Commit Graph

145 Commits

Author SHA1 Message Date
ahm3dgg
4f8745ce1b Support for KnownDLLs and Some Refactoring 2026-01-07 08:06:19 +02:00
ahm3dgg
f54bc3467f Support for KnownDLLs and Some Refactoring 2026-01-07 07:34:34 +02:00
Igor Pissolati
d51f890197 Use vector instead of large array 2026-01-04 22:51:19 -03:00
Maurice Heumann
1f936c024d Fix thread support (#640)
This PR fixes several things related to threads emulation:

1. Support `SameTebFlags.InitialThread`
This flag is needed to support emulation of .net executables (not yet
fully supported) that don't have an entry point set in `PE` header. This
applies to both `PE32` and `PE64` executables. If `InitialThread` is set
the loader substitutes an entry point of the .net executable with
`mscoree.dll!_CorExeMain`.

2. Fix static thread local storage for `WOW64`
This fix resolves `shell32.dll` initialization on `WOW64`. This fix also
uses correct structure and field names that are obtained from the
corresponding `.pdb` files.

3. Fix dynamic thread local storage for `WOW64`

4. Fix setting argument of a `WOW64` thread start proc

5. Fix creating suspended thread and parse create_flags
Currently creating suspended thread doesn't work because
`NtCreateThreadEx` handler uses invalid flag `CREATE_SUSPENDED`. This PR
fixes that, and moreover it carefully parses create_flags of the
`NtCreateThreadEx` call.

6. Fix `FS` and `GS` handling
This PR fixes several problems with `GS` and `FS` segments:

    * Wrong GDT descriptor for selector 0x53
* Update GDT descriptor for selector 0x53 for a `WOW64` process every
context switch like Windows does
* Set `GS` base when `GS` segment register is updated in 64-bit code
(code selector is `0x33`). When `GS` segment register is loaded with
correct selector (`0x2b`) `GS` base is set to 0. So, when the code
accesses something like `gs:[0]`, a page fault occurs. `KiPageFault`
handles this situation and sets correct `GS` base.

Also, take into account that `teb64.ExceptionList` initially contains
`teb32` address for `WOW64` process. This is used to setup `FS` base
when `wrfsbase` instruction is available. We can enable this instruction
using `kusd.ProcessorFeatures.arr[PF_RDWRFSGSBASE_AVAILABLE] = 1;` and
this work perfectly with `unicorn` backend. Unfortunately `icicle`
backend does not support `wrfsbase`, so I don't enable this instruction
by default.
2025-12-30 17:56:30 +01:00
ssvine
f25ee26c36 Fix FS and GS handling 2025-12-30 15:19:05 +03:00
66hh
f95081cb6e Introduce try_write_memory for the memory manager 2025-12-28 19:36:40 +08:00
momo5502
effd2f7a02 Merge remote-tracking branch 'origin/main' into wow64 2025-10-21 20:45:29 +02:00
Igor Pissolati
248c09d554 Implement ALPC port abstraction and implement DNS resolver port 2025-10-19 23:23:29 -03:00
brian
65eecf1cfd Comprehensive WOW64 subsystem implementation 2025-10-13 19:55:50 +08:00
momo5502
037f078302 Revert SGDT hooking support
It's useless
2025-08-24 13:49:56 +02:00
momo5502
10cd7868ac Support SGDT hooking 2025-08-18 18:24:46 +02:00
momo5502
7d6648ade0 Extend clang-format column limit to 140 2025-08-16 14:55:07 +02:00
momo5502
09ad463027 Support environment analysis 2025-08-09 14:06:06 +02:00
3fault
188b95af5d Fix formatting 2025-07-17 11:27:23 -04:00
3fault
f1d54f7417 Parameterize basic_memory_region to support extended memory flags 2025-07-17 11:19:56 -04:00
3fault
19574fb512 remove references to nt_memory_permission from backend 2025-07-09 14:43:06 -04:00
3fault
2e17f37f78 Update hook_memory_violation to handle guard page violations 2025-07-01 19:17:05 -04:00
3fault
1276c7e2bc Update occurances of memory_permission to nt_memory_permission where needed 2025-07-01 19:04:22 -04:00
3fault
7d8daf7c68 Update map_nt_to_emulator_protection to support PAGE_GUARD flag 2025-07-01 18:28:54 -04:00
momo5502
da4a4f90c9 Cleanup exception callbacks 2025-06-07 07:54:11 +02:00
momo5502
da658e5178 Prepare timer support 2025-06-01 13:56:45 +02:00
momo5502
86dbd11008 Fix serialization of atoms 2025-05-18 12:48:17 +02:00
momo5502
3ba06d15c2 Remove edge generation hook 2025-05-17 17:05:33 +02:00
robert-yates
b2296930d3 prepare 32bit support with name and class inheritance modifications 2025-04-22 12:01:40 +02:00
momo5502
88d94f7065 Fix hook sizes 2025-04-14 18:34:34 +02:00
Maurice Heumann
a6dd9251b8 Prepare 32 bit support 2025-04-14 13:57:54 +02:00
momo5502
9e8f921be1 Add emulator names 2025-04-08 20:29:53 +02:00
momo5502
5fde8c033d Fix hooks
This fixes #180
2025-04-06 20:01:18 +02:00
momo5502
349526a54a Simplify hooking interface 2025-04-05 11:59:49 +02:00
momo5502
a336bdf2af Simplify violation hook API 2025-04-05 10:01:28 +02:00
momo5502
d191f8e667 Optimize MMIO handling 2025-04-05 09:03:41 +02:00
Maurice Heumann
24df7c65c2 Support accurate instruction counts 2025-04-04 13:13:09 +02:00
momo5502
bdf5d60fd9 Implement serialization 2025-04-01 20:54:08 +02:00
momo5502
637ed75b8c GDT fixes 2025-03-29 10:44:41 +01:00
momo5502
af6492be6d Unify setting segment base 2025-03-29 10:44:41 +01:00
momo5502
2bc3cda062 Cleanup snapshot generation 2025-03-23 12:42:42 +01:00
momo5502
8dcfbf0601 Hm 2025-03-22 13:07:51 +01:00
momo5502
0e57c684a8 Optimize deserializer construction 2025-03-20 19:02:23 +01:00
momo5502
ef8a9dae6e Fix warnings 2025-03-18 20:08:54 +01:00
momo5502
6263353438 Isolate memory manager 2025-02-09 18:19:32 +01:00
momo5502
4e38ddc323 Ensure proper allocation granularity 2025-02-09 11:01:46 +01:00
momo5502
454c9a267b Fix afd device serialization 2025-01-26 09:56:55 +01:00
momo5502
45d7c542c3 Prepare emulation bisection 2025-01-26 08:28:10 +01:00
momo5502
130367619b Add debugging utils 2025-01-26 08:28:10 +01:00
momo5502
e34a9e6468 Serialization fixes 2025-01-26 07:05:32 +01:00
momo5502
ec1333278b Implement root fs handling 2025-01-25 07:24:01 +01:00
Elias Bachaalany
5bf325c77f some refactoring with optional_function
- wrapped std::function into utils::optional_function
-- cleaned the code accordingly in windows_emulator
- using the 'emulator'/'windows_emulator' dependency implies the emulator_common as well.
2025-01-21 19:25:51 -08:00
Maurice Heumann
7a663094d6 [NFC] Cleanup project structure a bit (#93) 2025-01-20 20:25:52 +01:00
Elias Bachaalany
1d5c5c2e74 Introducing reflection levels concept into core components (#91)
The idea is to allow as much internal information into inner components.
to not burden all builds, the reflection level can be controlled via the
MOMO_REFLECTION_LEVEL (where 0 means no reflection code is included).

more reflection variables will be introduced as needed.

For now, the memory manager's layout state version is used to track
whether the memory layout is changed or not (at the lowest level). the
win_emu API consumer can use this reflection to decide to whether to
refresh or not expensive computations
2025-01-20 11:19:33 -08:00
momo5502
2e1fa4554a Extract windows-gdb-stub 2025-01-20 20:09:16 +01:00