Commit Graph

615 Commits

Author SHA1 Message Date
momo5502
a895de1a16 Fix allocator skipping 2025-09-13 09:42:15 +02:00
momo5502
847765ec71 Log window access 2025-09-12 21:02:45 +02:00
momo5502
c9c6b46ec2 Support object types information query 2025-09-12 20:36:45 +02:00
momo5502
e55e078e92 Simplify import watching 2025-09-08 19:12:33 +02:00
momo5502
a671deb383 Rename is_within method to contains 2025-09-08 18:40:25 +02:00
momo5502
99249a8b3b Fix printing 2025-09-08 15:37:02 +02:00
momo5502
c81c1468ba Mark RDPID as unavailable 2025-09-07 21:30:11 +02:00
momo5502
2a43b42428 Mark rdtsc(p) as available 2025-09-07 20:43:11 +02:00
momo5502
0af756abd5 Use stored RIP as emulators are unreliable 2025-08-24 16:18:26 +02:00
Maurice Heumann
3cad8df288 Merge remote-tracking branch 'origin/main' into unicorn-upgrade-2 2025-08-24 08:43:38 +02:00
Maurice Heumann
37310a308b Fix Node.js analyzer 2025-08-24 08:43:23 +02:00
momo5502
549be496c4 Merge remote-tracking branch 'origin/main' into unicorn-upgrade-2 2025-08-23 10:40:48 +02:00
Red
257d9f6d02 Fix exception when NtTerminateThread is called on the active thread. 2025-08-22 00:32:05 +02:00
momo5502
5a3d05c64c Fix compilation 2025-08-18 19:16:43 +02:00
momo5502
8e984b8b29 Keep GDTR readable for now 2025-08-18 19:07:12 +02:00
momo5502
2cef0a5511 Make sure GDTR is page aligned 2025-08-18 19:01:09 +02:00
momo5502
584b770def Store previous IP per thread 2025-08-17 07:32:26 +02:00
momo5502
b2eef2bf46 Align processor counts 2025-08-17 07:31:37 +02:00
momo5502
9c29f26647 Small fixes 2025-08-17 07:26:11 +02:00
momo5502
eb3a685f67 Fix initial memory protection 2025-08-16 17:55:51 +02:00
momo5502
7d6648ade0 Extend clang-format column limit to 140 2025-08-16 14:55:07 +02:00
momo5502
127ed1b552 Log rdtsc 2025-08-15 12:54:36 +02:00
momo5502
5fbf065937 Handle debug strings via callback 2025-08-10 10:03:12 +02:00
momo5502
93ff52c2ec Fix ordinals 2025-08-09 21:36:40 +02:00
momo5502
2abe1737f3 Fix android compilation 2025-08-09 17:42:33 +02:00
momo5502
292fc6ce67 Fix compilation 2025-08-09 17:38:20 +02:00
momo5502
386f5b1cbc Add missing types 2025-08-09 17:20:22 +02:00
momo5502
eb6d352a81 Track import access 2025-08-09 17:07:33 +02:00
CarlTSpeak
051cef2212 fix: handle VirtualAlloc invalid size and flags 2025-08-08 14:52:03 +01:00
CarlTSpeak
0aea1f5385 I just learned how clang-format works. Fail. 2025-08-08 11:22:56 +01:00
CarlTSpeak
210ab2930c Fixed platform portability issues 2025-08-06 11:12:44 +01:00
CarlTSpeak
8b2c170236 Fixed clang exception. Again. 2025-08-06 11:01:42 +01:00
CarlTSpeak
ffea72d48a Added basic pipe support to NtRead/WriteFile 2025-08-06 10:30:40 +01:00
CarlTSpeak
100638d8ea Fixed clang-tidy issue 2025-08-05 16:26:13 +01:00
CarlTSpeak
85843ff5c9 Fixed cross-platform: removed MS-specific macro 2025-08-05 15:55:36 +01:00
CarlTSpeak
5f9bfd4694 Added stubs for NtCreateNamedPipeFile NtReleaseWorkerFactoryWorker 2025-08-05 15:44:19 +01:00
CarlTSpeak
cae1cf5c1f Added stubs for NtCreateNamedPipeFile NtReleaseWorkerFactoryWorker 2025-08-05 15:35:31 +01:00
momo5502
6eb4ef33ff Handle invalid page protections
This fixes #420
2025-07-20 09:34:25 +02:00
momo5502
5e57360dc3 Fix buffer overflow 2025-07-18 07:15:54 +02:00
Maurice Heumann
9e5a6b509b Implement guard pages (#406)
Hey, looking for feedback on my guard page implementation. 

I wasn't sure on how to structure the additional windows specific memory
flags, since the emulation backends won't like additional guard flag. I
opted to create a new `memory_permission_ext` enum to hold the guard
flag, and a `nt_memory_permission` struct to wrap the "common" memory
permission flags, with the new extended flags. This struct implicitly
coerces to the original `memory_permission` to reduce the amount of
changes for the PR.

This however meant that I changed signatures of `map_memory` and
`apply_memory_protection` in `memory_interface` to accommodate this new
structure, and was an afterthought.

The `map_nt_to_emulator_protection` function might also need some
attention now, too. For future reference, windows uses
[MiMakeProtectionMask](https://doxygen.reactos.org/d1/d9a/marea_8c.html#adfb66408771a4df77c1056cc2a99ef21)
in ntoskrnl to map `PAGE_*` flags to [MM PTE
constants](https://reactos.org/wiki/Techwiki:Memory_management_in_the_Windows_XP_kernel).

The test added to the `test-sample` binary seems to be passing.

Fixes #21
2025-07-17 17:41:06 +02:00
3fault
f1d54f7417 Parameterize basic_memory_region to support extended memory flags 2025-07-17 11:19:56 -04:00
3fault
9f637105fb Unset extended flags in nt_memory_permission assignment operator 2025-07-17 11:06:26 -04:00
Maurice Heumann
91375b22f9 Try upgrading unicorn 2025-07-13 19:37:56 +02:00
Maurice Heumann
d7a1a269b7 Setup thread before dispatching APC 2025-07-12 21:33:12 +02:00
momo5502
ac2d34c143 Small cleanup 2025-07-12 15:40:04 +02:00
momo5502
7a3a5d760e Fix thread deletion 2025-07-12 15:28:30 +02:00
momo5502
08995a4205 Print memory stats 2025-07-12 14:17:52 +02:00
momo5502
acb65dc10d Log message box arguments 2025-07-09 21:17:32 +02:00
3fault
f4fc9c4a6c fix memory_permissions_ext includes 2025-07-09 14:49:26 -04:00
3fault
19574fb512 remove references to nt_memory_permission from backend 2025-07-09 14:43:06 -04:00