Comprehensive WOW64 subsystem implementation (#555)

# Major Features Implemented
**Core WOW64 Architecture**
1. Full TEB, PEB, and Windows structure implementations for 32-bit
processes
2. Proper thread context switching with 32-bit stack allocation
3. Configurable memory allocation with 32-bit/64-bit address space
handling
4. Automatic WOW64 process identification and handling
5. Heaven's Gate Implementation for handling exceptions

**Enhanced Emulation Features**
1. Fixed GDT setup and segment management for WOW64
2. Multi-architecture PE loading with proper import resolution
3. Segment-aware disassembly with WOW64 debugging capabilities

**Testing & Validation**
**32-bit Test Sample**: Minimal "hello" executable with full ASM source

# TODO
Needs more testing, currently in very early stages.
This commit is contained in:
Maurice Heumann
2025-10-21 20:13:01 +02:00
committed by GitHub
51 changed files with 3772 additions and 283 deletions

View File

@@ -221,6 +221,26 @@ struct section : ref_counted_object
uint32_t section_page_protection{};
uint32_t allocation_attributes{};
// Cached PE image information for image sections
struct image_info
{
uint64_t entry_point_rva{};
uint64_t image_base{};
uint16_t machine{};
uint16_t subsystem{};
uint16_t subsystem_major_version{};
uint16_t subsystem_minor_version{};
uint16_t image_characteristics{};
uint16_t dll_characteristics{};
uint64_t size_of_stack_reserve{};
uint64_t size_of_stack_commit{};
uint32_t size_of_code{};
uint32_t loader_flags{};
uint32_t checksum{};
bool has_code{false};
};
std::optional<image_info> cached_image_info{};
bool is_image() const
{
return this->allocation_attributes & SEC_IMAGE;
@@ -233,6 +253,7 @@ struct section : ref_counted_object
buffer.write(this->maximum_size);
buffer.write(this->section_page_protection);
buffer.write(this->allocation_attributes);
buffer.write_optional<image_info>(this->cached_image_info);
}
void deserialize_object(utils::buffer_deserializer& buffer) override
@@ -242,6 +263,7 @@ struct section : ref_counted_object
buffer.read(this->maximum_size);
buffer.read(this->section_page_protection);
buffer.read(this->allocation_attributes);
buffer.read_optional(this->cached_image_info);
}
};