Igor Pissolati
dc3a0e6fd4
Small improvements
2025-10-21 11:23:57 -03:00
CarlTSpeak
b64f780ff6
Merge branch 'main' of https://github.com/momo5502/sogen
2025-10-21 11:20:08 +01:00
Igor Pissolati
1a97f3b2e2
Fix failed check
2025-10-20 23:19:24 -03:00
Igor Pissolati
65de67b24f
Use hard-coded values instead of calling __cpuidex
2025-10-20 22:52:56 -03:00
Igor Pissolati
6fe93375e6
Disable SSE4.x
2025-10-20 22:26:15 -03:00
Maurice Heumann
0e158b6064
Implement file renaming and relative path handling in NtQueryAttributesFile ( #557 )
...
This PR introduces several enhancements, mainly to the file system
syscalls:
- Implements file renaming via `NtSetInformationFile` by adding a
deferred rename mechanism to `file_handle`. The rename operation occurs
when the file handle is closed.
- Adds support for the `RootDirectory` parameter in
`NtQueryAttributesFile` to handle relative file paths.
- Adds support for opening the console output device (`\\??\\CONOUT$`).
- Stubs out the `NtLockVirtualMemory` syscall.
- Fixes an incorrect assertion in `socket_wrapper` that could fire on
`recvfrom` errors.
2025-10-20 15:08:37 +02:00
AlexGuo1998
66c7c3126d
Fix std::chrono::system_clock::now()
...
In `ntdll!RtlGetSystemTimePrecise`, `kusd.SystemTime` is queried first, and QPC offset (`QPC() - kusd.BaselineSystemTimeQpc`) is added if it's larger than 0.
Setting `kusd.BaselineSystemTimeQpc` to `UINT64_MAX` avoids the adjustment, so incorrect adjustments won't happen.
Alternatively, We can update `kusd.BaselineSystemTimeQpc` to be the QPC value just when `kusd.SystemTime` changes, but that's not possible, because we cannot monitor `kusd.SystemTime` for change.
2025-10-20 10:30:44 +08:00
Igor Pissolati
248c09d554
Implement ALPC port abstraction and implement DNS resolver port
2025-10-19 23:23:29 -03:00
Igor Pissolati
887b02c240
Support file renaming and support relative path in NtQueryAttributesFile
2025-10-19 17:51:44 -03:00
CarlTSpeak
1f5afe4c74
Minidump can load pages with C permission set. Minor instrumentation.
2025-10-18 14:19:53 +01:00
brian
65eecf1cfd
Comprehensive WOW64 subsystem implementation
2025-10-13 19:55:50 +08:00
momo5502
9453123db0
Force new line at EOF
2025-10-12 17:21:51 +02:00
momo5502
b10a9d3f2e
Regenerate flatbuffer files
2025-10-04 08:52:47 +02:00
Maurice Heumann
afdae4aa8e
Update analysis.cpp
2025-09-25 07:31:22 +02:00
momo5502
6c5ca91b96
Shorter import logging
2025-09-21 16:45:24 +02:00
momo5502
3a55236fdf
Dump LoadLibraryA argument
2025-09-13 10:31:19 +02:00
momo5502
a895de1a16
Fix allocator skipping
2025-09-13 09:42:15 +02:00
momo5502
847765ec71
Log window access
2025-09-12 21:02:45 +02:00
momo5502
c9c6b46ec2
Support object types information query
2025-09-12 20:36:45 +02:00
momo5502
20a4df5632
Throttle env access logging in concise mode
2025-09-12 19:27:39 +02:00
momo5502
a4f81c4c7a
Fix concise logging
2025-09-09 18:04:36 +02:00
momo5502
7b3e7ed07d
Tie import tracking to execution again
2025-09-08 20:14:49 +02:00
momo5502
e55e078e92
Simplify import watching
2025-09-08 19:12:33 +02:00
momo5502
a671deb383
Rename is_within method to contains
2025-09-08 18:40:25 +02:00
momo5502
99249a8b3b
Fix printing
2025-09-08 15:37:02 +02:00
momo5502
f5de884ddf
Fix compilation with latest reflect version
2025-09-08 12:20:46 +02:00
momo5502
238c2aea6a
Only slient output before starting the emulation
2025-09-08 08:15:49 +02:00
momo5502
91f58e9d11
Fix GDB address
2025-09-08 08:15:09 +02:00
momo5502
e1103d48bf
Dummy rdtscp
2025-09-07 21:31:09 +02:00
momo5502
f2916f4f0d
Fix specification
2025-09-07 21:30:11 +02:00
momo5502
c81c1468ba
Mark RDPID as unavailable
2025-09-07 21:30:11 +02:00
momo5502
2a43b42428
Mark rdtsc(p) as available
2025-09-07 20:43:11 +02:00
momo5502
f8bd45366b
Add more DLLs
2025-09-07 18:38:30 +02:00
momo5502
c545751cb5
Save wlanapi.dll
2025-09-07 18:01:39 +02:00
momo5502
dad460411c
Reduce cpuid, rdtsc and rdtscp logs in concise mode
2025-09-07 17:22:07 +02:00
momo5502
289eb2cbb0
Print counts in decimal
2025-09-06 11:12:51 +02:00
dependabot[bot]
97840f8878
Build(deps): Bump icicle-cpu
...
Bumps [icicle-cpu](https://github.com/icicle-emu/icicle-emu ) from `e80282d` to `ebb9bd1`.
- [Commits](e80282d3e1...ebb9bd1969support@github.com >
2025-09-02 07:43:24 +00:00
momo5502
0af756abd5
Use stored RIP as emulators are unreliable
2025-08-24 16:18:26 +02:00
momo5502
86e0dee91c
Merge remote-tracking branch 'origin/main' into unhandled-exceptions
2025-08-24 15:38:11 +02:00
momo5502
037f078302
Revert SGDT hooking support
...
It's useless
2025-08-24 13:49:56 +02:00
momo5502
58c71c687d
Merge remote-tracking branch 'origin/main' into unhandled-exceptions
2025-08-24 12:45:31 +02:00
Maurice Heumann
318b3a99d6
Unicorn upgrade ( #491 )
2025-08-24 12:29:11 +02:00
momo5502
aa1a49ad6f
Get rid of static variables
2025-08-24 09:33:16 +02:00
Maurice Heumann
3cad8df288
Merge remote-tracking branch 'origin/main' into unicorn-upgrade-2
2025-08-24 08:43:38 +02:00
Maurice Heumann
37310a308b
Fix Node.js analyzer
2025-08-24 08:43:23 +02:00
momo5502
549be496c4
Merge remote-tracking branch 'origin/main' into unicorn-upgrade-2
2025-08-23 10:40:48 +02:00
Red
257d9f6d02
Fix exception when NtTerminateThread is called on the active thread.
2025-08-22 00:32:05 +02:00
momo5502
7605309317
Fix cache for overlapping access
2025-08-20 16:13:48 +02:00
momo5502
644dcc903e
Support more memory on icicle
2025-08-19 20:23:05 +02:00
momo5502
717478e989
Small icicle optimization
2025-08-19 20:01:17 +02:00
