Commit Graph

1039 Commits

Author SHA1 Message Date
momo5502
b3139cfacd Small fixes 2025-04-13 16:38:50 +02:00
Maurice Heumann
5cbdeaaad5 Implement APC support (#198)
Still not completely done and clean. I think some stuff is still broken
2025-04-13 15:16:47 +02:00
momo5502
2ed35d94b9 Set correct status 2025-04-13 15:00:39 +02:00
momo5502
7910021124 Fix apc dispatching 2025-04-13 14:28:35 +02:00
momo5502
30e77f5f9a Fix NtQueueApcThreadEx 2025-04-13 14:12:14 +02:00
momo5502
a3f811a466 Support all APC queue syscalls 2025-04-13 13:39:09 +02:00
momo5502
c1e621c2cd Basic hacky working APC dispatching 2025-04-13 13:39:09 +02:00
momo5502
a8926592bc Prepare APC dispatching 2025-04-13 13:39:09 +02:00
momo5502
bb4b159850 Implement NtQueueApcThreadEx2 2025-04-13 13:39:09 +02:00
momo5502
fdab8cd5ec Extend APC test 2025-04-13 13:39:09 +02:00
momo5502
82227e4d41 Prepare NtQueueApcThreadEx2 support 2025-04-13 13:39:08 +02:00
momo5502
9609a550e0 Add APC test 2025-04-13 13:39:08 +02:00
momo5502
71e8aab913 Ignore linter warnings 2025-04-13 13:39:08 +02:00
momo5502
c0252a5f71 Add partial NtContinueEx support 2025-04-13 13:39:08 +02:00
momo5502
f58dec38a2 Prepare APC support 2025-04-13 13:39:08 +02:00
momo5502
4bf2e9287e Use test sample everywhere 2025-04-13 13:38:53 +02:00
momo5502
8e0e81c02d Less intrusive AFD logging 2025-04-12 19:26:07 +02:00
momo5502
532e9d7609 Remove gitattributes 2025-04-12 17:13:51 +02:00
Maurice Heumann
386b5ec249 Bump deps/googletest from 52204f7 to e90fe24 (#196)
Bumps [deps/googletest](https://github.com/google/googletest) from
`52204f7` to `e90fe24`.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e90fe24856"><code>e90fe24</code></a>
<code>gmock-actions</code>: add a missing conversion operator to
<code>WithArgsAction</code>.</li>
<li><a
href="50a9511f50"><code>50a9511</code></a>
<code>gmock-actions</code>: run clang-format.</li>
<li>See full diff in <a
href="52204f78f9...e90fe24856">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
2025-04-12 16:55:17 +02:00
momo5502
1f1e6f4ac4 Upgrade reflect 2025-04-12 16:46:30 +02:00
dependabot[bot]
47c1fe777e Bump deps/googletest from 52204f7 to e90fe24
Bumps [deps/googletest](https://github.com/google/googletest) from `52204f7` to `e90fe24`.
- [Release notes](https://github.com/google/googletest/releases)
- [Commits](52204f78f9...e90fe24856)

---
updated-dependencies:
- dependency-name: deps/googletest
  dependency-version: e90fe2485641bab0d6af4500192dc503384950d1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-04-12 14:38:36 +00:00
Maurice Heumann
ebbcf33932 Fix root creation batch file 2025-04-12 10:30:12 +02:00
momo5502
4efb9fce18 Add batch files again with correct line endings 2025-04-12 10:22:25 +02:00
momo5502
6e254a2b48 Remove batch files 2025-04-12 10:22:01 +02:00
momo5502
b613c89bab Force correct line endings for batch files 2025-04-12 10:20:29 +02:00
momo5502
84399d987d Add quick start 2025-04-12 09:55:52 +02:00
Maurice Heumann
8bad084b74 Add AVX2 support (#195) 2025-04-12 09:11:18 +02:00
momo5502
fb644b8bf1 Disable avx2 for android 2025-04-12 08:54:18 +02:00
momo5502
35092b9cdf Use test-sample as analysis sample 2025-04-12 08:52:24 +02:00
momo5502
b701d44e90 Disable AVX2 for samples 2025-04-12 08:26:38 +02:00
momo5502
f42005ce5d Add avx2 support 2025-04-12 08:26:38 +02:00
Maurice Heumann
49a27eafff Remove dependencies from sample (#194) 2025-04-12 08:26:12 +02:00
momo5502
d0a24ac65c Remove dependencies from sample 2025-04-12 08:09:19 +02:00
Maurice Heumann
b449684bde Cleanup file syscalls (#193) 2025-04-11 21:23:43 +02:00
momo5502
891dafaf26 Cleanup file syscalls 2025-04-11 21:05:11 +02:00
Maurice Heumann
de3f9e5555 Cleanup system information syscalls (#192) 2025-04-11 19:27:32 +02:00
momo5502
facfe2b6bf More system information syscall cleanup 2025-04-11 17:59:30 +02:00
momo5502
915b31c093 Cleanup system information syscalls 2025-04-11 17:44:57 +02:00
momo5502
2c1edc819d Group backend targets 2025-04-11 17:33:38 +02:00
Maurice Heumann
3933019042 refactor(windows-emulator/syscalls): partial refactor of syscalls.cpp… (#191)
refactor(windows-emulator/syscalls): partial refactor of syscalls.cpp,
splits syscall implementations over multiple files
2025-04-11 17:25:34 +02:00
RektInator
8bc49bdd03 refactor(windows-emulator/syscalls): partial refactor of syscalls.cpp, splits syscall implementations over multiple files 2025-04-11 16:42:00 +02:00
Maurice Heumann
d9b6aefeff Run isolated windows test to reduce CI load (#190) 2025-04-11 11:37:44 +02:00
momo5502
7f6edb46f7 Run isolated windows test to reduce CI load 2025-04-11 11:01:53 +02:00
Maurice Heumann
1751ec6e9a Group backends in a dedicated source directory (#189) 2025-04-11 09:25:51 +02:00
Maurice Heumann
1adb16f8e7 feat: spoof rdtsc timings (#185)
Previously, RDTSC in the VM always returned a constant value of 4, which
broke any timing-based operations, or caused detections in heuristics of
malware and ANTI-VM tools.

This patch introduces a spoofed rdtsc_fake counter that tracks and
adjusts timing deltas to simulate realistic TSC increments. Can be
extended to simulate rdtsc timings based on CPU clock speed.
2025-04-11 09:24:36 +02:00
momo5502
705162d069 Cancel in-progress workflows to speedup CI 2025-04-11 09:07:51 +02:00
momo5502
d409c08ef6 Restructure backends 2025-04-11 08:58:49 +02:00
Soham Nandy
ea7f6a68c8 Use auto for timestamp_counter tick type
Co-authored-by: Maurice Heumann <MauriceHeumann@gmail.com>
2025-04-11 12:12:56 +05:30
Soham Nandy
640cd500c3 fix typo on time.hpp
Co-authored-by: Maurice Heumann <MauriceHeumann@gmail.com>
2025-04-11 12:12:31 +05:30
Soham Nandy
daeefb4a7f refactor(rdtsc): clean up code overall
Change type of chrono return to be auto

Co-authored-by: Maurice Heumann <MauriceHeumann@gmail.com>

simplify conditional compile and add #else to prevent clang-tidy breaking CI

Co-authored-by: Maurice Heumann <MauriceHeumann@gmail.com>
2025-04-11 06:39:01 +05:30