Welcome to XDA

Search to go directly to your device's forum

Register an account

Unlock full posting privileges

Ask a question

No registration required
Post Reply

[Beta] Win86emu: Running x86 apps on WinRT devices

OP mamaich

12th January 2013, 08:58 PM   |  #11  
Member
Thanks Meter: 53
 
69 posts
Join Date:Joined: Aug 2009
Would you mind giving a technical explanation?
12th January 2013, 11:39 PM   |  #12  
Senior Member
Thanks Meter: 101
 
275 posts
Join Date:Joined: Jul 2007
Quote:
Originally Posted by mamaich

I'm presenting a prototype of a tool that allows running Windows programs compiled for a desktop PC (x86) on an unlocked Windows RT (arm) tablet. The tool emulates x86 instructions and passes Windows API calls to WinRT kernel with necessary modifications.

This build is an early alpha version. It can run only very simple apps that use rather small subset of Win32 API that I've already implemented. Archive contains clock.exe from NT4 distribution as an example of such app. As I'll continue work on the project - the list of supported applications would grow up.

This tool would support only 32-bit windows native applications. It would not allow running drivers or .NET apps that were written for old .NET versions nor Win16 or DOS apps. And current version supports emulation only of EXE files that contain relocations section (this would be fixed later).

Instructions:
1. Unlock your device with this tool: http://forum.xda-developers.com/show....php?t=2092158
2. Unzip the archive to any directory
3. Run _start_clock.cmd
This would execute the clock.exe from NT4 in the emulation mode.

This post would be updated as I'll make more progress.

Note: This is an early alpha version, and do not expect that it would run anything except the provided file. Do not ask me what programs would be supported and when the next builds would appear - I don't know, as I work on this project only on spare time. I would not publish the complete sources of the tool, but it would be extensible by users, and some plugins (at least bochs/dosbox emulation engines and some of the API wrappers) would be opensource.
"Yact" in the file names stands for "yet another code translator", it was the original name of the project.

Edited 13.01.2012:
- added a few ARM WinAPI workarounds, added calc.exe as a second example (run _start_calc.cmd).

heh, is this a port of the app you showed off back in the CE days? -awesome getting that ported over
13th January 2013, 01:29 AM   |  #13  
Senior Member
Thanks Meter: 5
 
223 posts
Join Date:Joined: May 2007
More
This is great, really opens up a lot more things and means that we don't need to recompile everything either.
13th January 2013, 04:42 AM   |  #14  
OP Recognized Developer
Thanks Meter: 214
 
1,150 posts
Join Date:Joined: Apr 2004
Donate to Me
Quote:

heh, is this a port of the app you showed off back in the CE days? -awesome getting that ported over

Not exactly a port, it is a clean remake based on the old ideas.
Quote:
Originally Posted by clrokr

Would you mind giving a technical explanation?

The idea is very simple:
- a PE file loader (load files, process relocs, run TLS callbacks in an emulation mode). Support import loops (DLL A imports B while B imports A), ordinals, etc.
- a set of wrapper x86 DLLs (kernel32_stub.dll and so on) that "look like" the corresponding Win API functions for an emulated program:
Code:
#define DEFINE_FUNC1(name)      \
static const ModuleDef str_##name={DLL_NAME,#name};     \
EXTERN_C DW STUB_EXPORT stub_##name(DW p1)              \
{       \
        DW *p=&p1;      \
        __asm { mov eax,p }     \
        __asm { jmp f1 }        \
        __asm { mov eax,offset str_##name }     \
f1:     __asm { in eax,0xe5 }   \
        __asm { mov p,eax }     \
        return (DW)p;   \
}
.....
#define DEFINE_FUNC3(name)      \
static const ModuleDef str_##name={DLL_NAME,#name};     \
EXTERN_C DW STUB_EXPORT stub_##name(DW p1,DW p2,DW p3)          \
{       \
        DW *p=&p1;      \
        __asm { mov eax,p }     \
        __asm { jmp f1 }        \
        __asm { mov eax,offset str_##name }     \
f1:     __asm { in eax,0xe5 }   \
        __asm { mov p,eax }     \
        return (DW)p;   \
}
....
DEFINE_FUNC1(AddAtomA)
DEFINE_FUNC1(AddAtomW)
DEFINE_FUNC7(CreateFileA) -- number in macro == number of parameters to a __stdcall WinAPI function. 
Compiler automatically generates "ret N*4" at the end of such function. 
I've decided to use such c+asm approach instead of making a tiny assebler stub, 
as I can easily implement some of such functions in C directly in a stub DLL plus it 
simplifies debugging. And the functions have a usual C prologue/epilogue, so that 
the emulated program may even patch them in runtime, for example for hooks.
...
- a 32-bit x86 emulation engine (currently 2 engines: from bochs and from dosbox, planning on adding my own) that intercepts the command "in eax,0xe5", determines which API is needed by a program and passes it to a handler.
- native (arm) API handler DLLs (kernel32_yact.dll and so on). They are mostly autogenerated too:
Code:
#define DEFINE_FUNC1(name) 	\
EXTERN_C DW STUB_IMPORT name(DW);	\                     -- this behaves like a function prototype to compiler
EXTERN_C DW STUB_EXPORT yact_##name(DW *R)		\     -- R - pointer to the x86 stack 
{	\
  DW r=name(p1);	\         // call the func passing it paramers from the emulated stack, p1==R[0], p2==R[1] and so on
  LEAVE(1);		\         // empty macro, as the stack is unwinded in x86 stub DLL now
  return r;		\
}
...
#define DEFINE_FUNC3(name) 	\
EXTERN_C DW STUB_IMPORT name(DW,DW,DW);	\
EXTERN_C DW STUB_EXPORT yact_##name(DW *R)		\
{	\
  DW r=name(p1,p2,p3);	\
  LEAVE(3);		\
  return r;		\
}
...
DEFINE_FUNC1(AddAtomA)
DEFINE_FUNC1(AddAtomW)
DEFINE_FUNC7(CreateFileA)  // as you see - implementation part is identical to an x86 stub, so I can use the same stub-generator tool
Some of the functions require complex emulation due to their absence in ARM or due to the callbacks to x86 code:
Code:
static DWORD WINAPI ThreadProc(
  LPVOID lpParameter	// [0] == orig func, [1] == orig param
)
{
	__EXCEPTION_REGISTRATION_RECORD R;
	DWORD *Parm=(DWORD*)lpParameter;
	DWORD *TEB=(DWORD*)PeLdrGetCurrentTeb();
	R.Next=(__EXCEPTION_REGISTRATION_RECORD*)-1;
	R.Handler=(void*)CbReturnToHost();
	TEB[0]=(DWORD)&R;	// in case of unhandled exception - just return 
	PeLdrNotifyNewThread(NULL,DLL_THREAD_ATTACH);

	DWORD Ret=EmuExecute(Parm[0],1,Parm[1]); // 1 == number of parameters to the emulated function
	delete Parm;
	return Ret;
}

EXTERN_C DW STUB_EXPORT yact_CreateThread(DW *R)
{	
	DWORD* Parm=new DWORD[2];
	Parm[0]=p3;                               // TODO: no out-of-memory checking for now
	Parm[1]=p4;
	DWORD StackSize=p2;
	if(StackSize)
		StackSize+=1024*1024;      // I reserve some space for my own needs (debugging)
	else
		StackSize=2*1024*1024;     // TODO: I don't support autogrow stacks, so reserve 2 Mb

	DWORD t=(DWORD)CreateThread((LPSECURITY_ATTRIBUTES)p1,StackSize,ThreadProc,Parm,p5,(LPDWORD)p6);
	LEAVE(6);		
	return t;
}
Some of the COM interfaces are already implemented, for example DirectDraw and DirectSound, though not heavily debugged. On a desktop emulator build I can already run "Heroes of might and magic 3" and old WinRAR, but there are several RT-specific OS limitations I need to bypass before making them run on ARM. Current work in progress is: overcoming the RT limitations, manually implementing the API functions that callback to a program code (like CreateThread, RegisterClassA and so on), adding stubs for other system DLLs/COM objects.
Manually thrown SEH exceptions are fully supported, but access violation, int3 and similar OS-generated exceptions would cause program to crash. Some of the TEB fields (TLS and the fields required by the Borland compilers) are implemented too.

I don't make pointer translation in an emulated code nor make parameter checks passed to API. As a side-effect - the emulated program may trash the emulator in memory, but this greatly increases speed.
Most of the x86 EXE files don't contain relocations section and need to be loaded on the specific addresses (typically 0x400000). This is not a problem on a desktop, as I can rebase my emulator's EXE to any address I need, and free the corresponding RAM addrs for emulated program, but on ARM - this is a main problem. So currently only EXEs with relocs are supported for emulation, but there are ways to overcome this problem. And some EXEs produced by old Borland compilers contain "broken" relocs, this is a small problem too.
Last edited by mamaich; 13th January 2013 at 04:54 AM.
The Following 3 Users Say Thank You to mamaich For This Useful Post: [ View ]
13th January 2013, 04:48 AM   |  #15  
Senior Member
Thanks Meter: 10
 
459 posts
Join Date:Joined: May 2006
HI mamaich, sorry for disturbing you, may i know how do you compile visual studio project for arm ?, i already change windowsarmdesktop to true. But i can't find arm options in build settings. Any suggestion ?
13th January 2013, 05:12 AM   |  #16  
Recognized Developer
Flag Denver
Thanks Meter: 543
 
868 posts
Join Date:Joined: Jun 2009
Donate to Me
More
Quote:
Originally Posted by rheza02

HI mamaich, sorry for disturbing you, may i know how do you compile visual studio project for arm ?, i already change windowsarmdesktop to true. But i can't find arm options in build settings. Any suggestion ?

This is completely unrelated to the topic and has been covered in at least 3 threads, multiple times in each, in the past couple days. Use the search function.
13th January 2013, 05:17 AM   |  #17  
OP Recognized Developer
Thanks Meter: 214
 
1,150 posts
Join Date:Joined: Apr 2004
Donate to Me
Quote:
Originally Posted by netham45

This is completely unrelated to the topic and has been covered in at least 3 threads, multiple times in each, in the past couple days. Use the search function.

Yes, and I've answered it here: http://forum.xda-developers.com/show...&postcount=131
13th January 2013, 09:47 AM   |  #18  
Recognized Developer
Flag Seattle
Thanks Meter: 2,791
 
5,877 posts
Join Date:Joined: Jan 2011
More
Wow, this is awesome work! While recompiling (for native speed, lower memory footprint, launch time, lower battery usage, script transparency, etc.) is still obviously preferred, this finally offers a way to run closed-source or otherwise un-recompilable legacy apps. Well done; I'll be watching this closely.

A thought for making it easier to run the apps (including the aforementioned script transparency): Windows (at least on x86 and x64, and I'm pretty sure on ARM too) supports specifying executable names that, when they would be executed, are instead passed as a parameter to another executable. This is usually used for testing or debugging purposes (for example, always load a given app under a debugger or have Application Verifier hook into it at launch) but it can be used for other purposes too. One, which would be fantastic here, is to always run a program through a compatibility layer... I've never before seen it used for a full instruction set translation compatibility layer, but why not?

Create the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<IMAGE FILE NAME>
i.e. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\starcraft.exe
Then create a REG_SZ (String) value under that key called "Debugger" and set the value to the full path of the program you want to host the executable.
i.e. C:\Program Files\x86_peldr\peldr.exe

Source: http://support.microsoft.com/kb/824344

I can't promise that this will work for executable images that wouldn't be loadable normally, but it's probably worth a shot. Another, slightly less seamless option: change the extension of the executables (for example, starcraft.ex86) and register your app as the handler for that file type.
13th January 2013, 09:51 AM   |  #19  
Recognized Developer
Flag Denver
Thanks Meter: 543
 
868 posts
Join Date:Joined: Jun 2009
Donate to Me
More
Quote:
Originally Posted by GoodDayToDie

Wow, this is awesome work! While recompiling (for native speed, lower memory footprint, launch time, lower battery usage, script transparency, etc.) is still obviously preferred, this finally offers a way to run closed-source or otherwise un-recompilable legacy apps. Well done; I'll be watching this closely.

A thought for making it easier to run the apps (including the aforementioned script transparency): Windows (at least on x86 and x64, and I'm pretty sure on ARM too) supports specifying executable names that, when they would be executed, are instead passed as a parameter to another executable. This is usually used for testing or debugging purposes (for example, always load a given app under a debugger or have Application Verifier hook into it at launch) but it can be used for other purposes too. One, which would be fantastic here, is to always run a program through a compatibility layer... I've never before seen it used for a full instruction set translation compatibility layer, but why not?

Create the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<IMAGE FILE NAME>
i.e. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\starcraft.exe
Then create a REG_SZ (String) value under that key called "Debugger" and set the value to the full path of the program you want to host the executable.
i.e. C:\Program Files\x86_peldr\peldr.exe

Source: http://support.microsoft.com/kb/824344

I can't promise that this will work for executable images that wouldn't be loadable normally, but it's probably worth a shot. Another, slightly less seamless option: change the extension of the executables (for example, starcraft.ex86) and register your app as the handler for that file type.

What I was thinking of for doing that was hooking the 'This doesn't run on this PC' error that explorer gives and making it call this instead of the error.
13th January 2013, 10:01 AM   |  #20  
Recognized Developer
Flag Seattle
Thanks Meter: 2,791
 
5,877 posts
Join Date:Joined: Jan 2011
More
Nice... but that doesn't cover things like launching a program from the command line (script or manually), or one program launching another, or launching Windows services (although I'm not sure you'd want to emulate those anyhow... the battery hit would suck), or so on. Still an interesting goal.

One other thought for the "it'd-be-awesome" list (not even really a wish-list): support doing this for DLLs loaded into other processes (i.e. somehow get between LoadLibrary and the x86 binary, and interpose your translator). Why, you ask? Plugins. Browser plugins, media codecs (which are DLLs, whatever their extension), Control Panel files, COM objects in general, etc.

Post Reply Subscribe to Thread
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes