Commit Graph

46 Commits

Author SHA1 Message Date
thejanit0r
b00f40aba7 Added support for NtCreateDirectoryObject 2026-01-04 04:31:49 +01:00
66hh
98393c03d2 Add a check before the conversion path 2025-12-27 17:17:24 +08:00
momo5502
f0f223faaa Remove error 2025-12-24 08:58:15 +01:00
momo5502
cb4fe6c30f Merge remote-tracking branch 'origin/main' into wow64 2025-10-25 11:06:03 +02:00
Igor Pissolati
3c6c2e2dde Apply review suggestion 2025-10-23 11:19:35 -03:00
Igor Pissolati
2c82277b5e Add FileIdInformation file info class 2025-10-23 11:19:17 -03:00
Igor Pissolati
46b97fd91c Don't request 'file_size' for directories 2025-10-22 17:21:04 -03:00
Igor Pissolati
c8a18cf61c Add FileIsRemoteDeviceInformation file info class 2025-10-22 17:14:51 -03:00
Igor Pissolati
c0fd8ebf51 Add FileFsAttributeInformation fs info class 2025-10-22 17:14:19 -03:00
Maurice Heumann
304dbcc661 Comprehensive WOW64 subsystem implementation (#555)
# Major Features Implemented
**Core WOW64 Architecture**
1. Full TEB, PEB, and Windows structure implementations for 32-bit
processes
2. Proper thread context switching with 32-bit stack allocation
3. Configurable memory allocation with 32-bit/64-bit address space
handling
4. Automatic WOW64 process identification and handling
5. Heaven's Gate Implementation for handling exceptions

**Enhanced Emulation Features**
1. Fixed GDT setup and segment management for WOW64
2. Multi-architecture PE loading with proper import resolution
3. Segment-aware disassembly with WOW64 debugging capabilities

**Testing & Validation**
**32-bit Test Sample**: Minimal "hello" executable with full ASM source

# TODO
Needs more testing, currently in very early stages.
2025-10-21 20:13:01 +02:00
Igor Pissolati
887b02c240 Support file renaming and support relative path in NtQueryAttributesFile 2025-10-19 17:51:44 -03:00
brian
65eecf1cfd Comprehensive WOW64 subsystem implementation 2025-10-13 19:55:50 +08:00
momo5502
7d6648ade0 Extend clang-format column limit to 140 2025-08-16 14:55:07 +02:00
CarlTSpeak
0aea1f5385 I just learned how clang-format works. Fail. 2025-08-08 11:22:56 +01:00
CarlTSpeak
210ab2930c Fixed platform portability issues 2025-08-06 11:12:44 +01:00
CarlTSpeak
8b2c170236 Fixed clang exception. Again. 2025-08-06 11:01:42 +01:00
CarlTSpeak
ffea72d48a Added basic pipe support to NtRead/WriteFile 2025-08-06 10:30:40 +01:00
CarlTSpeak
100638d8ea Fixed clang-tidy issue 2025-08-05 16:26:13 +01:00
CarlTSpeak
85843ff5c9 Fixed cross-platform: removed MS-specific macro 2025-08-05 15:55:36 +01:00
CarlTSpeak
5f9bfd4694 Added stubs for NtCreateNamedPipeFile NtReleaseWorkerFactoryWorker 2025-08-05 15:44:19 +01:00
CarlTSpeak
cae1cf5c1f Added stubs for NtCreateNamedPipeFile NtReleaseWorkerFactoryWorker 2025-08-05 15:35:31 +01:00
momo5502
08ae52710b Prevent translation of relative files 2025-06-16 18:38:55 +02:00
momo5502
bc77faec3d Move more logging into callbacks 2025-06-06 20:03:53 +02:00
momo5502
f2e0e91630 Isolate more analysis into analyzer 2025-06-05 18:59:27 +02:00
Maurice Heumann
dcee2982ce Update file.cpp 2025-06-03 11:18:10 +02:00
Igor Pissolati
cc2266d934 Add new pseudo-handles 2025-06-02 14:32:15 -03:00
momo5502
ed80b86e22 Fix compilation 2025-06-01 07:54:42 +02:00
momo5502
e763fdac54 Support more syscalls 2025-05-31 21:27:32 +02:00
momo5502
bc92023652 Fix directory enumation with filesystem mappings 2025-05-31 16:31:24 +02:00
momo5502
b6f4645420 Some more syscalls 2025-05-31 13:21:19 +02:00
Igor Pissolati
e0507aa2c5 Fix afd_endpoint::ioctl_connect 2025-05-21 19:28:27 -03:00
Igor Pissolati
5b4193cf92 Fix failing checks 2025-05-20 22:25:31 -03:00
Igor Pissolati
3e1f206bc0 Fixes to file syscalls 2025-05-20 21:44:40 -03:00
Igor Pissolati
a629f77e31 Miscellaneous fixes 2025-04-28 12:48:28 -03:00
Igor Pissolati
61c6ecb65b Fix small oversight 2025-04-24 18:01:17 -03:00
Igor Pissolati
97ec131c50 Improvements to NtQueryDirectoryFileEx 2025-04-24 17:31:49 -03:00
Igor Pissolati
6d0ad1dd61 Stub FileBasicInformation in NtSetInformationFile 2025-04-24 01:01:09 -03:00
Igor Pissolati
8e48793f47 Fix formatting 2025-04-19 17:12:41 -03:00
Igor Pissolati
c702bedaee Add 3 new syscall handlers 2025-04-19 16:33:34 -03:00
Maurice Heumann
91c7ce43a1 Fix reading unicode strings 2025-04-14 15:03:16 +02:00
Maurice Heumann
a6dd9251b8 Prepare 32 bit support 2025-04-14 13:57:54 +02:00
RektInator
e41a3be497 fix: comment unused parameter names 2025-04-14 12:56:09 +02:00
RektInator
6379370a50 fix(syscalls): fix VirtualQuery return size, ignore unimplemented APC flags and log a warning. 2025-04-14 12:43:11 +02:00
RektInator
7bf0b67167 wip 2025-04-14 12:23:08 +02:00
momo5502
891dafaf26 Cleanup file syscalls 2025-04-11 21:05:11 +02:00
RektInator
8bc49bdd03 refactor(windows-emulator/syscalls): partial refactor of syscalls.cpp, splits syscall implementations over multiple files 2025-04-11 16:42:00 +02:00