Commit Graph

113 Commits

Author SHA1 Message Date
Igor Pissolati
3c6c2e2dde Apply review suggestion 2025-10-23 11:19:35 -03:00
Igor Pissolati
2c82277b5e Add FileIdInformation file info class 2025-10-23 11:19:17 -03:00
Igor Pissolati
46b97fd91c Don't request 'file_size' for directories 2025-10-22 17:21:04 -03:00
Igor Pissolati
c07f541528 Stub NtSetSecurityObject 2025-10-22 17:20:38 -03:00
Igor Pissolati
c8a18cf61c Add FileIsRemoteDeviceInformation file info class 2025-10-22 17:14:51 -03:00
Igor Pissolati
c0fd8ebf51 Add FileFsAttributeInformation fs info class 2025-10-22 17:14:19 -03:00
Maurice Heumann
b84ae7475f Implement ALPC port abstraction and implement DNS resolver port (#558)
This PR introduces an abstraction for ALPC ports to make them easier to
manage in the future, and implements the DNS resolver port, at least
enough to get host address queries working.
There's a lot of code in this PR that I'm not very confident about, so
don't hesitate on the feedback 😄

<img width="1377" height="624" alt="image"
src="https://github.com/user-attachments/assets/4d56b84d-4b87-42ed-9bfa-be04dbbf3735"
/>
2025-10-21 20:42:26 +02:00
Igor Pissolati
dc3a0e6fd4 Small improvements 2025-10-21 11:23:57 -03:00
Igor Pissolati
248c09d554 Implement ALPC port abstraction and implement DNS resolver port 2025-10-19 23:23:29 -03:00
Igor Pissolati
887b02c240 Support file renaming and support relative path in NtQueryAttributesFile 2025-10-19 17:51:44 -03:00
momo5502
9453123db0 Force new line at EOF 2025-10-12 17:21:51 +02:00
momo5502
c9c6b46ec2 Support object types information query 2025-09-12 20:36:45 +02:00
momo5502
b2eef2bf46 Align processor counts 2025-08-17 07:31:37 +02:00
momo5502
9c29f26647 Small fixes 2025-08-17 07:26:11 +02:00
momo5502
7d6648ade0 Extend clang-format column limit to 140 2025-08-16 14:55:07 +02:00
momo5502
5fbf065937 Handle debug strings via callback 2025-08-10 10:03:12 +02:00
CarlTSpeak
051cef2212 fix: handle VirtualAlloc invalid size and flags 2025-08-08 14:52:03 +01:00
CarlTSpeak
0aea1f5385 I just learned how clang-format works. Fail. 2025-08-08 11:22:56 +01:00
CarlTSpeak
210ab2930c Fixed platform portability issues 2025-08-06 11:12:44 +01:00
CarlTSpeak
8b2c170236 Fixed clang exception. Again. 2025-08-06 11:01:42 +01:00
CarlTSpeak
ffea72d48a Added basic pipe support to NtRead/WriteFile 2025-08-06 10:30:40 +01:00
CarlTSpeak
100638d8ea Fixed clang-tidy issue 2025-08-05 16:26:13 +01:00
CarlTSpeak
85843ff5c9 Fixed cross-platform: removed MS-specific macro 2025-08-05 15:55:36 +01:00
CarlTSpeak
5f9bfd4694 Added stubs for NtCreateNamedPipeFile NtReleaseWorkerFactoryWorker 2025-08-05 15:44:19 +01:00
CarlTSpeak
cae1cf5c1f Added stubs for NtCreateNamedPipeFile NtReleaseWorkerFactoryWorker 2025-08-05 15:35:31 +01:00
momo5502
6eb4ef33ff Handle invalid page protections
This fixes #420
2025-07-20 09:34:25 +02:00
Maurice Heumann
9e5a6b509b Implement guard pages (#406)
Hey, looking for feedback on my guard page implementation. 

I wasn't sure on how to structure the additional windows specific memory
flags, since the emulation backends won't like additional guard flag. I
opted to create a new `memory_permission_ext` enum to hold the guard
flag, and a `nt_memory_permission` struct to wrap the "common" memory
permission flags, with the new extended flags. This struct implicitly
coerces to the original `memory_permission` to reduce the amount of
changes for the PR.

This however meant that I changed signatures of `map_memory` and
`apply_memory_protection` in `memory_interface` to accommodate this new
structure, and was an afterthought.

The `map_nt_to_emulator_protection` function might also need some
attention now, too. For future reference, windows uses
[MiMakeProtectionMask](https://doxygen.reactos.org/d1/d9a/marea_8c.html#adfb66408771a4df77c1056cc2a99ef21)
in ntoskrnl to map `PAGE_*` flags to [MM PTE
constants](https://reactos.org/wiki/Techwiki:Memory_management_in_the_Windows_XP_kernel).

The test added to the `test-sample` binary seems to be passing.

Fixes #21
2025-07-17 17:41:06 +02:00
momo5502
ac2d34c143 Small cleanup 2025-07-12 15:40:04 +02:00
momo5502
7a3a5d760e Fix thread deletion 2025-07-12 15:28:30 +02:00
3fault
1276c7e2bc Update occurances of memory_permission to nt_memory_permission where needed 2025-07-01 19:04:22 -04:00
momo5502
08ae52710b Prevent translation of relative files 2025-06-16 18:38:55 +02:00
momo5502
bda89b5d1e Add more syscalls 2025-06-15 19:48:05 +02:00
momo5502
1421550764 Cleanup and fix NtQueryInformationProcess 2025-06-15 09:31:57 +02:00
Red
f14b16d080 Fix anti-debug detections for NtQueryInformationProcess with ProcessDebugObjectHandle 2025-06-14 15:00:53 +02:00
momo5502
906cec808a Small fixes 2025-06-07 20:10:36 +02:00
momo5502
05c5f0a085 Final cleanup 2025-06-07 08:01:02 +02:00
momo5502
da4a4f90c9 Cleanup exception callbacks 2025-06-07 07:54:11 +02:00
momo5502
802e295bcc Adapt more printing 2025-06-07 07:29:30 +02:00
momo5502
9372e27453 Fix module logging 2025-06-07 07:11:27 +02:00
momo5502
bc77faec3d Move more logging into callbacks 2025-06-06 20:03:53 +02:00
momo5502
f2e0e91630 Isolate more analysis into analyzer 2025-06-05 18:59:27 +02:00
momo5502
956e73d839 Some fixes 2025-06-04 20:47:51 +02:00
momo5502
1f829463c1 Use more semantic logging 2025-06-04 20:22:28 +02:00
momo5502
de0d9a17a5 Small fixes 2025-06-04 20:19:47 +02:00
momo5502
84e8e86b94 Extract sus activity logging 2025-06-04 19:28:50 +02:00
Maurice Heumann
dcee2982ce Update file.cpp 2025-06-03 11:18:10 +02:00
Igor Pissolati
9f32620220 Fix failing checks 2025-06-02 14:32:15 -03:00
Igor Pissolati
c67146ee45 Add new syscalls 2025-06-02 14:32:15 -03:00
Igor Pissolati
db1588623b Add KSecDD device and support for devices in NtQueryObject 2025-06-02 14:32:15 -03:00
Igor Pissolati
cc2266d934 Add new pseudo-handles 2025-06-02 14:32:15 -03:00