Add unicode extraction wrapper and expose it to introspectionAPI (#87)

GDATASoftwareAG · Mar 20, 2023 · 3cc75e4 · 3cc75e4
1 parent 84dbb76
commit 3cc75e4
Show file tree

Hide file tree

Showing 5 changed files with 30 additions and 1 deletion.
diff --git a/vmicore/src/include/vmicore/vmi/IIntrospectionAPI.h b/vmicore/src/include/vmicore/vmi/IIntrospectionAPI.h
@@ -5,6 +5,7 @@
 #include "../types.h"
 #include <cstdint>
 #include <memory>
+#include <optional>
 #include <string>
 #include <tuple>
 #include <vector>
@@ -45,6 +46,9 @@ namespace VmiCore
 
         virtual std::unique_ptr<std::string> extractUnicodeStringAtVA(addr_t stringVA, addr_t cr3) = 0;
 
+        [[nodiscard]] virtual std::optional<std::unique_ptr<std::string>>
+        tryExtractUnicodeStringAtVA(const addr_t stringVA, const addr_t cr3) = 0;
+
         virtual std::unique_ptr<std::string> extractStringAtVA(addr_t virtualAddress, addr_t cr3) = 0;
 
         [[nodiscard]] virtual OperatingSystem getOsType() = 0;

diff --git a/vmicore/src/lib/vmi/LibvmiInterface.cpp b/vmicore/src/lib/vmi/LibvmiInterface.cpp
@@ -342,6 +342,18 @@ namespace VmiCore
     }
 
     std::unique_ptr<std::string> LibvmiInterface::extractUnicodeStringAtVA(const addr_t stringVA, const addr_t cr3)
+    {
+        auto extractedString = tryExtractUnicodeStringAtVA(stringVA, cr3);
+
+        if (!extractedString)
+        {
+            throw VmiException(fmt::format("{}: Unable to convert unicode string", __func__));
+        }
+        return std::move(extractedString.value());
+    }
+
+    std::optional<std::unique_ptr<std::string>> LibvmiInterface::tryExtractUnicodeStringAtVA(const addr_t stringVA,
+                                                                                             const addr_t cr3)
     {
         auto accessContext = createVirtualAddressAccessContext(stringVA, cr3);
         std::lock_guard<std::mutex> lock(libvmiLock);
@@ -351,7 +363,7 @@ namespace VmiCore
         vmi_free_unicode_str(extractedUnicodeString);
         if (success != VMI_SUCCESS)
         {
-            throw VmiException(fmt::format("{}: Unable to convert unicode string", __func__));
+            return std::nullopt;
         }
         auto result = std::make_unique<std::string>(reinterpret_cast<char*>(convertedUnicodeString.contents),
                                                     convertedUnicodeString.length);

diff --git a/vmicore/src/lib/vmi/LibvmiInterface.h b/vmicore/src/lib/vmi/LibvmiInterface.h
@@ -105,6 +105,9 @@ namespace VmiCore
 
         [[nodiscard]] std::unique_ptr<std::string> extractUnicodeStringAtVA(addr_t stringVA, addr_t cr3) override;
 
+        [[nodiscard]] std::optional<std::unique_ptr<std::string>>
+        tryExtractUnicodeStringAtVA(const addr_t stringVA, const addr_t cr3) override;
+
         [[nodiscard]] std::unique_ptr<std::string> extractStringAtVA(addr_t virtualAddress, addr_t cr3) override;
 
         void stopSingleStepForVcpu(vmi_event_t* event, uint vcpuId) override;

diff --git a/vmicore/test/include/vmicore_test/vmi/mock_IntrospectionAPI.h b/vmicore/test/include/vmicore_test/vmi/mock_IntrospectionAPI.h
@@ -37,6 +37,11 @@ namespace VmiCore
 
         MOCK_METHOD(std::unique_ptr<std::string>, extractUnicodeStringAtVA, (addr_t, addr_t), (override));
 
+        MOCK_METHOD(std::optional<std::unique_ptr<std::string>>,
+                    tryExtractUnicodeStringAtVA,
+                    (addr_t, addr_t),
+                    (override));
+
         MOCK_METHOD(std::unique_ptr<std::string>, extractStringAtVA, (addr_t, addr_t), (override));
 
         MOCK_METHOD(OperatingSystem, getOsType, (), (override));

diff --git a/vmicore/test/lib/vmi/mock_LibvmiInterface.h b/vmicore/test/lib/vmi/mock_LibvmiInterface.h
@@ -53,6 +53,11 @@ namespace VmiCore
 
         MOCK_METHOD(std::unique_ptr<std::string>, extractUnicodeStringAtVA, (const addr_t, const addr_t), (override));
 
+        MOCK_METHOD(std::optional<std::unique_ptr<std::string>>,
+                    tryExtractUnicodeStringAtVA,
+                    (addr_t, addr_t),
+                    (override));
+
         MOCK_METHOD(std::unique_ptr<std::string>, extractStringAtVA, (const addr_t, const addr_t), (override));
 
         MOCK_METHOD(void, stopSingleStepForVcpu, (vmi_event_t*, uint), (override));