Commit Graph

88 Commits

Author SHA1 Message Date
momo5502
6eb4ef33ff Handle invalid page protections
This fixes #420
2025-07-20 09:34:25 +02:00
Maurice Heumann
9e5a6b509b Implement guard pages (#406)
Hey, looking for feedback on my guard page implementation. 

I wasn't sure on how to structure the additional windows specific memory
flags, since the emulation backends won't like additional guard flag. I
opted to create a new `memory_permission_ext` enum to hold the guard
flag, and a `nt_memory_permission` struct to wrap the "common" memory
permission flags, with the new extended flags. This struct implicitly
coerces to the original `memory_permission` to reduce the amount of
changes for the PR.

This however meant that I changed signatures of `map_memory` and
`apply_memory_protection` in `memory_interface` to accommodate this new
structure, and was an afterthought.

The `map_nt_to_emulator_protection` function might also need some
attention now, too. For future reference, windows uses
[MiMakeProtectionMask](https://doxygen.reactos.org/d1/d9a/marea_8c.html#adfb66408771a4df77c1056cc2a99ef21)
in ntoskrnl to map `PAGE_*` flags to [MM PTE
constants](https://reactos.org/wiki/Techwiki:Memory_management_in_the_Windows_XP_kernel).

The test added to the `test-sample` binary seems to be passing.

Fixes #21
2025-07-17 17:41:06 +02:00
momo5502
ac2d34c143 Small cleanup 2025-07-12 15:40:04 +02:00
momo5502
7a3a5d760e Fix thread deletion 2025-07-12 15:28:30 +02:00
3fault
1276c7e2bc Update occurances of memory_permission to nt_memory_permission where needed 2025-07-01 19:04:22 -04:00
momo5502
08ae52710b Prevent translation of relative files 2025-06-16 18:38:55 +02:00
momo5502
bda89b5d1e Add more syscalls 2025-06-15 19:48:05 +02:00
momo5502
1421550764 Cleanup and fix NtQueryInformationProcess 2025-06-15 09:31:57 +02:00
Red
f14b16d080 Fix anti-debug detections for NtQueryInformationProcess with ProcessDebugObjectHandle 2025-06-14 15:00:53 +02:00
momo5502
906cec808a Small fixes 2025-06-07 20:10:36 +02:00
momo5502
05c5f0a085 Final cleanup 2025-06-07 08:01:02 +02:00
momo5502
da4a4f90c9 Cleanup exception callbacks 2025-06-07 07:54:11 +02:00
momo5502
802e295bcc Adapt more printing 2025-06-07 07:29:30 +02:00
momo5502
9372e27453 Fix module logging 2025-06-07 07:11:27 +02:00
momo5502
bc77faec3d Move more logging into callbacks 2025-06-06 20:03:53 +02:00
momo5502
f2e0e91630 Isolate more analysis into analyzer 2025-06-05 18:59:27 +02:00
momo5502
956e73d839 Some fixes 2025-06-04 20:47:51 +02:00
momo5502
1f829463c1 Use more semantic logging 2025-06-04 20:22:28 +02:00
momo5502
de0d9a17a5 Small fixes 2025-06-04 20:19:47 +02:00
momo5502
84e8e86b94 Extract sus activity logging 2025-06-04 19:28:50 +02:00
Maurice Heumann
dcee2982ce Update file.cpp 2025-06-03 11:18:10 +02:00
Igor Pissolati
9f32620220 Fix failing checks 2025-06-02 14:32:15 -03:00
Igor Pissolati
c67146ee45 Add new syscalls 2025-06-02 14:32:15 -03:00
Igor Pissolati
db1588623b Add KSecDD device and support for devices in NtQueryObject 2025-06-02 14:32:15 -03:00
Igor Pissolati
cc2266d934 Add new pseudo-handles 2025-06-02 14:32:15 -03:00
Igor Pissolati
ad3046466e Improvements to NtQueryInformationToken 2025-06-02 14:32:15 -03:00
momo5502
aa763c8392 Prepare more timer syscalls 2025-06-01 14:05:18 +02:00
momo5502
009961620b Fix thread deletion 2025-06-01 13:57:14 +02:00
momo5502
da658e5178 Prepare timer support 2025-06-01 13:56:45 +02:00
momo5502
c605131a80 Small changes 2025-06-01 12:48:59 +02:00
momo5502
ed80b86e22 Fix compilation 2025-06-01 07:54:42 +02:00
momo5502
e763fdac54 Support more syscalls 2025-05-31 21:27:32 +02:00
momo5502
bc92023652 Fix directory enumation with filesystem mappings 2025-05-31 16:31:24 +02:00
momo5502
b6f4645420 Some more syscalls 2025-05-31 13:21:19 +02:00
momo5502
8abc7a65ef Support svcctrl start event 2025-05-24 11:06:23 +02:00
momo5502
92bdf26669 Fix computername 2025-05-24 11:06:09 +02:00
Igor Pissolati
e0507aa2c5 Fix afd_endpoint::ioctl_connect 2025-05-21 19:28:27 -03:00
Igor Pissolati
5b4193cf92 Fix failing checks 2025-05-20 22:25:31 -03:00
Igor Pissolati
3e1f206bc0 Fixes to file syscalls 2025-05-20 21:44:40 -03:00
Igor Pissolati
4888142d22 Better handling of NtCreateKey 2025-05-20 21:44:18 -03:00
momo5502
d08bcbae9c Add window object 2025-05-18 09:13:26 +02:00
Maurice Heumann
3e7f6e5fc1 Redirect zero base memory image requests to main exe 2025-05-08 18:30:50 +02:00
Igor Pissolati
7a8e6dd459 Fix Windows 2019 Time Zone Test 2025-04-28 18:47:24 -03:00
Igor Pissolati
a629f77e31 Miscellaneous fixes 2025-04-28 12:48:28 -03:00
Maurice Heumann
be9d0164d7 Improvements to NtQueryDirectoryFileEx (#235)
This PR aims to:
- [Stub FileBasicInformation in
NtSetInformationFile](6d0ad1dd61)
- [Make sure a root `windows_path` have slash at the
end](02ed4fbb03),
this was necessary because `directory_iterator` fails when the path is
`C:` (without slash)..
- [Improve
NtQueryDirectoryFileEx](f6ec1fc9cc)
by adding filename filtering support, including more basic file
information in the struct, and fixing an issue that prevented the last
chunk of files from being enumerated correctly.
2025-04-25 08:32:47 +02:00
Igor Pissolati
61c6ecb65b Fix small oversight 2025-04-24 18:01:17 -03:00
Igor Pissolati
97ec131c50 Improvements to NtQueryDirectoryFileEx 2025-04-24 17:31:49 -03:00
Igor Pissolati
6d0ad1dd61 Stub FileBasicInformation in NtSetInformationFile 2025-04-24 01:01:09 -03:00
Igor Pissolati
a3a786c6ec Fix failing check 2025-04-23 18:41:56 -03:00
Igor Pissolati
3b918f2d5c Stub SystemFirmwareTableInformation in NtQuerySystemInformation 2025-04-23 18:24:12 -03:00