momo5502
127ed1b552
Log rdtsc
2025-08-15 12:54:36 +02:00
momo5502
bfb874662f
Cache access in concise mode
2025-08-14 19:15:27 +02:00
momo5502
ee679dcd0a
Log ldr access
2025-08-14 18:38:11 +02:00
momo5502
73000c8d22
Log foreign memory access
2025-08-14 17:03:39 +02:00
momo5502
e10df224a7
Log accessed size
2025-08-13 20:58:48 +02:00
momo5502
3189e6f701
Log more interesting things if outside any mapped module
2025-08-13 19:50:04 +02:00
momo5502
982d02b674
Log invocations outside of any module
2025-08-13 19:09:44 +02:00
momo5502
a33e252e40
Kill WinVerifyTrust
2025-08-13 19:06:18 +02:00
momo5502
f9cee1837c
Print compare input
2025-08-10 12:43:35 +02:00
momo5502
94687d73fe
Small fixes
2025-08-10 11:18:05 +02:00
momo5502
5fbf065937
Handle debug strings via callback
2025-08-10 10:03:12 +02:00
momo5502
74bff93580
Print on unknown exception
2025-08-10 08:40:29 +02:00
momo5502
b980ff6277
Fix crash is module is nullptr
2025-08-10 08:37:02 +02:00
momo5502
806aa8b61b
Print module name
2025-08-09 21:56:25 +02:00
momo5502
93ff52c2ec
Fix ordinals
2025-08-09 21:36:40 +02:00
momo5502
9e45d2a333
Fix warning
2025-08-09 21:00:10 +02:00
momo5502
b3bdfc9d6b
Support hooking/unhooking within hooks for icicle
2025-08-09 20:45:05 +02:00
momo5502
3b9320fd62
Better import access tracking
2025-08-09 18:02:37 +02:00
momo5502
2abe1737f3
Fix android compilation
2025-08-09 17:42:33 +02:00
momo5502
292fc6ce67
Fix compilation
2025-08-09 17:38:20 +02:00
momo5502
eb07148bfd
Support hook deletion during hook deletion
2025-08-09 17:23:58 +02:00
momo5502
386f5b1cbc
Add missing types
2025-08-09 17:20:22 +02:00
momo5502
eb6d352a81
Track import access
2025-08-09 17:07:33 +02:00
momo5502
09ad463027
Support environment analysis
2025-08-09 14:06:06 +02:00
CarlTSpeak
051cef2212
fix: handle VirtualAlloc invalid size and flags
2025-08-08 14:52:03 +01:00
CarlTSpeak
0aea1f5385
I just learned how clang-format works. Fail.
2025-08-08 11:22:56 +01:00
CarlTSpeak
210ab2930c
Fixed platform portability issues
2025-08-06 11:12:44 +01:00
CarlTSpeak
8b2c170236
Fixed clang exception. Again.
2025-08-06 11:01:42 +01:00
CarlTSpeak
ffea72d48a
Added basic pipe support to NtRead/WriteFile
2025-08-06 10:30:40 +01:00
CarlTSpeak
100638d8ea
Fixed clang-tidy issue
2025-08-05 16:26:13 +01:00
CarlTSpeak
85843ff5c9
Fixed cross-platform: removed MS-specific macro
2025-08-05 15:55:36 +01:00
CarlTSpeak
5f9bfd4694
Added stubs for NtCreateNamedPipeFile NtReleaseWorkerFactoryWorker
2025-08-05 15:44:19 +01:00
CarlTSpeak
cae1cf5c1f
Added stubs for NtCreateNamedPipeFile NtReleaseWorkerFactoryWorker
2025-08-05 15:35:31 +01:00
Maurice Heumann
a1df4d8047
Update reflect_type_info.hpp
2025-08-05 07:24:16 +02:00
Maurice Heumann
73085b16db
Update reflect_type_info.hpp
2025-08-05 07:14:54 +02:00
momo5502
6eb4ef33ff
Handle invalid page protections
...
This fixes #420
2025-07-20 09:34:25 +02:00
momo5502
5e57360dc3
Fix buffer overflow
2025-07-18 07:15:54 +02:00
Maurice Heumann
acc5dd9646
Fix compilation
2025-07-17 19:49:16 +02:00
Maurice Heumann
4d4c04eb78
Finish tenet tracer refactoring
2025-07-17 19:42:59 +02:00
Maurice Heumann
6e71e495bc
More fixes
2025-07-17 18:55:16 +02:00
Maurice Heumann
3c05c7a607
Small fixes
2025-07-17 18:53:07 +02:00
Maurice Heumann
d09b32eb5e
Fix clang tidy warnings
2025-07-17 18:45:18 +02:00
Maurice Heumann
b5e40c3627
Revert line endings
2025-07-17 18:38:26 +02:00
Maurice Heumann
8caf724c95
Fix formatting
2025-07-17 18:30:00 +02:00
Maurice Heumann
079d367792
Generate an output that the Tenet plugin can read ( #416 )
...
Generates a Tenet tracer output with the -t parameter. The original
Tenet tracer plugin is outdated, so I made updates to support our
emulator. The forked project below works well.
https://github.com/maskelihileci/tenet/tree/master/plugins_sogen-support
2025-07-17 18:11:47 +02:00
Maurice Heumann
9e5a6b509b
Implement guard pages ( #406 )
...
Hey, looking for feedback on my guard page implementation.
I wasn't sure on how to structure the additional windows specific memory
flags, since the emulation backends won't like additional guard flag. I
opted to create a new `memory_permission_ext` enum to hold the guard
flag, and a `nt_memory_permission` struct to wrap the "common" memory
permission flags, with the new extended flags. This struct implicitly
coerces to the original `memory_permission` to reduce the amount of
changes for the PR.
This however meant that I changed signatures of `map_memory` and
`apply_memory_protection` in `memory_interface` to accommodate this new
structure, and was an afterthought.
The `map_nt_to_emulator_protection` function might also need some
attention now, too. For future reference, windows uses
[MiMakeProtectionMask](https://doxygen.reactos.org/d1/d9a/marea_8c.html#adfb66408771a4df77c1056cc2a99ef21 )
in ntoskrnl to map `PAGE_*` flags to [MM PTE
constants](https://reactos.org/wiki/Techwiki:Memory_management_in_the_Windows_XP_kernel ).
The test added to the `test-sample` binary seems to be passing.
Fixes #21
2025-07-17 17:41:06 +02:00
3fault
188b95af5d
Fix formatting
2025-07-17 11:27:23 -04:00
3fault
f1d54f7417
Parameterize basic_memory_region to support extended memory flags
2025-07-17 11:19:56 -04:00
3fault
9f637105fb
Unset extended flags in nt_memory_permission assignment operator
2025-07-17 11:06:26 -04:00
3fault
8cea9fc75a
Ensure memory is freed after guard page test
2025-07-17 10:55:45 -04:00
