momo5502
ff99a1cb56
Log writes to the import table
2026-01-06 14:41:34 +01:00
momo5502
5ebf2dfd81
Support skipping syscall logging
2025-12-22 16:13:58 +01:00
momo5502
90343077da
Fix ordinals
2025-12-22 14:02:15 +01:00
momo5502
69ddd7a93b
Small fixes
2025-12-22 07:42:34 +01:00
momo5502
cfebd2f35f
Fix WinVerifyTrust
2025-12-21 20:37:42 +01:00
Maurice Heumann
304dbcc661
Comprehensive WOW64 subsystem implementation ( #555 )
...
# Major Features Implemented
**Core WOW64 Architecture**
1. Full TEB, PEB, and Windows structure implementations for 32-bit
processes
2. Proper thread context switching with 32-bit stack allocation
3. Configurable memory allocation with 32-bit/64-bit address space
handling
4. Automatic WOW64 process identification and handling
5. Heaven's Gate Implementation for handling exceptions
**Enhanced Emulation Features**
1. Fixed GDT setup and segment management for WOW64
2. Multi-architecture PE loading with proper import resolution
3. Segment-aware disassembly with WOW64 debugging capabilities
**Testing & Validation**
**32-bit Test Sample**: Minimal "hello" executable with full ASM source
# TODO
Needs more testing, currently in very early stages.
2025-10-21 20:13:01 +02:00
Igor Pissolati
1a97f3b2e2
Fix failed check
2025-10-20 23:19:24 -03:00
Igor Pissolati
65de67b24f
Use hard-coded values instead of calling __cpuidex
2025-10-20 22:52:56 -03:00
Igor Pissolati
6fe93375e6
Disable SSE4.x
2025-10-20 22:26:15 -03:00
brian
65eecf1cfd
Comprehensive WOW64 subsystem implementation
2025-10-13 19:55:50 +08:00
Maurice Heumann
afdae4aa8e
Update analysis.cpp
2025-09-25 07:31:22 +02:00
momo5502
6c5ca91b96
Shorter import logging
2025-09-21 16:45:24 +02:00
momo5502
3a55236fdf
Dump LoadLibraryA argument
2025-09-13 10:31:19 +02:00
momo5502
20a4df5632
Throttle env access logging in concise mode
2025-09-12 19:27:39 +02:00
momo5502
a4f81c4c7a
Fix concise logging
2025-09-09 18:04:36 +02:00
momo5502
7b3e7ed07d
Tie import tracking to execution again
2025-09-08 20:14:49 +02:00
momo5502
e55e078e92
Simplify import watching
2025-09-08 19:12:33 +02:00
momo5502
a671deb383
Rename is_within method to contains
2025-09-08 18:40:25 +02:00
momo5502
99249a8b3b
Fix printing
2025-09-08 15:37:02 +02:00
momo5502
f5de884ddf
Fix compilation with latest reflect version
2025-09-08 12:20:46 +02:00
momo5502
238c2aea6a
Only slient output before starting the emulation
2025-09-08 08:15:49 +02:00
momo5502
91f58e9d11
Fix GDB address
2025-09-08 08:15:09 +02:00
momo5502
dad460411c
Reduce cpuid, rdtsc and rdtscp logs in concise mode
2025-09-07 17:22:07 +02:00
momo5502
289eb2cbb0
Print counts in decimal
2025-09-06 11:12:51 +02:00
momo5502
037f078302
Revert SGDT hooking support
...
It's useless
2025-08-24 13:49:56 +02:00
momo5502
aa1a49ad6f
Get rid of static variables
2025-08-24 09:33:16 +02:00
Maurice Heumann
37310a308b
Fix Node.js analyzer
2025-08-24 08:43:23 +02:00
momo5502
7605309317
Fix cache for overlapping access
2025-08-20 16:13:48 +02:00
momo5502
80c8b88d23
Optimize instruction summary
2025-08-18 19:29:25 +02:00
momo5502
1db2c97165
Fix help
2025-08-18 19:16:56 +02:00
momo5502
c71c204583
Print instruction summary
2025-08-18 19:16:56 +02:00
momo5502
f432af419b
Small fix
2025-08-18 19:01:09 +02:00
momo5502
c75f30fdfb
Optimize instruction bytes
2025-08-18 19:01:09 +02:00
momo5502
10cd7868ac
Support SGDT hooking
2025-08-18 18:24:46 +02:00
momo5502
acf28467c5
Small fix
2025-08-18 18:24:45 +02:00
momo5502
0e92b04ef9
Log overlapping object access
2025-08-17 18:07:51 +02:00
momo5502
9ca18dd141
Fix linter warning
2025-08-17 07:52:45 +02:00
momo5502
584b770def
Store previous IP per thread
2025-08-17 07:32:26 +02:00
momo5502
9c29f26647
Small fixes
2025-08-17 07:26:11 +02:00
momo5502
7d6648ade0
Extend clang-format column limit to 140
2025-08-16 14:55:07 +02:00
momo5502
f3de9697d6
Prevent fallthrough to foreign transition if ignored
2025-08-16 14:27:11 +02:00
momo5502
ee2835d658
Enable instruction details
2025-08-16 13:48:52 +02:00
momo5502
397db6decc
Fix print
2025-08-16 11:53:44 +02:00
momo5502
3b72ae9709
Add capstone disassembler
2025-08-16 11:53:40 +02:00
momo5502
f12fd47d1d
Log transitions to foreign code
2025-08-15 15:30:08 +02:00
momo5502
127ed1b552
Log rdtsc
2025-08-15 12:54:36 +02:00
momo5502
bfb874662f
Cache access in concise mode
2025-08-14 19:15:27 +02:00
momo5502
ee679dcd0a
Log ldr access
2025-08-14 18:38:11 +02:00
momo5502
73000c8d22
Log foreign memory access
2025-08-14 17:03:39 +02:00
momo5502
e10df224a7
Log accessed size
2025-08-13 20:58:48 +02:00