momo5502
802e295bcc
Adapt more printing
2025-06-07 07:29:30 +02:00
momo5502
9372e27453
Fix module logging
2025-06-07 07:11:27 +02:00
momo5502
bc77faec3d
Move more logging into callbacks
2025-06-06 20:03:53 +02:00
momo5502
f2e0e91630
Isolate more analysis into analyzer
2025-06-05 18:59:27 +02:00
momo5502
956e73d839
Some fixes
2025-06-04 20:47:51 +02:00
momo5502
1f829463c1
Use more semantic logging
2025-06-04 20:22:28 +02:00
momo5502
de0d9a17a5
Small fixes
2025-06-04 20:19:47 +02:00
momo5502
84e8e86b94
Extract sus activity logging
2025-06-04 19:28:50 +02:00
Maurice Heumann
dcee2982ce
Update file.cpp
2025-06-03 11:18:10 +02:00
Igor Pissolati
9f32620220
Fix failing checks
2025-06-02 14:32:15 -03:00
Igor Pissolati
c67146ee45
Add new syscalls
2025-06-02 14:32:15 -03:00
Igor Pissolati
db1588623b
Add KSecDD device and support for devices in NtQueryObject
2025-06-02 14:32:15 -03:00
Igor Pissolati
cc2266d934
Add new pseudo-handles
2025-06-02 14:32:15 -03:00
Igor Pissolati
ad3046466e
Improvements to NtQueryInformationToken
2025-06-02 14:32:15 -03:00
momo5502
aa763c8392
Prepare more timer syscalls
2025-06-01 14:05:18 +02:00
momo5502
009961620b
Fix thread deletion
2025-06-01 13:57:14 +02:00
momo5502
da658e5178
Prepare timer support
2025-06-01 13:56:45 +02:00
momo5502
c605131a80
Small changes
2025-06-01 12:48:59 +02:00
momo5502
ed80b86e22
Fix compilation
2025-06-01 07:54:42 +02:00
momo5502
e763fdac54
Support more syscalls
2025-05-31 21:27:32 +02:00
momo5502
bc92023652
Fix directory enumation with filesystem mappings
2025-05-31 16:31:24 +02:00
momo5502
b6f4645420
Some more syscalls
2025-05-31 13:21:19 +02:00
momo5502
8abc7a65ef
Support svcctrl start event
2025-05-24 11:06:23 +02:00
momo5502
92bdf26669
Fix computername
2025-05-24 11:06:09 +02:00
Igor Pissolati
e0507aa2c5
Fix afd_endpoint::ioctl_connect
2025-05-21 19:28:27 -03:00
Igor Pissolati
5b4193cf92
Fix failing checks
2025-05-20 22:25:31 -03:00
Igor Pissolati
3e1f206bc0
Fixes to file syscalls
2025-05-20 21:44:40 -03:00
Igor Pissolati
4888142d22
Better handling of NtCreateKey
2025-05-20 21:44:18 -03:00
momo5502
d08bcbae9c
Add window object
2025-05-18 09:13:26 +02:00
Maurice Heumann
3e7f6e5fc1
Redirect zero base memory image requests to main exe
2025-05-08 18:30:50 +02:00
Igor Pissolati
7a8e6dd459
Fix Windows 2019 Time Zone Test
2025-04-28 18:47:24 -03:00
Igor Pissolati
a629f77e31
Miscellaneous fixes
2025-04-28 12:48:28 -03:00
Maurice Heumann
be9d0164d7
Improvements to NtQueryDirectoryFileEx ( #235 )
...
This PR aims to:
- [Stub FileBasicInformation in
NtSetInformationFile](6d0ad1dd61 )
- [Make sure a root `windows_path` have slash at the
end](02ed4fbb03 ),
this was necessary because `directory_iterator` fails when the path is
`C:` (without slash)..
- [Improve
NtQueryDirectoryFileEx](f6ec1fc9cc )
by adding filename filtering support, including more basic file
information in the struct, and fixing an issue that prevented the last
chunk of files from being enumerated correctly.
2025-04-25 08:32:47 +02:00
Igor Pissolati
61c6ecb65b
Fix small oversight
2025-04-24 18:01:17 -03:00
Igor Pissolati
97ec131c50
Improvements to NtQueryDirectoryFileEx
2025-04-24 17:31:49 -03:00
Igor Pissolati
6d0ad1dd61
Stub FileBasicInformation in NtSetInformationFile
2025-04-24 01:01:09 -03:00
Igor Pissolati
a3a786c6ec
Fix failing check
2025-04-23 18:41:56 -03:00
Igor Pissolati
3b918f2d5c
Stub SystemFirmwareTableInformation in NtQuerySystemInformation
2025-04-23 18:24:12 -03:00
Igor Pissolati
7fef4ebc24
Handle TokenGroups in NtQueryInformationToken
2025-04-23 18:22:06 -03:00
Igor Pissolati
44fcc9970d
Fix failing checks
2025-04-23 01:51:37 -03:00
Igor Pissolati
134b45d1e8
Fix vm crash when teb.ThreadLocalStoragePointer is null
2025-04-23 01:16:31 -03:00
Igor Pissolati
39d40a7f2f
Simplify TimeZone query fix
2025-04-23 01:14:35 -03:00
Igor Pissolati
8dfcf2755c
Add stub for NtAreMappedFilesTheSame and modify NtSetInformationKey to return success
2025-04-23 01:03:42 -03:00
Maurice Heumann
1b9e114737
Improvements to locale syscalls, fix TimeZone query and add more syscalls ( #223 )
...
This PR aims to do the following:
- Add the `NtUserGetAtomName` syscall.
- Add stub handlers for `NtUserSetWindowsHookEx`,
`NtUserUnhookWindowsHookEx`, and `NtUserCreateWindowEx`.
- Implement `NtGetNlsSectionPtr` (for Code Pages), add
`NtQueryDefaultUILanguage`, and improve `NtQueryInstallUILanguage`.
- Handle `SystemTimeZoneInformation`,
`SystemCurrentTimeZoneInformation`, and
`SystemDynamicTimeZoneInformation` in `NtQuerySystemInformation`.
- Skip `ThreadAffinityMask` in `NtSetInformationThread`.
- Fix `NtConnectPort` to allow TimeZone queries to work properly. This
is probably the most problematic change here because it required messing
with the shared section and hardcoding an offset (2504). Initializing
the data in this offset seems necessary for calls like
`GetTimeZoneInformation` to succeed, so maybe there's no other way
around it.
2025-04-22 09:08:42 +02:00
Igor Pissolati
8970c4b1e6
Fix x86 build (again)
2025-04-22 03:54:13 -03:00
Igor Pissolati
bd8818c335
Fix failing checks
2025-04-22 02:35:54 -03:00
Igor Pissolati
7e93f5d7f6
Improvements to locale syscalls and fix TimeZone query
2025-04-22 01:48:52 -03:00
Igor Pissolati
08098da538
Skip ThreadAffinityMask in NtSetInformationThread
2025-04-22 01:25:15 -03:00
Igor Pissolati
7dbf498ea9
Fix clang-tidy warning (attempt 2)
2025-04-20 17:08:54 -03:00
Igor Pissolati
763b8fc760
Improvements to registry syscalls
2025-04-20 16:09:04 -03:00