Commit Graph

190 Commits

Author SHA1 Message Date
ahm3dgg
3064f3c1b7 remove regex 2026-01-14 08:49:09 +02:00
Maurice Heumann
608a0cf0ec Improve Windows version detection and LdrSystemDllInitBlock initialization (#697)
- Add WINDOWS_VERSION enum and PS_SYSTEM_DLL_INIT_BLOCK sizes for WOW64
support across different Windows builds.
- Read system information (SystemRoot, BuildNumber, UpdateBuildRevision)
from registry instead of hardcoded paths.
- Add build comparison helpers in process_context for precise build
checks.
2026-01-14 07:14:06 +01:00
ahmed
0eae0cac56 Merge branch 'main' into knowndlls-patch 2026-01-11 01:47:34 +02:00
brian
0a414ca346 Extract Windows version management into separate module 2026-01-09 16:44:48 +08:00
brian
456dc99fb6 Improve Windows version detection and LdrSystemDllInitBlock initialization
- Add WINDOWS_VERSION enum and PS_SYSTEM_DLL_INIT_BLOCK sizes for WOW64 support across different Windows builds.
- Read system information (SystemRoot, BuildNumber, UpdateBuildRevision) from registry instead of hardcoded paths.
- Add build comparison helpers in process_context for precise build checks.
2026-01-09 00:38:03 +08:00
Igor Pissolati
9fdc2a4ce6 Add support for user callbacks 2026-01-06 10:14:02 -03:00
ahm3dgg
725c7e3e9c Pass file_system to process_context::setup 2026-01-06 09:16:45 +02:00
ssvine
f25ee26c36 Fix FS and GS handling 2025-12-30 15:19:05 +03:00
ssvine
57ad277158 Fix creating suspended thread and parse create_flags 2025-12-30 15:18:55 +03:00
ssvine
fea27338bb Support SameTebFlags.InitialThread
This flag is needed to suport emulation of .net executables
that don't have an entry point set in PE header. This applies
to both PE32 and PE64 executables. If InitialThread is set
the loader substitutes an entry point of the .net executable
with mscoree.dll!_CorExeMain.
2025-12-30 13:44:21 +03:00
momo5502
cb4fe6c30f Merge remote-tracking branch 'origin/main' into wow64 2025-10-25 11:06:03 +02:00
CarlTSpeak
064df5b6ef Revert earlier rdtsc changes, implement fixes 2025-10-24 10:59:28 +01:00
CarlTSpeak
1f5afe4c74 Minidump can load pages with C permission set. Minor instrumentation. 2025-10-18 14:19:53 +01:00
brian
65eecf1cfd Comprehensive WOW64 subsystem implementation 2025-10-13 19:55:50 +08:00
momo5502
0af756abd5 Use stored RIP as emulators are unreliable 2025-08-24 16:18:26 +02:00
momo5502
549be496c4 Merge remote-tracking branch 'origin/main' into unicorn-upgrade-2 2025-08-23 10:40:48 +02:00
Red
257d9f6d02 Fix exception when NtTerminateThread is called on the active thread. 2025-08-22 00:32:05 +02:00
momo5502
584b770def Store previous IP per thread 2025-08-17 07:32:26 +02:00
momo5502
7d6648ade0 Extend clang-format column limit to 140 2025-08-16 14:55:07 +02:00
momo5502
127ed1b552 Log rdtsc 2025-08-15 12:54:36 +02:00
Maurice Heumann
9e5a6b509b Implement guard pages (#406)
Hey, looking for feedback on my guard page implementation. 

I wasn't sure on how to structure the additional windows specific memory
flags, since the emulation backends won't like additional guard flag. I
opted to create a new `memory_permission_ext` enum to hold the guard
flag, and a `nt_memory_permission` struct to wrap the "common" memory
permission flags, with the new extended flags. This struct implicitly
coerces to the original `memory_permission` to reduce the amount of
changes for the PR.

This however meant that I changed signatures of `map_memory` and
`apply_memory_protection` in `memory_interface` to accommodate this new
structure, and was an afterthought.

The `map_nt_to_emulator_protection` function might also need some
attention now, too. For future reference, windows uses
[MiMakeProtectionMask](https://doxygen.reactos.org/d1/d9a/marea_8c.html#adfb66408771a4df77c1056cc2a99ef21)
in ntoskrnl to map `PAGE_*` flags to [MM PTE
constants](https://reactos.org/wiki/Techwiki:Memory_management_in_the_Windows_XP_kernel).

The test added to the `test-sample` binary seems to be passing.

Fixes #21
2025-07-17 17:41:06 +02:00
Maurice Heumann
91375b22f9 Try upgrading unicorn 2025-07-13 19:37:56 +02:00
Maurice Heumann
d7a1a269b7 Setup thread before dispatching APC 2025-07-12 21:33:12 +02:00
3fault
f4fc9c4a6c fix memory_permissions_ext includes 2025-07-09 14:49:26 -04:00
3fault
6e203d9590 Fix formatting issues 2025-07-02 14:47:51 -04:00
3fault
2e17f37f78 Update hook_memory_violation to handle guard page violations 2025-07-01 19:17:05 -04:00
momo5502
f3b20da9cc Optimize thread scheduling and pausing 2025-06-07 14:20:19 +02:00
momo5502
05c5f0a085 Final cleanup 2025-06-07 08:01:02 +02:00
momo5502
da4a4f90c9 Cleanup exception callbacks 2025-06-07 07:54:11 +02:00
momo5502
bc77faec3d Move more logging into callbacks 2025-06-06 20:03:53 +02:00
momo5502
9b8ea27a29 Delay process setup 2025-06-05 20:53:38 +02:00
momo5502
f2e0e91630 Isolate more analysis into analyzer 2025-06-05 18:59:27 +02:00
momo5502
f046246740 Extract more analysis logic 2025-06-04 21:21:48 +02:00
momo5502
84e8e86b94 Extract sus activity logging 2025-06-04 19:28:50 +02:00
momo5502
009961620b Fix thread deletion 2025-06-01 13:57:14 +02:00
momo5502
da658e5178 Prepare timer support 2025-06-01 13:56:45 +02:00
momo5502
28de07ac8f Explicitly pass desired backend to emulator 2025-05-29 19:49:53 +02:00
momo5502
c559c2ff43 Support stopping emulation while all threads are sleeping
This fixes #242
2025-05-29 08:30:56 +02:00
momo5502
ae77e1b62d Fix fuzzer 2025-05-28 19:47:08 +02:00
momo5502
30363cc760 Reimplement snapshot support 2025-05-25 17:56:50 +02:00
Soham Nandy
cff2feee75 Add rdtscp instruction with stub IA32_TSC_AUX values 2025-05-02 07:20:36 +05:30
Maurice Heumann
6cb571f496 Prepare web debugger (#247) 2025-04-29 09:51:15 +02:00
momo5502
1beb95c2b2 Support thread-switch callback 2025-04-29 09:25:45 +02:00
Igor Pissolati
a629f77e31 Miscellaneous fixes 2025-04-28 12:48:28 -03:00
Igor Pissolati
9d5338b168 Load environment variables from registry 2025-04-28 12:46:36 -03:00
robert-yates
b2296930d3 prepare 32bit support with name and class inheritance modifications 2025-04-22 12:01:40 +02:00
momo5502
4ac8d853a6 Always use static socket factory for emscripten 2025-04-18 08:15:17 +02:00
momo5502
c1553ad2ec Fixes for emscripten 2025-04-17 19:40:20 +02:00
momo5502
68022ef501 Fixes 2025-04-14 20:16:24 +02:00
Maurice Heumann
a6dd9251b8 Prepare 32 bit support 2025-04-14 13:57:54 +02:00