Comprehensive WOW64 subsystem implementation (#555)

# Major Features Implemented
**Core WOW64 Architecture**
1. Full TEB, PEB, and Windows structure implementations for 32-bit
processes
2. Proper thread context switching with 32-bit stack allocation
3. Configurable memory allocation with 32-bit/64-bit address space
handling
4. Automatic WOW64 process identification and handling
5. Heaven's Gate Implementation for handling exceptions

**Enhanced Emulation Features**
1. Fixed GDT setup and segment management for WOW64
2. Multi-architecture PE loading with proper import resolution
3. Segment-aware disassembly with WOW64 debugging capabilities

**Testing & Validation**
**32-bit Test Sample**: Minimal "hello" executable with full ASM source

# TODO
Needs more testing, currently in very early stages.
This commit is contained in:
Maurice Heumann
2025-10-21 20:13:01 +02:00
committed by GitHub
51 changed files with 3772 additions and 283 deletions

View File

@@ -74,14 +74,16 @@ namespace
kusd.QpcData.QpcBypassEnabled = 0x83;
kusd.QpcBias = 0x000000159530c4af;
kusd.QpcFrequency = utils::clock::steady_duration::period::den;
kusd.Reserved1 = 0x7ffeffff;
kusd.Reserved3 = 0x80000000;
kusd.ProcessorFeatures.arr[PF_RDTSC_INSTRUCTION_AVAILABLE] = 1;
kusd.ProcessorFeatures.arr[PF_RDTSCP_INSTRUCTION_AVAILABLE] = 1;
kusd.ProcessorFeatures.arr[PF_RDPID_INSTRUCTION_AVAILABLE] = 0;
constexpr std::u16string_view root_dir{u"C:\\WINDOWS"};
constexpr std::u16string_view root_dir{u"C:\\Windows"};
memcpy(&kusd.NtSystemRoot.arr[0], root_dir.data(), root_dir.size() * 2);
kusd.ImageNumberLow = IMAGE_FILE_MACHINE_I386;
kusd.ImageNumberLow = IMAGE_FILE_MACHINE_AMD64;
kusd.ImageNumberHigh = IMAGE_FILE_MACHINE_AMD64;
}
}