Platform: crate::ShimPlatform, FS: ShimFS>(
+ platform: &'static Platform,
+ fs: Arc<FS>,
+ path: &str,
+ page_manager: &crate::WindowsPageManager<Platform>,
+ virtual_allocations: &crate::WindowsVirtualAllocations<Platform>,
+) -> Result<MappingInfo, WindowsLoadError> {
+ let image = load_image(platform, fs, path, page_manager)?;
+ let mapping = image.mapping;
+ register_image_virtual_allocation(virtual_allocations, mapping, image.pages);
+ Ok(mapping)
+}
+
+pub(crate) struct ImageSectionMetadata {
+ pub(crate) transfer_address: usize,
+ pub(crate) file_size: u32,
+ pub(crate) subsystem: u32,
+ pub(crate) subsystem_major_version: u16,
+ pub(crate) subsystem_minor_version: u16,
+ pub(crate) image_characteristics: u16,
+ pub(crate) dll_characteristics: u16,
+ pub(crate) machine: u16,
+}
+
+pub(crate) fn image_section_metadata<FS: ShimFS>(
+ fs: Arc<FS>,
+ path: &str,
+) -> Result<ImageSectionMetadata, WindowsLoadError> {
+ let file = PeImageFile::open(fs, path)?;
+ let parsed = PeParsedFile::parse(&mut &file).map_err(WindowsLoadError::Parse)?;
+ let file_size = file
+ .fs
+ .fd_file_status(&file.fd)
+ .map_err(PeImageAccessError::FileStatus)?
+ .size
+ .try_into()
+ .map_err(|_| PeImageAccessError::AddressOverflow)?;
+ Ok(ImageSectionMetadata {
+ transfer_address: parsed
+ .image_base()
+ .checked_add(parsed.entry_point_rva())
+ .ok_or(PeImageAccessError::AddressOverflow)?,
+ file_size,
+ subsystem: u32::from(parsed.subsystem()),
+ subsystem_major_version: parsed.major_subsystem_version(),
+ subsystem_minor_version: parsed.minor_subsystem_version(),
+ image_characteristics: parsed.characteristics(),
+ dll_characteristics: parsed.dll_characteristics(),
+ machine: parsed.machine(),
+ })
+}
+
 fn load_image_with_writable_sections<Platform: crate::ShimPlatform, FS: ShimFS>(
  fs: Arc<FS>,
  path: &str,

litebox_common_windows/src/loader.rs

@@ -489,6 +489,21 @@ impl PeParsedFile {
  self.image.image_base
  }
 
+ #[must_use]
+ pub fn machine(&self) -> u16 {
+ self.image.machine
+ }
+
+ #[must_use]
+ pub fn characteristics(&self) -> u16 {
+ self.image.characteristics
+ }
+
+ #[must_use]
+ pub fn dll_characteristics(&self) -> u16 {
+ self.image.dll_characteristics
+ }
+
  /// Returns whether the image opts into dynamic-base loading.
  #[must_use]
  pub fn has_dynamic_base(&self) -> bool {

litebox_common_windows/src/nt_status.rs

@@ -159,6 +159,8 @@ impl NtStatus {
  0xC0000046 => "STATUS_MUTANT_NOT_OWNED: Mutant not owned",
  0xC0000047 => "STATUS_SEMAPHORE_LIMIT_EXCEEDED: Semaphore limit exceeded",
  0xC0000048 => "STATUS_PORT_ALREADY_SET: Port already set",
+ 0xC0000049 => "STATUS_SECTION_NOT_IMAGE: Section not image",
+ 0xC000004E => "STATUS_SECTION_PROTECTION: Section protection",
  0xC000004F => "STATUS_EAS_NOT_SUPPORTED: EAS not supported",
  0xC0000050 => "STATUS_EA_TOO_LARGE: EA too large",
  0xC0000056 => "STATUS_DELETE_PENDING: Delete pending",
@@ -420,6 +422,9 @@ impl NtStatus {
  /// STATUS_SECTION_TOO_BIG
  pub const SECTION_TOO_BIG: Self = Self::from_raw(0xC0000040);
 
+ /// STATUS_SECTION_NOT_IMAGE
+ pub const SECTION_NOT_IMAGE: Self = Self::from_raw(0xC0000049);
+
  /// STATUS_PORT_CONNECTION_REFUSED
  pub const PORT_CONNECTION_REFUSED: Self = Self::from_raw(0xC0000041);
 
@@ -435,6 +440,9 @@ impl NtStatus {
  /// STATUS_INVALID_PAGE_PROTECTION
  pub const INVALID_PAGE_PROTECTION: Self = Self::from_raw(0xC0000045);
 
+ /// STATUS_SECTION_PROTECTION
+ pub const SECTION_PROTECTION: Self = Self::from_raw(0xC000004E);
+
  /// STATUS_MUTANT_NOT_OWNED
  pub const MUTANT_NOT_OWNED: Self = Self::from_raw(0xC0000046);
 

litebox_shim_windows/src/lib.rs

@@ -38,6 +38,9 @@ use crate::syscalls::event::{EventHandleObject, EventObject, EventSubsystem};
 use crate::syscalls::file::{FileObject, FileObjectSubsystem};
 use crate::syscalls::iocp::{IoCompletionHandleObject, IoCompletionSubsystem};
 use crate::syscalls::registry::{RegistryKeyObject, RegistryKeySubsystem};
+use crate::syscalls::section::{
+ MapViewOfSectionParameters, SectionHandleObject, SectionObject, SectionSubsystem,
+};
 use crate::syscalls::symlink::{SymbolicLinkHandleObject, SymbolicLinkSubsystem};
 use crate::syscalls::timer::{TimerCreateParameters, TimerHandleObject, TimerSubsystem};
 use crate::syscalls::wait_completion_packet::{
@@ -90,6 +93,10 @@ pub(crate) type WindowsNlsSectionMappings<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<(u32, u32), (usize, usize)>>;
 pub(crate) type WindowsVirtualAllocations<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<usize, WindowsVirtualAllocation>>;
+pub(crate) type WindowsSectionNamespace<Platform> =
+ litebox::sync::RwLock<Platform, BTreeMap<String, Weak<SectionObject<Platform>>>>;
+pub(crate) type WindowsSectionViews<Platform> =
+ litebox::sync::RwLock<Platform, BTreeMap<usize, WindowsSectionView<Platform>>>;
 pub(crate) type WindowsEventNamespace<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<String, Weak<EventObject<Platform>>>>;
 pub(crate) type WindowsDirectoryNamespace<Platform> = DirectoryNamespace<Platform>;
@@ -103,6 +110,22 @@ pub(crate) struct WindowsVirtualAllocation {
  pub(crate) pages: rangemap::RangeMap<usize, syscalls::mm::PageProtection>,
 }
 
+pub(crate) struct WindowsSectionView<Platform: ShimPlatform> {
+ pub(crate) size: usize,
+ pub(crate) section_offset: usize,
+ pub(crate) section: Option<Arc<SectionObject<Platform>>>,
+}
+
+impl<Platform: ShimPlatform> Clone for WindowsSectionView<Platform> {
+ fn clone(&self) -> Self {
+ Self {
+ size: self.size,
+ section_offset: self.section_offset,
+ section: self.section.clone(),
+ }
+ }
+}
+
 pub type DefaultFS<Platform> = WindowsFS<Platform>;
 
 pub type WindowsFS<Platform> = litebox::fs::layered::FileSystem<
@@ -343,6 +366,8 @@ impl<Platform: ShimPlatform, FS: ShimFS> WindowsShim<Platform, FS> {
  handles: WindowsHandleStore::<Platform>::new(litebox::fd::RawDescriptorStorage::new()),
  directory_namespace,
  event_namespace: WindowsEventNamespace::<Platform>::new(BTreeMap::new()),
+ section_namespace: WindowsSectionNamespace::<Platform>::new(BTreeMap::new()),
+ section_views: WindowsSectionViews::<Platform>::new(BTreeMap::new()),
  nls_section_mappings: WindowsNlsSectionMappings::<Platform>::new(BTreeMap::new()),
  virtual_allocations: load_info.virtual_allocations,
  system_lcid: AtomicU32::new(syscalls::nls::DEFAULT_LOCALE_ID),
@@ -387,6 +412,8 @@ pub struct Process<Platform: ShimPlatform> {
  handles: WindowsHandleStore<Platform>,
  directory_namespace: WindowsDirectoryNamespace<Platform>,
  event_namespace: WindowsEventNamespace<Platform>,
+ section_namespace: WindowsSectionNamespace<Platform>,
+ section_views: WindowsSectionViews<Platform>,
  nls_section_mappings: WindowsNlsSectionMappings<Platform>,
  virtual_allocations: WindowsVirtualAllocations<Platform>,
  system_lcid: AtomicU32,
@@ -588,6 +615,15 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtOpenSection {
+ section_handle,
+ desired_access,
+ object_attributes,
+ } => {
+ let status =
+ self.sys_nt_open_section(section_handle, desired_access, object_attributes);
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtQueryDirectoryObject {
  directory_handle,
  buffer,
@@ -662,6 +698,50 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtCreateSection {
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ } => {
+ let status = self.sys_nt_create_section(
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ );
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtCreateSectionEx {
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ extended_parameters,
+ extended_parameter_count,
+ } => {
+ let status = self.sys_nt_create_section_ex(
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ extended_parameters,
+ extended_parameter_count,
+ );
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtCreateWaitCompletionPacket {
  wait_completion_packet_handle,
  desired_access,
@@ -1023,6 +1103,22 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtQuerySection {
+ section_handle,
+ section_information_class,
+ section_information,
+ section_information_length,
+ return_length,
+ } => {
+ let status = self.sys_nt_query_section(
+ section_handle,
+ section_information_class,
+ section_information,
+ section_information_length,
+ return_length,
+ );
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtQueryInformationProcess {
  process_handle,
  process_information_class,
@@ -1199,6 +1295,80 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtMapViewOfSection {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ } => {
+ let status = self.sys_nt_map_view_of_section(MapViewOfSectionParameters {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ });
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtMapViewOfSectionEx {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ extended_parameters,
+ extended_parameter_count,
+ } => {
+ let status = self.sys_nt_map_view_of_section_ex(
+ MapViewOfSectionParameters {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ },
+ extended_parameters,
+ extended_parameter_count,
+ );
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtUnmapViewOfSection {
+ process_handle,
+ base_address,
+ } => {
+ let status = self.sys_nt_unmap_view_of_section(process_handle, base_address);
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtUnmapViewOfSectionEx {
+ process_handle,
+ base_address,
+ flags,
+ } => {
+ let status =
+ self.sys_nt_unmap_view_of_section_ex(process_handle, base_address, flags);
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtTerminateProcess {
  process_handle,
  exit_status,
@@ -1306,6 +1476,14 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  ) {
  return NtStatus::SUCCESS;
  }
+ if remove_raw_handle_by_raw_fd::<Platform, SectionSubsystem<Platform>>(
+ &self.global.litebox,
+ &self.process.handles,
+ raw_fd,
+ |section| visitor.section(section),
+ ) {
+ return NtStatus::SUCCESS;
+ }
  NtStatus::INVALID_HANDLE
  }
 
@@ -1342,6 +1520,8 @@ trait RawHandleVisitor<Platform: ShimPlatform, FS: ShimFS> {
  );
 
  fn worker_factory(&self, worker_factory: WorkerFactoryHandleObject<Platform>);
+
+ fn section(&self, section: SectionHandleObject<Platform>);
 }
 
 struct CloseRawHandleVisitor<'task, Platform: ShimPlatform, FS: ShimFS> {
@@ -1389,6 +1569,10 @@ impl<Platform: ShimPlatform, FS: ShimFS> RawHandleVisitor<Platform, FS>
  fn worker_factory(&self, worker_factory: WorkerFactoryHandleObject<Platform>) {
  Task::<Platform, FS>::close_worker_factory(worker_factory);
  }
+
+ fn section(&self, section: SectionHandleObject<Platform>) {
+ Task::<Platform, FS>::close_section(section);
+ }
 }
 
 /// The shim entrypoint object passed to the platform.

litebox_shim_windows/src/loader/mod.rs

@@ -4,3 +4,4 @@
 mod pe;
 
 pub(super) use pe::{PeLoader, WindowsLoadError};
+pub(crate) use pe::{image_section_metadata, load_image_section};

litebox_shim_windows/src/loader/pe.rs

@@ -1224,6 +1224,58 @@ fn load_image<Platform: crate::ShimPlatform, FS: ShimFS>(
  load_image_with_writable_sections(fs, path, platform, page_manager, &[])
 }
 
+pub(crate) fn load_image_section<Platform: crate::ShimPlatform, FS: ShimFS>(
+ platform: &'static Platform,
+ fs: Arc<FS>,
+ path: &str,
+ page_manager: &crate::WindowsPageManager<Platform>,
+ virtual_allocations: &crate::WindowsVirtualAllocations<Platform>,
+) -> Result<MappingInfo, WindowsLoadError> {
+ let image = load_image(platform, fs, path, page_manager)?;
+ let mapping = image.mapping;
+ register_image_virtual_allocation(virtual_allocations, mapping, image.pages);
+ Ok(mapping)
+}
+
+pub(crate) struct ImageSectionMetadata {
+ pub(crate) transfer_address: usize,
+ pub(crate) file_size: u32,
+ pub(crate) subsystem: u32,
+ pub(crate) subsystem_major_version: u16,
+ pub(crate) subsystem_minor_version: u16,
+ pub(crate) image_characteristics: u16,
+ pub(crate) dll_characteristics: u16,
+ pub(crate) machine: u16,
+}
+
+pub(crate) fn image_section_metadata<FS: ShimFS>(
+ fs: Arc<FS>,
+ path: &str,
+) -> Result<ImageSectionMetadata, WindowsLoadError> {
+ let file = PeImageFile::open(fs, path)?;
+ let parsed = PeParsedFile::parse(&mut &file).map_err(WindowsLoadError::Parse)?;
+ let file_size = file
+ .fs
+ .fd_file_status(&file.fd)
+ .map_err(PeImageAccessError::FileStatus)?
+ .size
+ .try_into()
+ .map_err(|_| PeImageAccessError::AddressOverflow)?;
+ Ok(ImageSectionMetadata {
+ transfer_address: parsed
+ .image_base()
+ .checked_add(parsed.entry_point_rva())
+ .ok_or(PeImageAccessError::AddressOverflow)?,
+ file_size,
+ subsystem: u32::from(parsed.subsystem()),
+ subsystem_major_version: parsed.major_subsystem_version(),
+ subsystem_minor_version: parsed.minor_subsystem_version(),
+ image_characteristics: parsed.characteristics(),
+ dll_characteristics: parsed.dll_characteristics(),
+ machine: parsed.machine(),
+ })
+}
+
 fn load_image_with_writable_sections<Platform: crate::ShimPlatform, FS: ShimFS>(
  fs: Arc<FS>,
  path: &str,

litebox_common_windows/src/loader.rs

@@ -489,6 +489,21 @@ impl PeParsedFile {
  self.image.image_base
  }
 
+ #[must_use]
+ pub fn machine(&self) -> u16 {
+ self.image.machine
+ }
+
+ #[must_use]
+ pub fn characteristics(&self) -> u16 {
+ self.image.characteristics
+ }
+
+ #[must_use]
+ pub fn dll_characteristics(&self) -> u16 {
+ self.image.dll_characteristics
+ }
+
  /// Returns whether the image opts into dynamic-base loading.
  #[must_use]
  pub fn has_dynamic_base(&self) -> bool {

litebox_common_windows/src/nt_status.rs

@@ -159,6 +159,8 @@ impl NtStatus {
  0xC0000046 => "STATUS_MUTANT_NOT_OWNED: Mutant not owned",
  0xC0000047 => "STATUS_SEMAPHORE_LIMIT_EXCEEDED: Semaphore limit exceeded",
  0xC0000048 => "STATUS_PORT_ALREADY_SET: Port already set",
+ 0xC0000049 => "STATUS_SECTION_NOT_IMAGE: Section not image",
+ 0xC000004E => "STATUS_SECTION_PROTECTION: Section protection",
  0xC000004F => "STATUS_EAS_NOT_SUPPORTED: EAS not supported",
  0xC0000050 => "STATUS_EA_TOO_LARGE: EA too large",
  0xC0000056 => "STATUS_DELETE_PENDING: Delete pending",
@@ -420,6 +422,9 @@ impl NtStatus {
  /// STATUS_SECTION_TOO_BIG
  pub const SECTION_TOO_BIG: Self = Self::from_raw(0xC0000040);
 
+ /// STATUS_SECTION_NOT_IMAGE
+ pub const SECTION_NOT_IMAGE: Self = Self::from_raw(0xC0000049);
+
  /// STATUS_PORT_CONNECTION_REFUSED
  pub const PORT_CONNECTION_REFUSED: Self = Self::from_raw(0xC0000041);
 
@@ -435,6 +440,9 @@ impl NtStatus {
  /// STATUS_INVALID_PAGE_PROTECTION
  pub const INVALID_PAGE_PROTECTION: Self = Self::from_raw(0xC0000045);
 
+ /// STATUS_SECTION_PROTECTION
+ pub const SECTION_PROTECTION: Self = Self::from_raw(0xC000004E);
+
  /// STATUS_MUTANT_NOT_OWNED
  pub const MUTANT_NOT_OWNED: Self = Self::from_raw(0xC0000046);
 

litebox_shim_windows/src/lib.rs

@@ -38,6 +38,9 @@ use crate::syscalls::event::{EventHandleObject, EventObject, EventSubsystem};
 use crate::syscalls::file::{FileObject, FileObjectSubsystem};
 use crate::syscalls::iocp::{IoCompletionHandleObject, IoCompletionSubsystem};
 use crate::syscalls::registry::{RegistryKeyObject, RegistryKeySubsystem};
+use crate::syscalls::section::{
+ MapViewOfSectionParameters, SectionHandleObject, SectionObject, SectionSubsystem,
+};
 use crate::syscalls::symlink::{SymbolicLinkHandleObject, SymbolicLinkSubsystem};
 use crate::syscalls::timer::{TimerCreateParameters, TimerHandleObject, TimerSubsystem};
 use crate::syscalls::wait_completion_packet::{
@@ -90,6 +93,10 @@ pub(crate) type WindowsNlsSectionMappings<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<(u32, u32), (usize, usize)>>;
 pub(crate) type WindowsVirtualAllocations<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<usize, WindowsVirtualAllocation>>;
+pub(crate) type WindowsSectionNamespace<Platform> =
+ litebox::sync::RwLock<Platform, BTreeMap<String, Weak<SectionObject<Platform>>>>;
+pub(crate) type WindowsSectionViews<Platform> =
+ litebox::sync::RwLock<Platform, BTreeMap<usize, WindowsSectionView<Platform>>>;
 pub(crate) type WindowsEventNamespace<Platform> =
  litebox::sync::RwLock<Platform, BTreeMap<String, Weak<EventObject<Platform>>>>;
 pub(crate) type WindowsDirectoryNamespace<Platform> = DirectoryNamespace<Platform>;
@@ -103,6 +110,22 @@ pub(crate) struct WindowsVirtualAllocation {
  pub(crate) pages: rangemap::RangeMap<usize, syscalls::mm::PageProtection>,
 }
 
+pub(crate) struct WindowsSectionView<Platform: ShimPlatform> {
+ pub(crate) size: usize,
+ pub(crate) section_offset: usize,
+ pub(crate) section: Option<Arc<SectionObject<Platform>>>,
+}
+
+impl<Platform: ShimPlatform> Clone for WindowsSectionView<Platform> {
+ fn clone(&self) -> Self {
+ Self {
+ size: self.size,
+ section_offset: self.section_offset,
+ section: self.section.clone(),
+ }
+ }
+}
+
 pub type DefaultFS<Platform> = WindowsFS<Platform>;
 
 pub type WindowsFS<Platform> = litebox::fs::layered::FileSystem<
@@ -343,6 +366,8 @@ impl<Platform: ShimPlatform, FS: ShimFS> WindowsShim<Platform, FS> {
  handles: WindowsHandleStore::<Platform>::new(litebox::fd::RawDescriptorStorage::new()),
  directory_namespace,
  event_namespace: WindowsEventNamespace::<Platform>::new(BTreeMap::new()),
+ section_namespace: WindowsSectionNamespace::<Platform>::new(BTreeMap::new()),
+ section_views: WindowsSectionViews::<Platform>::new(BTreeMap::new()),
  nls_section_mappings: WindowsNlsSectionMappings::<Platform>::new(BTreeMap::new()),
  virtual_allocations: load_info.virtual_allocations,
  system_lcid: AtomicU32::new(syscalls::nls::DEFAULT_LOCALE_ID),
@@ -387,6 +412,8 @@ pub struct Process<Platform: ShimPlatform> {
  handles: WindowsHandleStore<Platform>,
  directory_namespace: WindowsDirectoryNamespace<Platform>,
  event_namespace: WindowsEventNamespace<Platform>,
+ section_namespace: WindowsSectionNamespace<Platform>,
+ section_views: WindowsSectionViews<Platform>,
  nls_section_mappings: WindowsNlsSectionMappings<Platform>,
  virtual_allocations: WindowsVirtualAllocations<Platform>,
  system_lcid: AtomicU32,
@@ -588,6 +615,15 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtOpenSection {
+ section_handle,
+ desired_access,
+ object_attributes,
+ } => {
+ let status =
+ self.sys_nt_open_section(section_handle, desired_access, object_attributes);
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtQueryDirectoryObject {
  directory_handle,
  buffer,
@@ -662,6 +698,50 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtCreateSection {
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ } => {
+ let status = self.sys_nt_create_section(
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ );
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtCreateSectionEx {
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ extended_parameters,
+ extended_parameter_count,
+ } => {
+ let status = self.sys_nt_create_section_ex(
+ section_handle,
+ desired_access,
+ object_attributes,
+ maximum_size,
+ section_page_protection,
+ allocation_attributes,
+ file_handle,
+ extended_parameters,
+ extended_parameter_count,
+ );
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtCreateWaitCompletionPacket {
  wait_completion_packet_handle,
  desired_access,
@@ -1023,6 +1103,22 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtQuerySection {
+ section_handle,
+ section_information_class,
+ section_information,
+ section_information_length,
+ return_length,
+ } => {
+ let status = self.sys_nt_query_section(
+ section_handle,
+ section_information_class,
+ section_information,
+ section_information_length,
+ return_length,
+ );
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtQueryInformationProcess {
  process_handle,
  process_information_class,
@@ -1199,6 +1295,80 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  );
  (status, ContinueOperation::Resume)
  }
+ SyscallRequest::NtMapViewOfSection {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ } => {
+ let status = self.sys_nt_map_view_of_section(MapViewOfSectionParameters {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ });
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtMapViewOfSectionEx {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ extended_parameters,
+ extended_parameter_count,
+ } => {
+ let status = self.sys_nt_map_view_of_section_ex(
+ MapViewOfSectionParameters {
+ section_handle,
+ process_handle,
+ base_address,
+ zero_bits,
+ commit_size,
+ section_offset,
+ view_size,
+ inherit_disposition,
+ allocation_type,
+ page_protection,
+ },
+ extended_parameters,
+ extended_parameter_count,
+ );
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtUnmapViewOfSection {
+ process_handle,
+ base_address,
+ } => {
+ let status = self.sys_nt_unmap_view_of_section(process_handle, base_address);
+ (status, ContinueOperation::Resume)
+ }
+ SyscallRequest::NtUnmapViewOfSectionEx {
+ process_handle,
+ base_address,
+ flags,
+ } => {
+ let status =
+ self.sys_nt_unmap_view_of_section_ex(process_handle, base_address, flags);
+ (status, ContinueOperation::Resume)
+ }
  SyscallRequest::NtTerminateProcess {
  process_handle,
  exit_status,
@@ -1306,6 +1476,14 @@ impl<Platform: ShimPlatform, FS: ShimFS> Task<Platform, FS> {
  ) {
  return NtStatus::SUCCESS;
  }
+ if remove_raw_handle_by_raw_fd::<Platform, SectionSubsystem<Platform>>(
+ &self.global.litebox,
+ &self.process.handles,
+ raw_fd,
+ |section| visitor.section(section),
+ ) {
+ return NtStatus::SUCCESS;
+ }
  NtStatus::INVALID_HANDLE
  }
 
@@ -1342,6 +1520,8 @@ trait RawHandleVisitor<Platform: ShimPlatform, FS: ShimFS> {
  );
 
  fn worker_factory(&self, worker_factory: WorkerFactoryHandleObject<Platform>);
+
+ fn section(&self, section: SectionHandleObject<Platform>);
 }
 
 struct CloseRawHandleVisitor<'task, Platform: ShimPlatform, FS: ShimFS> {
@@ -1389,6 +1569,10 @@ impl<Platform: ShimPlatform, FS: ShimFS> RawHandleVisitor<Platform, FS>
  fn worker_factory(&self, worker_factory: WorkerFactoryHandleObject<Platform>) {
  Task::<Platform, FS>::close_worker_factory(worker_factory);
  }
+
+ fn section(&self, section: SectionHandleObject<Platform>) {
+ Task::<Platform, FS>::close_section(section);
+ }
 }
 
 /// The shim entrypoint object passed to the platform.

litebox_shim_windows/src/loader/mod.rs

@@ -4,3 +4,4 @@
 mod pe;
 
 pub(super) use pe::{PeLoader, WindowsLoadError};
+pub(crate) use pe::{image_section_metadata, load_image_section};

litebox_shim_windows/src/loader/pe.rs

@@ -1224,6 +1224,58 @@ fn load_image<Platform: crate::ShimPlatform, FS: ShimFS>(
  load_image_with_writable_sections(fs, path, platform, page_manager, &[])
 }
 
+pub(crate) fn load_image_section<Platform: crate::ShimPlatform, FS: ShimFS>(
+ platform: &'static Platform,
+ fs: Arc<FS>,
+ path: &str,
+ page_manager: &crate::WindowsPageManager<Platform>,
+ virtual_allocations: &crate::WindowsVirtualAllocations<Platform>,
+) -> Result<MappingInfo, WindowsLoadError> {
+ let image = load_image(platform, fs, path, page_manager)?;
+ let mapping = image.mapping;
+ register_image_virtual_allocation(virtual_allocations, mapping, image.pages);
+ Ok(mapping)
+}
+
+pub(crate) struct ImageSectionMetadata {
+ pub(crate) transfer_address: usize,
+ pub(crate) file_size: u32,
+ pub(crate) subsystem: u32,
+ pub(crate) subsystem_major_version: u16,
+ pub(crate) subsystem_minor_version: u16,
+ pub(crate) image_characteristics: u16,
+ pub(crate) dll_characteristics: u16,
+ pub(crate) machine: u16,
+}
+
+pub(crate) fn image_section_metadata<FS: ShimFS>(
+ fs: Arc<FS>,
+ path: &str,
+) -> Result<ImageSectionMetadata, WindowsLoadError> {
+ let file = PeImageFile::open(fs, path)?;
+ let parsed = PeParsedFile::parse(&mut &file).map_err(WindowsLoadError::Parse)?;
+ let file_size = file
+ .fs
+ .fd_file_status(&file.fd)
+ .map_err(PeImageAccessError::FileStatus)?
+ .size
+ .try_into()
+ .map_err(|_| PeImageAccessError::AddressOverflow)?;
+ Ok(ImageSectionMetadata {
+ transfer_address: parsed
+ .image_base()
+ .checked_add(parsed.entry_point_rva())
+ .ok_or(PeImageAccessError::AddressOverflow)?,
+ file_size,
+ subsystem: u32::from(parsed.subsystem()),
+ subsystem_major_version: parsed.major_subsystem_version(),
+ subsystem_minor_version: parsed.minor_subsystem_version(),
+ image_characteristics: parsed.characteristics(),
+ dll_characteristics: parsed.dll_characteristics(),
+ machine: parsed.machine(),
+ })
+}
+
 fn load_image_with_writable_sections<Platform: crate::ShimPlatform, FS: ShimFS>(
  fs: Arc<FS>,
  path: &str,