ahm3dgg
725c7e3e9c
Pass file_system to process_context::setup
2026-01-06 09:16:45 +02:00
ssvine
f25ee26c36
Fix FS and GS handling
2025-12-30 15:19:05 +03:00
ssvine
57ad277158
Fix creating suspended thread and parse create_flags
2025-12-30 15:18:55 +03:00
ssvine
fea27338bb
Support SameTebFlags.InitialThread
...
This flag is needed to suport emulation of .net executables
that don't have an entry point set in PE header. This applies
to both PE32 and PE64 executables. If InitialThread is set
the loader substitutes an entry point of the .net executable
with mscoree.dll!_CorExeMain.
2025-12-30 13:44:21 +03:00
momo5502
cb4fe6c30f
Merge remote-tracking branch 'origin/main' into wow64
2025-10-25 11:06:03 +02:00
CarlTSpeak
064df5b6ef
Revert earlier rdtsc changes, implement fixes
2025-10-24 10:59:28 +01:00
CarlTSpeak
1f5afe4c74
Minidump can load pages with C permission set. Minor instrumentation.
2025-10-18 14:19:53 +01:00
brian
65eecf1cfd
Comprehensive WOW64 subsystem implementation
2025-10-13 19:55:50 +08:00
momo5502
0af756abd5
Use stored RIP as emulators are unreliable
2025-08-24 16:18:26 +02:00
momo5502
549be496c4
Merge remote-tracking branch 'origin/main' into unicorn-upgrade-2
2025-08-23 10:40:48 +02:00
Red
257d9f6d02
Fix exception when NtTerminateThread is called on the active thread.
2025-08-22 00:32:05 +02:00
momo5502
584b770def
Store previous IP per thread
2025-08-17 07:32:26 +02:00
momo5502
7d6648ade0
Extend clang-format column limit to 140
2025-08-16 14:55:07 +02:00
momo5502
127ed1b552
Log rdtsc
2025-08-15 12:54:36 +02:00
Maurice Heumann
9e5a6b509b
Implement guard pages ( #406 )
...
Hey, looking for feedback on my guard page implementation.
I wasn't sure on how to structure the additional windows specific memory
flags, since the emulation backends won't like additional guard flag. I
opted to create a new `memory_permission_ext` enum to hold the guard
flag, and a `nt_memory_permission` struct to wrap the "common" memory
permission flags, with the new extended flags. This struct implicitly
coerces to the original `memory_permission` to reduce the amount of
changes for the PR.
This however meant that I changed signatures of `map_memory` and
`apply_memory_protection` in `memory_interface` to accommodate this new
structure, and was an afterthought.
The `map_nt_to_emulator_protection` function might also need some
attention now, too. For future reference, windows uses
[MiMakeProtectionMask](https://doxygen.reactos.org/d1/d9a/marea_8c.html#adfb66408771a4df77c1056cc2a99ef21 )
in ntoskrnl to map `PAGE_*` flags to [MM PTE
constants](https://reactos.org/wiki/Techwiki:Memory_management_in_the_Windows_XP_kernel ).
The test added to the `test-sample` binary seems to be passing.
Fixes #21
2025-07-17 17:41:06 +02:00
Maurice Heumann
91375b22f9
Try upgrading unicorn
2025-07-13 19:37:56 +02:00
Maurice Heumann
d7a1a269b7
Setup thread before dispatching APC
2025-07-12 21:33:12 +02:00
3fault
f4fc9c4a6c
fix memory_permissions_ext includes
2025-07-09 14:49:26 -04:00
3fault
6e203d9590
Fix formatting issues
2025-07-02 14:47:51 -04:00
3fault
2e17f37f78
Update hook_memory_violation to handle guard page violations
2025-07-01 19:17:05 -04:00
momo5502
f3b20da9cc
Optimize thread scheduling and pausing
2025-06-07 14:20:19 +02:00
momo5502
05c5f0a085
Final cleanup
2025-06-07 08:01:02 +02:00
momo5502
da4a4f90c9
Cleanup exception callbacks
2025-06-07 07:54:11 +02:00
momo5502
bc77faec3d
Move more logging into callbacks
2025-06-06 20:03:53 +02:00
momo5502
9b8ea27a29
Delay process setup
2025-06-05 20:53:38 +02:00
momo5502
f2e0e91630
Isolate more analysis into analyzer
2025-06-05 18:59:27 +02:00
momo5502
f046246740
Extract more analysis logic
2025-06-04 21:21:48 +02:00
momo5502
84e8e86b94
Extract sus activity logging
2025-06-04 19:28:50 +02:00
momo5502
009961620b
Fix thread deletion
2025-06-01 13:57:14 +02:00
momo5502
da658e5178
Prepare timer support
2025-06-01 13:56:45 +02:00
momo5502
28de07ac8f
Explicitly pass desired backend to emulator
2025-05-29 19:49:53 +02:00
momo5502
c559c2ff43
Support stopping emulation while all threads are sleeping
...
This fixes #242
2025-05-29 08:30:56 +02:00
momo5502
ae77e1b62d
Fix fuzzer
2025-05-28 19:47:08 +02:00
momo5502
30363cc760
Reimplement snapshot support
2025-05-25 17:56:50 +02:00
Soham Nandy
cff2feee75
Add rdtscp instruction with stub IA32_TSC_AUX values
2025-05-02 07:20:36 +05:30
Maurice Heumann
6cb571f496
Prepare web debugger ( #247 )
2025-04-29 09:51:15 +02:00
momo5502
1beb95c2b2
Support thread-switch callback
2025-04-29 09:25:45 +02:00
Igor Pissolati
a629f77e31
Miscellaneous fixes
2025-04-28 12:48:28 -03:00
Igor Pissolati
9d5338b168
Load environment variables from registry
2025-04-28 12:46:36 -03:00
robert-yates
b2296930d3
prepare 32bit support with name and class inheritance modifications
2025-04-22 12:01:40 +02:00
momo5502
4ac8d853a6
Always use static socket factory for emscripten
2025-04-18 08:15:17 +02:00
momo5502
c1553ad2ec
Fixes for emscripten
2025-04-17 19:40:20 +02:00
momo5502
68022ef501
Fixes
2025-04-14 20:16:24 +02:00
Maurice Heumann
a6dd9251b8
Prepare 32 bit support
2025-04-14 13:57:54 +02:00
momo5502
b3139cfacd
Small fixes
2025-04-13 16:38:50 +02:00
momo5502
2ed35d94b9
Set correct status
2025-04-13 15:00:39 +02:00
momo5502
7910021124
Fix apc dispatching
2025-04-13 14:28:35 +02:00
momo5502
c1e621c2cd
Basic hacky working APC dispatching
2025-04-13 13:39:09 +02:00
momo5502
f58dec38a2
Prepare APC support
2025-04-13 13:39:08 +02:00
Soham Nandy
ea7f6a68c8
Use auto for timestamp_counter tick type
...
Co-authored-by: Maurice Heumann <MauriceHeumann@gmail.com >
2025-04-11 12:12:56 +05:30
