feat: implement Warden API binding / IAT patching for module imports

Complete the last major Warden stub — the import table parser that
resolves Windows API calls in loaded modules. This is the critical
missing piece for strict servers like Warmane.

Implementation:
- Parse Warden module import table from decompressed data (after
  relocation entries): alternating libraryName\0 / functionName\0
  pairs, terminated by null library name
- For each import, look up the emulator's pre-registered stub address
  (VirtualAlloc, GetTickCount, ReadProcessMemory, etc.)
- Auto-stub unrecognized APIs with a no-op returning 0 — prevents
  module crashes on unimplemented Windows functions
- Patch each IAT slot (sequential dwords at module image base) with
  the resolved stub address
- Add WardenEmulator::getAPIAddress() public accessor for IAT lookups
- Fix initialization order: bindAPIs() now runs inside initializeModule()
  after emulator setup but before entry point call

The full Warden pipeline is now: RC4 decrypt → RSA verify → zlib
decompress → parse executable → relocate → create emulator → register
API hooks → bind imports (IAT patch) → call entry point → extract
exported functions (packetHandler, tick, generateRC4Keys, unload).
This commit is contained in:
Kelsi 2026-03-30 22:38:05 -07:00
parent 248d131af7
commit 88d047d2fb
3 changed files with 104 additions and 54 deletions

View file

@ -138,6 +138,10 @@ public:
*/
std::vector<uint8_t> readData(uint32_t address, size_t size);
// Look up an already-registered API stub address by DLL and function name.
// Returns 0 if not found. Used by WardenModule::bindAPIs() for IAT patching.
uint32_t getAPIAddress(const std::string& dllName, const std::string& funcName) const;
private:
uc_engine* uc_; // Unicorn engine instance
uint32_t moduleBase_; // Module base address