qilingframework / qiling

A True Instrumentable Binary Emulation Framework
https://qiling.io
GNU General Public License v2.0
5.06k stars 737 forks source link

support FILE_GENERIC_* access modes #1440

Closed matt-phylum closed 7 months ago

matt-phylum commented 7 months ago

CreateFile dwDesiredAccess is weird. Qiling supports GENERIC_READ and GENERIC_WRITE, but CreateFile natively uses FILE_READ_DATA and FILE_WRITE_DATA (Generic Access Rights). This PR doesn't translate the GENERIC_* values to specific file access rights (Qiling doesn't have all of the involved constants), but it does allow Qiling to recognize the FILE_* rights.

Do you know about winmd files? It should be possible to dump constants and generate hook method stubs from the definitions in the winmd files. https://github.com/microsoft/win32metadata

Checklist

Which kind of PR do you create?

Coding convention?

Extra tests?

Changelog?

Target branch?

One last thing