diff --git a/src/analyzer/analysis.cpp b/src/analyzer/analysis.cpp index 43f0452f..e547dd1a 100644 --- a/src/analyzer/analysis.cpp +++ b/src/analyzer/analysis.cpp @@ -472,15 +472,18 @@ namespace } else if (mod->contains(previous_ip)) { - const auto rsp = emu.read_stack_pointer(); + if (!c.settings->skip_syscalls) + { + const auto rsp = emu.read_stack_pointer(); - uint64_t return_address{}; - emu.try_read_memory(rsp, &return_address, sizeof(return_address)); + uint64_t return_address{}; + emu.try_read_memory(rsp, &return_address, sizeof(return_address)); - const auto* caller_mod_name = win_emu.mod_manager.find_name(return_address); + const auto* caller_mod_name = win_emu.mod_manager.find_name(return_address); - win_emu.log.print(color::dark_gray, "Executing syscall: %.*s (0x%X) at 0x%" PRIx64 " via 0x%" PRIx64 " (%s)\n", - STR_VIEW_VA(syscall_name), syscall_id, address, return_address, caller_mod_name); + win_emu.log.print(color::dark_gray, "Executing syscall: %.*s (0x%X) at 0x%" PRIx64 " via 0x%" PRIx64 " (%s)\n", + STR_VIEW_VA(syscall_name), syscall_id, address, return_address, caller_mod_name); + } } else { diff --git a/src/analyzer/analysis.hpp b/src/analyzer/analysis.hpp index 388e2ed6..f9f5aeaf 100644 --- a/src/analyzer/analysis.hpp +++ b/src/analyzer/analysis.hpp @@ -17,6 +17,7 @@ struct analysis_settings bool silent{false}; bool buffer_stdout{false}; bool instruction_summary{false}; + bool skip_syscalls{false}; string_set modules{}; string_set ignored_functions{}; diff --git a/src/analyzer/main.cpp b/src/analyzer/main.cpp index 63b688b0..33cc45c1 100644 --- a/src/analyzer/main.cpp +++ b/src/analyzer/main.cpp @@ -650,6 +650,7 @@ namespace printf(" -p, --path Map Windows path to host path\n"); printf(" -r, --registry Set registry path (default: ./registry)\n\n"); printf(" -is, --inst-summary Print a summary of executed instructions of the analyzed modules\n"); + printf(" -ss, --skip-syscalls Skip the logging of regular syscalls\n"); printf("Examples:\n"); printf(" analyzer -v -e path/to/root myapp.exe\n"); printf(" analyzer -e path/to/root -p c:/analysis-sample.exe /path/to/sample.exe c:/analysis-sample.exe\n"); @@ -706,6 +707,10 @@ namespace { options.instruction_summary = true; } + else if (arg == "-ss" || arg == "--skip-syscalls") + { + options.skip_syscalls = true; + } else if (arg == "-m" || arg == "--module") { if (args.size() < 2)