Commit Graph

79 Commits

Author SHA1 Message Date
momo5502
906cec808a Small fixes 2025-06-07 20:10:36 +02:00
momo5502
05c5f0a085 Final cleanup 2025-06-07 08:01:02 +02:00
momo5502
da4a4f90c9 Cleanup exception callbacks 2025-06-07 07:54:11 +02:00
momo5502
802e295bcc Adapt more printing 2025-06-07 07:29:30 +02:00
momo5502
9372e27453 Fix module logging 2025-06-07 07:11:27 +02:00
momo5502
bc77faec3d Move more logging into callbacks 2025-06-06 20:03:53 +02:00
momo5502
f2e0e91630 Isolate more analysis into analyzer 2025-06-05 18:59:27 +02:00
momo5502
956e73d839 Some fixes 2025-06-04 20:47:51 +02:00
momo5502
1f829463c1 Use more semantic logging 2025-06-04 20:22:28 +02:00
momo5502
de0d9a17a5 Small fixes 2025-06-04 20:19:47 +02:00
momo5502
84e8e86b94 Extract sus activity logging 2025-06-04 19:28:50 +02:00
Maurice Heumann
dcee2982ce Update file.cpp 2025-06-03 11:18:10 +02:00
Igor Pissolati
9f32620220 Fix failing checks 2025-06-02 14:32:15 -03:00
Igor Pissolati
c67146ee45 Add new syscalls 2025-06-02 14:32:15 -03:00
Igor Pissolati
db1588623b Add KSecDD device and support for devices in NtQueryObject 2025-06-02 14:32:15 -03:00
Igor Pissolati
cc2266d934 Add new pseudo-handles 2025-06-02 14:32:15 -03:00
Igor Pissolati
ad3046466e Improvements to NtQueryInformationToken 2025-06-02 14:32:15 -03:00
momo5502
aa763c8392 Prepare more timer syscalls 2025-06-01 14:05:18 +02:00
momo5502
009961620b Fix thread deletion 2025-06-01 13:57:14 +02:00
momo5502
da658e5178 Prepare timer support 2025-06-01 13:56:45 +02:00
momo5502
c605131a80 Small changes 2025-06-01 12:48:59 +02:00
momo5502
ed80b86e22 Fix compilation 2025-06-01 07:54:42 +02:00
momo5502
e763fdac54 Support more syscalls 2025-05-31 21:27:32 +02:00
momo5502
bc92023652 Fix directory enumation with filesystem mappings 2025-05-31 16:31:24 +02:00
momo5502
b6f4645420 Some more syscalls 2025-05-31 13:21:19 +02:00
momo5502
8abc7a65ef Support svcctrl start event 2025-05-24 11:06:23 +02:00
momo5502
92bdf26669 Fix computername 2025-05-24 11:06:09 +02:00
Igor Pissolati
e0507aa2c5 Fix afd_endpoint::ioctl_connect 2025-05-21 19:28:27 -03:00
Igor Pissolati
5b4193cf92 Fix failing checks 2025-05-20 22:25:31 -03:00
Igor Pissolati
3e1f206bc0 Fixes to file syscalls 2025-05-20 21:44:40 -03:00
Igor Pissolati
4888142d22 Better handling of NtCreateKey 2025-05-20 21:44:18 -03:00
momo5502
d08bcbae9c Add window object 2025-05-18 09:13:26 +02:00
Maurice Heumann
3e7f6e5fc1 Redirect zero base memory image requests to main exe 2025-05-08 18:30:50 +02:00
Igor Pissolati
7a8e6dd459 Fix Windows 2019 Time Zone Test 2025-04-28 18:47:24 -03:00
Igor Pissolati
a629f77e31 Miscellaneous fixes 2025-04-28 12:48:28 -03:00
Maurice Heumann
be9d0164d7 Improvements to NtQueryDirectoryFileEx (#235)
This PR aims to:
- [Stub FileBasicInformation in
NtSetInformationFile](6d0ad1dd61)
- [Make sure a root `windows_path` have slash at the
end](02ed4fbb03),
this was necessary because `directory_iterator` fails when the path is
`C:` (without slash)..
- [Improve
NtQueryDirectoryFileEx](f6ec1fc9cc)
by adding filename filtering support, including more basic file
information in the struct, and fixing an issue that prevented the last
chunk of files from being enumerated correctly.
2025-04-25 08:32:47 +02:00
Igor Pissolati
61c6ecb65b Fix small oversight 2025-04-24 18:01:17 -03:00
Igor Pissolati
97ec131c50 Improvements to NtQueryDirectoryFileEx 2025-04-24 17:31:49 -03:00
Igor Pissolati
6d0ad1dd61 Stub FileBasicInformation in NtSetInformationFile 2025-04-24 01:01:09 -03:00
Igor Pissolati
a3a786c6ec Fix failing check 2025-04-23 18:41:56 -03:00
Igor Pissolati
3b918f2d5c Stub SystemFirmwareTableInformation in NtQuerySystemInformation 2025-04-23 18:24:12 -03:00
Igor Pissolati
7fef4ebc24 Handle TokenGroups in NtQueryInformationToken 2025-04-23 18:22:06 -03:00
Igor Pissolati
44fcc9970d Fix failing checks 2025-04-23 01:51:37 -03:00
Igor Pissolati
134b45d1e8 Fix vm crash when teb.ThreadLocalStoragePointer is null 2025-04-23 01:16:31 -03:00
Igor Pissolati
39d40a7f2f Simplify TimeZone query fix 2025-04-23 01:14:35 -03:00
Igor Pissolati
8dfcf2755c Add stub for NtAreMappedFilesTheSame and modify NtSetInformationKey to return success 2025-04-23 01:03:42 -03:00
Maurice Heumann
1b9e114737 Improvements to locale syscalls, fix TimeZone query and add more syscalls (#223)
This PR aims to do the following:
- Add the `NtUserGetAtomName` syscall.
- Add stub handlers for `NtUserSetWindowsHookEx`,
`NtUserUnhookWindowsHookEx`, and `NtUserCreateWindowEx`.
- Implement `NtGetNlsSectionPtr` (for Code Pages), add
`NtQueryDefaultUILanguage`, and improve `NtQueryInstallUILanguage`.
- Handle `SystemTimeZoneInformation`,
`SystemCurrentTimeZoneInformation`, and
`SystemDynamicTimeZoneInformation` in `NtQuerySystemInformation`.
- Skip `ThreadAffinityMask` in `NtSetInformationThread`.
- Fix `NtConnectPort` to allow TimeZone queries to work properly. This
is probably the most problematic change here because it required messing
with the shared section and hardcoding an offset (2504). Initializing
the data in this offset seems necessary for calls like
`GetTimeZoneInformation` to succeed, so maybe there's no other way
around it.
2025-04-22 09:08:42 +02:00
Igor Pissolati
8970c4b1e6 Fix x86 build (again) 2025-04-22 03:54:13 -03:00
Igor Pissolati
bd8818c335 Fix failing checks 2025-04-22 02:35:54 -03:00
Igor Pissolati
7e93f5d7f6 Improvements to locale syscalls and fix TimeZone query 2025-04-22 01:48:52 -03:00