Commit Graph

190 Commits

Author SHA1 Message Date
momo5502
ff99a1cb56 Log writes to the import table 2026-01-06 14:41:34 +01:00
momo5502
5ebf2dfd81 Support skipping syscall logging 2025-12-22 16:13:58 +01:00
momo5502
90343077da Fix ordinals 2025-12-22 14:02:15 +01:00
momo5502
69ddd7a93b Small fixes 2025-12-22 07:42:34 +01:00
momo5502
cfebd2f35f Fix WinVerifyTrust 2025-12-21 20:37:42 +01:00
Maurice Heumann
304dbcc661 Comprehensive WOW64 subsystem implementation (#555)
# Major Features Implemented
**Core WOW64 Architecture**
1. Full TEB, PEB, and Windows structure implementations for 32-bit
processes
2. Proper thread context switching with 32-bit stack allocation
3. Configurable memory allocation with 32-bit/64-bit address space
handling
4. Automatic WOW64 process identification and handling
5. Heaven's Gate Implementation for handling exceptions

**Enhanced Emulation Features**
1. Fixed GDT setup and segment management for WOW64
2. Multi-architecture PE loading with proper import resolution
3. Segment-aware disassembly with WOW64 debugging capabilities

**Testing & Validation**
**32-bit Test Sample**: Minimal "hello" executable with full ASM source

# TODO
Needs more testing, currently in very early stages.
2025-10-21 20:13:01 +02:00
Igor Pissolati
1a97f3b2e2 Fix failed check 2025-10-20 23:19:24 -03:00
Igor Pissolati
65de67b24f Use hard-coded values instead of calling __cpuidex 2025-10-20 22:52:56 -03:00
Igor Pissolati
6fe93375e6 Disable SSE4.x 2025-10-20 22:26:15 -03:00
brian
65eecf1cfd Comprehensive WOW64 subsystem implementation 2025-10-13 19:55:50 +08:00
Maurice Heumann
afdae4aa8e Update analysis.cpp 2025-09-25 07:31:22 +02:00
momo5502
6c5ca91b96 Shorter import logging 2025-09-21 16:45:24 +02:00
momo5502
3a55236fdf Dump LoadLibraryA argument 2025-09-13 10:31:19 +02:00
momo5502
20a4df5632 Throttle env access logging in concise mode 2025-09-12 19:27:39 +02:00
momo5502
a4f81c4c7a Fix concise logging 2025-09-09 18:04:36 +02:00
momo5502
7b3e7ed07d Tie import tracking to execution again 2025-09-08 20:14:49 +02:00
momo5502
e55e078e92 Simplify import watching 2025-09-08 19:12:33 +02:00
momo5502
a671deb383 Rename is_within method to contains 2025-09-08 18:40:25 +02:00
momo5502
99249a8b3b Fix printing 2025-09-08 15:37:02 +02:00
momo5502
f5de884ddf Fix compilation with latest reflect version 2025-09-08 12:20:46 +02:00
momo5502
238c2aea6a Only slient output before starting the emulation 2025-09-08 08:15:49 +02:00
momo5502
91f58e9d11 Fix GDB address 2025-09-08 08:15:09 +02:00
momo5502
dad460411c Reduce cpuid, rdtsc and rdtscp logs in concise mode 2025-09-07 17:22:07 +02:00
momo5502
289eb2cbb0 Print counts in decimal 2025-09-06 11:12:51 +02:00
momo5502
037f078302 Revert SGDT hooking support
It's useless
2025-08-24 13:49:56 +02:00
momo5502
aa1a49ad6f Get rid of static variables 2025-08-24 09:33:16 +02:00
Maurice Heumann
37310a308b Fix Node.js analyzer 2025-08-24 08:43:23 +02:00
momo5502
7605309317 Fix cache for overlapping access 2025-08-20 16:13:48 +02:00
momo5502
80c8b88d23 Optimize instruction summary 2025-08-18 19:29:25 +02:00
momo5502
1db2c97165 Fix help 2025-08-18 19:16:56 +02:00
momo5502
c71c204583 Print instruction summary 2025-08-18 19:16:56 +02:00
momo5502
f432af419b Small fix 2025-08-18 19:01:09 +02:00
momo5502
c75f30fdfb Optimize instruction bytes 2025-08-18 19:01:09 +02:00
momo5502
10cd7868ac Support SGDT hooking 2025-08-18 18:24:46 +02:00
momo5502
acf28467c5 Small fix 2025-08-18 18:24:45 +02:00
momo5502
0e92b04ef9 Log overlapping object access 2025-08-17 18:07:51 +02:00
momo5502
9ca18dd141 Fix linter warning 2025-08-17 07:52:45 +02:00
momo5502
584b770def Store previous IP per thread 2025-08-17 07:32:26 +02:00
momo5502
9c29f26647 Small fixes 2025-08-17 07:26:11 +02:00
momo5502
7d6648ade0 Extend clang-format column limit to 140 2025-08-16 14:55:07 +02:00
momo5502
f3de9697d6 Prevent fallthrough to foreign transition if ignored 2025-08-16 14:27:11 +02:00
momo5502
ee2835d658 Enable instruction details 2025-08-16 13:48:52 +02:00
momo5502
397db6decc Fix print 2025-08-16 11:53:44 +02:00
momo5502
3b72ae9709 Add capstone disassembler 2025-08-16 11:53:40 +02:00
momo5502
f12fd47d1d Log transitions to foreign code 2025-08-15 15:30:08 +02:00
momo5502
127ed1b552 Log rdtsc 2025-08-15 12:54:36 +02:00
momo5502
bfb874662f Cache access in concise mode 2025-08-14 19:15:27 +02:00
momo5502
ee679dcd0a Log ldr access 2025-08-14 18:38:11 +02:00
momo5502
73000c8d22 Log foreign memory access 2025-08-14 17:03:39 +02:00
momo5502
e10df224a7 Log accessed size 2025-08-13 20:58:48 +02:00