Commit Graph

626 Commits

Author SHA1 Message Date
Igor Pissolati
c8a18cf61c Add FileIsRemoteDeviceInformation file info class 2025-10-22 17:14:51 -03:00
Igor Pissolati
c0fd8ebf51 Add FileFsAttributeInformation fs info class 2025-10-22 17:14:19 -03:00
Maurice Heumann
b84ae7475f Implement ALPC port abstraction and implement DNS resolver port (#558)
This PR introduces an abstraction for ALPC ports to make them easier to
manage in the future, and implements the DNS resolver port, at least
enough to get host address queries working.
There's a lot of code in this PR that I'm not very confident about, so
don't hesitate on the feedback 😄

<img width="1377" height="624" alt="image"
src="https://github.com/user-attachments/assets/4d56b84d-4b87-42ed-9bfa-be04dbbf3735"
/>
2025-10-21 20:42:26 +02:00
Maurice Heumann
7799f3dd74 Small timing fix (#563) 2025-10-21 20:35:19 +02:00
momo5502
facf997120 Small timing fix 2025-10-21 20:12:04 +02:00
Igor Pissolati
dc3a0e6fd4 Small improvements 2025-10-21 11:23:57 -03:00
Maurice Heumann
0e158b6064 Implement file renaming and relative path handling in NtQueryAttributesFile (#557)
This PR introduces several enhancements, mainly to the file system
syscalls:

- Implements file renaming via `NtSetInformationFile` by adding a
deferred rename mechanism to `file_handle`. The rename operation occurs
when the file handle is closed.
- Adds support for the `RootDirectory` parameter in
`NtQueryAttributesFile` to handle relative file paths.
- Adds support for opening the console output device (`\\??\\CONOUT$`).
- Stubs out the `NtLockVirtualMemory` syscall.
- Fixes an incorrect assertion in `socket_wrapper` that could fire on
`recvfrom` errors.
2025-10-20 15:08:37 +02:00
AlexGuo1998
66c7c3126d Fix std::chrono::system_clock::now()
In `ntdll!RtlGetSystemTimePrecise`, `kusd.SystemTime` is queried first, and QPC offset (`QPC() - kusd.BaselineSystemTimeQpc`) is added if it's larger than 0.
Setting `kusd.BaselineSystemTimeQpc` to `UINT64_MAX` avoids the adjustment, so incorrect adjustments won't happen.
Alternatively, We can update `kusd.BaselineSystemTimeQpc` to be the QPC value just when `kusd.SystemTime` changes, but that's not possible, because we cannot monitor `kusd.SystemTime` for change.
2025-10-20 10:30:44 +08:00
Igor Pissolati
248c09d554 Implement ALPC port abstraction and implement DNS resolver port 2025-10-19 23:23:29 -03:00
Igor Pissolati
887b02c240 Support file renaming and support relative path in NtQueryAttributesFile 2025-10-19 17:51:44 -03:00
momo5502
9453123db0 Force new line at EOF 2025-10-12 17:21:51 +02:00
momo5502
a895de1a16 Fix allocator skipping 2025-09-13 09:42:15 +02:00
momo5502
847765ec71 Log window access 2025-09-12 21:02:45 +02:00
momo5502
c9c6b46ec2 Support object types information query 2025-09-12 20:36:45 +02:00
momo5502
e55e078e92 Simplify import watching 2025-09-08 19:12:33 +02:00
momo5502
a671deb383 Rename is_within method to contains 2025-09-08 18:40:25 +02:00
momo5502
99249a8b3b Fix printing 2025-09-08 15:37:02 +02:00
momo5502
c81c1468ba Mark RDPID as unavailable 2025-09-07 21:30:11 +02:00
momo5502
2a43b42428 Mark rdtsc(p) as available 2025-09-07 20:43:11 +02:00
momo5502
0af756abd5 Use stored RIP as emulators are unreliable 2025-08-24 16:18:26 +02:00
Maurice Heumann
3cad8df288 Merge remote-tracking branch 'origin/main' into unicorn-upgrade-2 2025-08-24 08:43:38 +02:00
Maurice Heumann
37310a308b Fix Node.js analyzer 2025-08-24 08:43:23 +02:00
momo5502
549be496c4 Merge remote-tracking branch 'origin/main' into unicorn-upgrade-2 2025-08-23 10:40:48 +02:00
Red
257d9f6d02 Fix exception when NtTerminateThread is called on the active thread. 2025-08-22 00:32:05 +02:00
momo5502
5a3d05c64c Fix compilation 2025-08-18 19:16:43 +02:00
momo5502
8e984b8b29 Keep GDTR readable for now 2025-08-18 19:07:12 +02:00
momo5502
2cef0a5511 Make sure GDTR is page aligned 2025-08-18 19:01:09 +02:00
momo5502
584b770def Store previous IP per thread 2025-08-17 07:32:26 +02:00
momo5502
b2eef2bf46 Align processor counts 2025-08-17 07:31:37 +02:00
momo5502
9c29f26647 Small fixes 2025-08-17 07:26:11 +02:00
momo5502
eb3a685f67 Fix initial memory protection 2025-08-16 17:55:51 +02:00
momo5502
7d6648ade0 Extend clang-format column limit to 140 2025-08-16 14:55:07 +02:00
momo5502
127ed1b552 Log rdtsc 2025-08-15 12:54:36 +02:00
momo5502
5fbf065937 Handle debug strings via callback 2025-08-10 10:03:12 +02:00
momo5502
93ff52c2ec Fix ordinals 2025-08-09 21:36:40 +02:00
momo5502
2abe1737f3 Fix android compilation 2025-08-09 17:42:33 +02:00
momo5502
292fc6ce67 Fix compilation 2025-08-09 17:38:20 +02:00
momo5502
386f5b1cbc Add missing types 2025-08-09 17:20:22 +02:00
momo5502
eb6d352a81 Track import access 2025-08-09 17:07:33 +02:00
CarlTSpeak
051cef2212 fix: handle VirtualAlloc invalid size and flags 2025-08-08 14:52:03 +01:00
CarlTSpeak
0aea1f5385 I just learned how clang-format works. Fail. 2025-08-08 11:22:56 +01:00
CarlTSpeak
210ab2930c Fixed platform portability issues 2025-08-06 11:12:44 +01:00
CarlTSpeak
8b2c170236 Fixed clang exception. Again. 2025-08-06 11:01:42 +01:00
CarlTSpeak
ffea72d48a Added basic pipe support to NtRead/WriteFile 2025-08-06 10:30:40 +01:00
CarlTSpeak
100638d8ea Fixed clang-tidy issue 2025-08-05 16:26:13 +01:00
CarlTSpeak
85843ff5c9 Fixed cross-platform: removed MS-specific macro 2025-08-05 15:55:36 +01:00
CarlTSpeak
5f9bfd4694 Added stubs for NtCreateNamedPipeFile NtReleaseWorkerFactoryWorker 2025-08-05 15:44:19 +01:00
CarlTSpeak
cae1cf5c1f Added stubs for NtCreateNamedPipeFile NtReleaseWorkerFactoryWorker 2025-08-05 15:35:31 +01:00
momo5502
6eb4ef33ff Handle invalid page protections
This fixes #420
2025-07-20 09:34:25 +02:00
momo5502
5e57360dc3 Fix buffer overflow 2025-07-18 07:15:54 +02:00